Privacy policy

1. Data controller

The controller of your personal data is UAB Yakiwood, company code 305636457, registered office at Butrimonių g. 7, LT-50218 Kaunas, Lithuania.

For privacy questions, contact info@yakiwood.eu or +370 675 64733.

This policy was last updated on 11 October 2026.

2. Data we process

Depending on how you use the website, we may process:

• Enquiry data: your full name, email address, optional phone number, message and project information.
• Newsletter data: your email address, optional name, consent record and subscription source.
• Account data, if account features are used: authentication and profile data handled by our authentication and database provider.
• Chat assistant data: a chat session identifier, your messages, the current page, language and conversation history.
• Technical and security data: IP address, browser information, referring page, submission time, server logs and anti-abuse signals.
• An approximate country inferred from your IP address is used on the contact page only to select relevant representative details. The IP address is checked locally against the GeoLite2 database and is not sent to a geolocation service provider. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
• Usage and preference data held in cookies or browser local storage, as described in the Cookie policy.

3. Purposes and legal bases

We process data only for the stated purposes and on an applicable legal basis:

• To answer enquiries, prepare an individual quote and take steps before a contract — steps at your request before entering a contract or performance of a contract (GDPR Article 6(1)(b)).
• To send newsletters and marketing messages — your consent (GDPR Article 6(1)(a)). You can withdraw consent at any time through the unsubscribe link or by contacting us.
• To manage an account and provide requested website functions — performance of a contract or steps at your request before entering a contract.
• To protect the website, limit automated or excessive requests, diagnose errors and establish or defend legal claims — our legitimate interest in a secure and reliable service (GDPR Article 6(1)(f)).
• To measure website use and run selected marketing through tags managed in Google Tag Manager — your consent. Those tags load only after the relevant analytics or marketing choice.
• To comply with accounting, tax and other mandatory requirements — compliance with a legal obligation (GDPR Article 6(1)(c)).

4. Recipients and service providers

Authorised UAB Yakiwood staff and service providers may receive data only as needed to provide their services. The exact provider depends on the deployment configuration.

• Supabase may provide database, authentication and related infrastructure.
• Resend or a configured SMTP email provider may deliver contact-form emails and other service messages.
• Newsletter subscriptions may be stored in Supabase or sent to a configured Mailchimp or Resend list.
• Google Tag Manager loads only after the relevant consent; the analytics or marketing tags available through it depend on the container settings published at that time.
• OpenAI may receive chat assistant request content only when this optional assistant function is enabled and a generated reply is required.
• Data may also be disclosed to public authorities or professional advisers where required by law or needed to establish, exercise or defend legal claims.

5. Transfers outside the EEA

Where a selected service provider processes data outside the European Economic Area, we rely on an adequacy decision, the European Commission’s Standard Contractual Clauses or another safeguard under Chapter V of the GDPR. You may contact us for information about the safeguard relevant to a particular transfer.

6. Retention

We retain data only for as long as needed for the purpose for which it was collected. Enquiry data is kept as needed to reply, prepare a quote, manage the relationship and, where necessary, establish or defend legal claims. Contract and accounting records are retained as required by applicable law.

Newsletter data is processed until consent is withdrawn or the subscription becomes inactive, except for minimal records that may be needed to honour an opt-out or support a legal claim. Preferences in local storage remain on your device until you clear them or the website feature overwrites them. Cookie durations are described in the Cookie policy.

7. Your rights

Under the GDPR, and depending on the circumstances, you may:

• access your personal data and obtain a copy;
• correct inaccurate or complete incomplete data;
• request erasure or restriction of processing;
• object to processing based on legitimate interests and object to direct marketing at any time;
• receive data you provided in a structured, commonly used and machine-readable format where data portability applies;
• withdraw consent at any time without affecting processing carried out before withdrawal;
• lodge a complaint with the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt).

8. Required data and automated decisions

Required form fields are marked with an asterisk. Without them, we cannot accept the relevant enquiry or subscription. A phone number and newsletter name are optional.

The website does not make decisions based solely on automated processing that produce legal or similarly significant effects for you.