Get in touch
Back to the site

Privacy notice

How we handle personal data you send us through this website.

Draft — pending review. This notice was prepared for Sugibana, MB to satisfy GDPR Article 13, but it has not yet been reviewed by a qualified adviser, and the contact form it describes is not yet connected to a backend. Have it checked before relying on it. Retention periods and the processor list in particular need confirming against what is actually deployed.

Last updated: 16 August 2026

Who we are

The controller of your personal data is Sugibana, MB, a private limited liability company registered in Lithuania under company code 308103418, based in Kaunas, Lithuania.

We have not appointed a Data Protection Officer. We are not required to, given our size and the nature of what we process. Write to the address above with any question about this notice and it will reach the people who can answer it.

What we collect, and why

When you use the contact form

We ask for:

  • Your name — so we can address you properly
  • Your email address — so we can reply
  • Your company (optional) — context for the enquiry
  • What you need — so the enquiry reaches the right person
  • Your message — whatever you choose to tell us

We also record the time of submission and the page you sent it from, which we use to spot automated spam.

Purpose: to respond to your enquiry and, if it goes further, to discuss and potentially deliver work for you.
Legal basis: Article 6(1)(b) GDPR — steps taken at your request prior to entering a contract. Where an enquiry is not about a possible contract, our legitimate interest in answering messages people send us, Article 6(1)(f).

Please do not send us special-category data (health, political opinions, biometrics and so on) through this form. We have no reason to ask for it and no basis to process it.

When you email or phone us

We keep the correspondence itself, on the same basis as above. Our email runs on Google Workspace — see the processor list below.

Cookies and tracking

This site sets no cookies and runs no analytics. There is no tracking pixel, no advertising tag, and no third-party script. We deliberately self-host our fonts rather than loading them from a font CDN, so no request leaves your browser to a third party simply because you opened the page.

The one exception is the map in the contact section, and it is off until you click it. If you press "Show interactive map", your browser then connects to OpenStreetMap, which will see your IP address and may set its own cookies. If you never press it, that connection never happens. See the OpenStreetMap Foundation privacy policy.

Because we set no cookies and do no tracking, there is no consent banner to click away.

Who else sees your data

We keep this list short on purpose. Your data is shared with:

  • Our own server infrastructure — contact form submissions are delivered to an automation service running on infrastructure we rent and administer ourselves, hosted within the EU. They are not passed to a third-party form provider.
  • Google Ireland Ltd (Google Workspace) — our email provider. Any message you send us lives in that mailbox.
  • Microsoft Ireland (Azure) — hosts this website. Standard web server logs, including IP addresses, are generated when you load a page.

We do not sell personal data, and we do not share it for advertising. We will disclose data if the law requires it.

Where your data is held

Inside the European Union. Our infrastructure and hosting are EU-based. Google Workspace may involve transfers outside the EEA under the European Commission's Standard Contractual Clauses and its adequacy decision for the EU–US Data Privacy Framework.

How long we keep it

Enquiries that go nowhere
Deleted within 12 months of our last exchange.
Enquiries that become work
Kept for the life of the engagement, then for as long as Lithuanian accounting and limitation rules require us to retain records of it.
Server logs
Rotated on the standard schedule of the hosting platform, typically within 90 days.

Your rights

Under the GDPR you may ask us to:

  • Access the personal data we hold about you
  • Correct it, if it is wrong or incomplete
  • Erase it, where we have no overriding reason to keep it
  • Restrict how we process it
  • Port it to you or another controller in a machine-readable format
  • Object to processing we base on legitimate interests

Email hello@sugibana.com and we will respond within one month. There is no charge.

If you think we have handled your data badly, you can complain to the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) — vdai.lrv.lt. We would rather you told us first, but it is your right either way.

Automated decision-making

We do not make decisions about you by automated means, and we do not profile you. A person reads every enquiry.

Changes to this notice

If we change it, we update the date at the top. Material changes affecting people who have already contacted us will be notified by email.