Privacy Policy

1. Data controller

The data controller for the purposes of the GDPR is:

Signava, MB
Company code 308055293 · Not VAT-registered
V. Nageviciaus g. 3
Vilnius, LT-08237
Republic of Lithuania
Email: privacy@signava.expert

Where we act as a data processor on a client's behalf under a specific engagement, our obligations are governed by the Data Processing Agreement attached to that engagement rather than this policy alone.

2. What data we collect

We collect three distinct categories of personal data:

• Website visitors: contact form submissions (name, company, email, message) and basic technical data from standard server logs (IP address, browser type, pages visited).
• Research participants: data volunteered during interviews, focus groups, or surveys conducted as part of a commissioned study — for example opinions, demographic details, and, for qualitative fieldwork, recorded or transcribed responses. We collect only what a given study's methodology requires, as agreed with the commissioning client.
• Client contacts: names, roles, and contact details of individuals we work with at client organizations, plus billing and company information.

3. How we use data

Website enquiry data is used only to respond to your message and, where relevant, to prepare a proposal. Research participant data is used solely for the analysis purposes defined in the relevant study, and is anonymized or pseudonymized in client-facing deliverables unless a participant has given explicit, informed consent to be identified. We do not use participant data for any purpose beyond the study it was collected for.

4. Legal basis for processing

We rely on the following legal bases under Article 6 GDPR:

• Consent — for research participants taking part in interviews, focus groups, or surveys. Consent is obtained before data collection begins and is specific to that study.
• Contract — for processing necessary to deliver a service a client has commissioned, or to respond to your enquiry.
• Legitimate interest — for responding to website enquiries, basic security logging, and site functionality.
• Legal obligation — where retention or disclosure is required by Lithuanian or EU law, such as tax record-keeping.

5. International data transfers

Signava, MB is registered in the EU, while a substantial portion of our research fieldwork is conducted in Indonesia, which does not hold a European Commission adequacy decision. Where personal data collected during fieldwork is transferred into our EU-based systems, or accessed by fieldwork partners located outside the European Economic Area, we require appropriate safeguards under GDPR Chapter V — including contractual data-protection clauses consistent with the European Commission's Standard Contractual Clauses — before that partner is given access to any personal data, together with minimization of identifiable data wherever the study design allows it.

6. Retention

We keep personal data only for as long as necessary for the purpose it was collected:

• Website contact-form submissions: up to 12 months, unless a client relationship develops.
• Server logs (IP address, browser type, pages visited): kept by our hosting provider for a limited period for security and troubleshooting, then deleted automatically.
• Research participant data: for the retention period agreed for that specific study, typically 12–24 months after study completion, after which it is deleted or fully anonymized.
• Billing and contract records: retained per Lithuanian statutory requirements for tax and accounting purposes.

7. Storage & security

Personal data is stored on access-controlled systems, encrypted in transit, and retained only for as long as necessary to fulfil the purpose it was collected for. See our Security Standards page for the technical and organizational measures we use to protect it.

8. Data sharing

We do not sell personal data. Research participant data is never shared with a commissioning client in identifiable form without explicit consent — clients receive anonymized findings and aggregated analysis. Data may be shared with trusted processors (for example, secure hosting or email providers) strictly under data processing agreements, or where required by law.

9. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure ("right to be forgotten")
• Object to or restrict certain processing
• Request data portability
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI)

To exercise any of these rights, contact us at privacy@signava.expert.

10. Cookies

As of the date at the top of this page, signava.expert does not set cookies for analytics, advertising, or tracking purposes, and we do not use third-party trackers. Fonts and scripts are served from our own server, so loading a page does not send your data to other services such as Google. The only cookie the site uses is a strictly necessary session cookie, set solely when a team member logs in to internal tools; it is deleted on logout or when the browser is closed. If this changes in the future — for example, if we add analytics tooling — this policy will be updated first, and we will request your consent before any non-essential cookie is set, in line with GDPR and the ePrivacy Directive.

11. Children's data

Our services are not directed at individuals under 18, and we do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy periodically. Material changes will be posted on this page with an updated effective date.

13. Contact

Questions about this policy can be directed to:

Signava, MB
V. Nageviciaus g. 3, Vilnius, LT-08237, Republic of Lithuania
privacy@signava.expert

For our contractual terms, see Terms & Conditions.