How we handle your data
The data controller is MB BustoRadar, small partnership (mažoji bendrija), legal entity code 307633577 (Register of Legal Entities of Lithuania), registered office Vytenio g. 15-78, LT-03111 Vilnius, Lithuania. For anything about your data or this notice, write to labas@ikurtuves.lt. We have no data protection officer – we are not required to appoint one. Version of 7 October 2026.
What we process, why and for how long
Your request to contractors
Data: name, email, phone (if you give one), comment, when you want to start, the flat you chose, fit-out package and the calculated estimate, survey answers (without income, payments or down payment – we don't store those), chosen products, the site language, the text of your consent and when you gave it.
Legal basis: your consent (GDPR Art. 6(1)(a)).
Retention: 12 months from your request, then we delete it – both the record and the email copies in the mailbox.
Spam and abuse detection
Data: a salted hash of your IP address (not the address itself) and your browser's User-Agent string (browser, version and operating system), stored with the request.
Legal basis: our legitimate interest in protecting the form and contractors from spam (GDPR Art. 6(1)(f)).
Retention: 90 days, then removed from the request.
Rate limiting
Data: your IP address (for IPv6, the network part) and a hash of the request email address – in server memory only, so that one visitor can't send hundreds of requests, visualisations or statistics events and the same address gets at most one confirmation email a day.
Legal basis: our legitimate interest in protecting the service (GDPR Art. 6(1)(f)).
Retention: deleted within 10 minutes after the limit period ends (the longest is one day); never written to disk.
Server logs
Data: request time, response code and size, the browser's User-Agent string. We don't keep IP addresses, page addresses with parameters, cookies or the referring page (“Referer”) in the logs.
Legal basis: our legitimate interest in keeping the website running and secure (GDPR Art. 6(1)(f)).
Retention: up to 14 days, on the server in Warsaw (Scaleway).
Usage statistics
Data: anonymous events recorded by our server from page requests – results opened and their count, flat page and tab opened, shop link clicked, request sent, visualisation created. No scripts, cookies or storage in your browser for this; no IP addresses or identifiers; the request event has no flat and is rounded to the hour.
This data doesn't identify you, so it isn't personal data.
Retention: as long as needed for statistics.
Giving us your data is optional, but without your name and email we can't pass your request to contractors. We don't use your contact details for anything else, and we don't sell them.
Who receives your data
Contractors: before passing on your contact details we tell you who they are (company name and code), and we pass them only to the ones you approve. Once they have your details, contractors handle them as separate data controllers under their own rules.
Processors that handle data on our behalf and only on our instructions: email delivery (your confirmation and our notification) – Plus Five Five, Inc., trading as “Resend” (USA): it stores the email content and delivery logs in the USA for up to 30 days; transfers rely on EU standard contractual clauses; the mailbox labas@ikurtuves.lt, which receives requests and your emails – Hostinger International Ltd. (Cyprus) under Hostinger’s data processing agreement, some of whose sub-processors are outside the European Economic Area under EU standard contractual clauses; the website server – Scaleway SAS (France), data centre in Warsaw (Poland, EU). No processor uses your data for its own purposes. Requests are read and handled by MB BustoRadar’s manager and a person authorised by him in writing, both bound by confidentiality.
Banks – only if you click a bank link yourself: we pass the flat price, down payment, loan amount, term and flat description (and “first home” if you chose a 10% down payment), without your name, contacts or income. From then on the bank handles the data as a separate controller under its own rules.
Survey answers and browser storage
Your survey answers are in the page address and in this browser. Your income is not in the address: it's kept only in this browser tab, and the address holds only the maximum flat price worked out from it, rounded to €1,000. The address reaches our server with each page request, but we don't store your answers unless you send a request to contractors. In the browser, your answers and the request form draft are kept only in this tab until you close it (session storage) – that's necessary for the survey to work. We don't use cookies.
Images and the map from other websites
Your browser loads flat photos, floor plans and product photos directly from developers' and shops' websites, and map tiles from OpenStreetMap Foundation servers. Those servers then receive your IP address, browser details and our site's address (without the page path or your answers). This lets us show the works from their lawful source without copying them; the legal basis is legitimate interest (GDPR Art. 6(1)(f)). The operators of those websites handle this data as separate controllers under their own rules.
For an AI visualisation we send the floor plan and the chosen style to OpenAI (USA); we don't send any of your personal data.
Your rights
You can withdraw your consent at any time (this doesn't affect processing before the withdrawal), ask to access, correct or delete your data, restrict its processing or receive it to transfer elsewhere, and object to processing based on legitimate interest. Write to labas@ikurtuves.lt – we reply within 30 days. You can lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).