Privacy policy
This policy explains what happens to your information when you visit emiskas.com or send me a message through the contact form. It is written to be read, not to be survived.
1. Who is responsible
Emilis Paulauskas is the data controller for this site.
- Email: emilis@emiskas.com
- Operating under individual activity (individuali veikla), certificate No. 1490834
- Lithuania
Given the size of this operation, a designated Data Protection Officer is not required. Questions go straight to me at the address above.
2. What this policy covers
This policy covers emiskas.com only. It does not cover GitHub, LinkedIn, or any other site you reach by following a link from here, and it does not cover systems I have built for clients, which are governed by those clients' own policies.
One clarification worth making: my services page offers to build analytics and tracking into client projects. That describes work I do for others. It is not something running on this website.
I also sometimes host work-in-progress client sites on subdomains of this domain, so the client can review them before launch. Those previews are the client's own project and the client's own data. This policy covers this site's own pages.
3. What is collected
Three things, and nothing else:
- Contact form submissions, when you choose to send one.
- Server access logs, recorded automatically by the hosting provider.
- Email correspondence, if we end up in a conversation.
Explicitly not collected: user accounts, passwords, payment details, newsletter subscriptions, analytics, advertising identifiers, behavioural profiles, or anything resembling a tracking profile of you.
4. The contact form
The form asks for your name, email address, message, and optionally your company name.
This website does not store your message in a database. When you submit the form, the message is composed and sent directly to my mailbox by email, and the website keeps no copy. Your data therefore lives in my email account, not on this server.
I use it for one purpose: to reply to you. It is not added to a mailing list, and it is not shared with anyone.
5. Legal bases for processing
- Contact form: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract, and where that does not apply, Article 6(1)(f), my legitimate interest in answering enquiries sent to me.
- Strictly necessary cookies: Article 6(1)(f), legitimate interest in a secure, functioning site. These are also exempt from the consent requirement under the ePrivacy Directive.
- Language cookie: functional, and set only in direct response to your own action of switching language.
- Server logs: Article 6(1)(f), legitimate interest in operating and securing the service.
6. Cookies and local storage
Here is the complete list. There is nothing hidden behind it.
| Name | Type | Set when | Lifetime | What it does |
|---|---|---|---|---|
csrftoken |
Strictly necessary | Every page you visit | 1 year | Protects the contact form against cross-site request forgery. It is set on every page because the language switcher in the header is itself a form. |
django_language |
Functional | Only when you switch language | Until you close the browser | Remembers whether you chose English or Lithuanian. |
sessionid |
Strictly necessary | Only when signing in to the admin area | 14 days | Keeps me signed in to the site's own admin. Ordinary visitors never receive this cookie. |
emk:cookie-notice |
Functional (local storage, not a cookie) | When you dismiss the cookie notice | Until you clear site data | Remembers that you have already seen the notice, so it does not reappear on every page. |
There are no analytics, advertising, or third-party tracking cookies on this site. That is why the notice at the bottom of the page has a single button rather than a consent panel: there is genuinely nothing to consent to.
You can block or delete cookies through your browser settings. One warning: if you block csrftoken, the contact form will stop working, because the site cannot verify the submission came from you.
7. Third parties
Google Fonts
The two typefaces on this site are loaded from Google's font service at fonts.googleapis.com and fonts.gstatic.com. This means that on every page load, your browser sends Google your IP address, your user agent, and the page you are viewing. These requests do not set cookies.
Google is based in the United States. Google is certified under the EU-US Data Privacy Framework, which is the mechanism these transfers rely on. You can read Google's privacy policy for what they do with it.
Hosting
This site runs on a virtual private server from Hostinger (Hostinger International UAB, a company registered in Lithuania). The server itself is in Vilnius, so the site and its logs stay inside the EU. Hostinger processes data on my behalf and provides the infrastructure that records the server logs described below.
Contact form messages are delivered to a Gmail mailbox provided by Google. This is where every enquiry ends up and is stored, so Google holds that data on my behalf.
Nothing on this site is sold, rented, or shared for advertising. There are no data brokers involved.
8. Server logs
Like essentially every web server, the host records technical details of each request: IP address, timestamp, the page requested, the response status, your browser's user agent, and the referring page. These exist for security and for diagnosing faults.
The website's own code writes no visitor records of any kind. These logs are rotated and deleted automatically by the server; they are kept only long enough to investigate faults and abuse.
9. How long things are kept
- Enquiry emails: kept while the conversation is live and for a reasonable period afterwards, for 12 months after our last contact, then deleted.
- Server logs: per the hosting provider's retention policy.
- Cookies: per the lifetimes in the table above.
10. Your rights
Under the GDPR you have the right to:
- Access the personal data I hold about you
- Have inaccurate data corrected
- Have your data erased
- Restrict how it is processed
- Receive it in a portable format
- Object to processing based on legitimate interests
- Withdraw consent, where consent is the basis
To exercise any of these, email emilis@emiskas.com. I will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
In practice, for most visitors the answer to "what do you hold about me" is nothing at all, unless you have sent me a message.
11. Complaints
If you think I have handled your data badly, please tell me first so I can fix it. You also have the right to complain to the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybine duomenu apsaugos inspekcija), at vdai.lrv.lt, or to the supervisory authority in your own country of residence.
12. Automated decision-making
There is none. No automated decision-making, no profiling, no scoring of any kind takes place on this site.
13. Children
This site sells services to businesses. It is not directed at children, and I do not knowingly collect data from anyone under 16.
14. Security
The site is served over HTTPS. Contact form messages are transmitted to Google's mail servers over an authenticated TLS connection. The mailbox that receives them is protected by two-factor authentication, and the site's admin area is protected by a strong, unique password and is not linked from anywhere on the site.
No system is perfectly secure, and I would rather say that plainly than claim otherwise.
15. Links to other sites
The footer and some pages link to GitHub, LinkedIn, and client projects. Once you follow those links you are on someone else's site, under their privacy policy, not this one.
16. Changes to this policy
The date at the top of this page shows when it last changed. If a change is material, the cookie notice will reappear so you have a reason to look again.
17. Contact
Anything at all about this policy, or about your data: emilis@emiskas.com.