Privacy policy
Codelab, MB is the data controller for personal data collected on codelab.lt. This policy sets out what we collect, why we collect it, how long we keep it, and what you can ask us to do about it. We process personal data under the General Data Protection Regulation (GDPR).
01Data controller
- Name
- Codelab, MB
- Company code
- 302984405
- Address
- Švitrigailos g. 11K-109, LT-03228, Vilnius, Lithuania
- talk@codelab.lt
02What we collect, and on what basis
We only process your data where we have a legal basis for it.
| Data category | Collection method | Legal basis |
|---|---|---|
| Contact detailsName, email, message | The inquiry form on this website | Consent, or pre-contractual relations |
| Usage dataPages viewed, referrer, country, device type | Our own Umami analytics, self-hosted | Legitimate interest in improving the site |
| Product analyticsPages viewed, clicks, feature usage, and, only if you accept marketing/analytics cookies, session replays and a cookie-based identifier | PostHog (EU hosted) | Legitimate interest for pageviews; consent for cookies and replay |
| Advertising dataIP address, cookies, browsing behaviour | The Meta Pixel, loaded only if you accept marketing cookies | Consent |
| Security checksTurnstile token, IP address, device telemetry, browser metadata | The Cloudflare Turnstile widget on our forms | Legitimate interest in blocking spam and bots, GDPR Art. 6(1)(f) |
03Why we process your data
- To reply when you contact us about our services or a project.
- To issue invoices and meet Lithuanian accounting requirements.
- To see which pages people actually read. If you have consented, we also record anonymised session replays and use them to find pages that confuse visitors.
- To measure how our ads perform and show you relevant ones on Meta platforms, if you accept marketing cookies.
- To keep our forms usable by blocking spam and automated abuse.
04How long we keep it
- Inquiries: two years from your last contact with us.
- Invoices and accounting records: ten years, as Lithuanian law requires.
- Analytics data: 24 months, then deleted.
- Advertising data: until you withdraw consent. Meta applies its own retention periods on top of that.
- Security check data: held by Cloudflare rather than by us.
05Who else sees your data
We do not sell your data. Four companies process parts of it on our behalf.
- Cloudflare (USA) hosts the site and runs our security checks. Turnstile collects your IP address, device characteristics and browser signature to work out whether a request comes from a person or a bot. Their Turnstile privacy policy covers that processing.
- Mailgun (EU region) delivers our email. Anything you send through the contact form reaches us through Mailgun servers inside the European Union.
- PostHog (EU region) processes product analytics and, only if you accept marketing/analytics cookies, session replays.
- Meta Platforms Ireland Ltd handles our advertising, and only if you accept marketing cookies.
Our page-view analytics runs on Umami, on our own servers, and never reaches an outside analytics company. We also use PostHog, hosted in the EU, for product analytics; PostHog only sets a cookie and records session replays once you accept marketing/analytics cookies.
06Cookies
- Essential cookies keep the website working.
- Marketing/analytics cookies come from the Meta Pixel and PostHog. They measure our campaigns, let us see how visitors use the site, and let us show you relevant advertising, and they load only after you accept them.
Umami sets no cookies at all and cannot follow you to other websites, which is why measuring traffic through it does not need your consent. PostHog only starts setting a cookie and recording session replays once you accept marketing/analytics cookies; until then it only sees anonymous, non-persistent pageview data.
You can change your cookie choices whenever you want, either through the banner on this site or in your browser settings.
07Your rights
You can ask us to:
- Show you the data we hold about you, and give you a copy.
- Correct anything that is wrong.
- Erase your data, the so-called right to be forgotten.
- Stop using your data for direct marketing.
- Transfer your data to another controller.
You can also withdraw consent at any time. Anything we processed before you withdrew it stays lawful. To exercise any of these rights, write to talk@codelab.lt.
08Complaints
If you think we have mishandled your personal data, email us first at talk@codelab.lt and we will try to put it right quickly. If we cannot reach an agreement, you have the right to lodge a complaint with the State Data Protection Inspectorate (VDAI) of the Republic of Lithuania.