Privacy policy

Who processes your data

The data controller is MB VBNetwork (company code 307791342, registered office Mokyklos g. 62 K9-31, LT-00303 Palanga). For any data protection question, write to [email protected].

Other data controllers

Some data is also processed by other, independent controllers:

• The stable you buy a gift voucher from receives the buyer’s name and email and the recipient’s name and message. It processes them as an independent controller to provide the service.
• The payment service provider processes payment data as an independent controller under its own privacy policy. When a stable opens a payout account, the provider collects its identity, business and bank account details itself.

What data we collect

We only collect the data you give us yourself or that the site needs to work.

• Newsletter subscription: email address, chosen language and subscription date.
• Account: name, email address, password (stored only in a form that cannot be reversed) and chosen language.
• Contact form message: name, email address, topic and message text.
• Technical data: IP address and security check data when you submit a form or sign in.
• Stable listing: the stable's name, address, services, description, photos and contacts (phone, email, website, social media pages).
• Payments: invoice details (name or company name, company and VAT numbers, address, email) and the amount, date and method of payment. We never receive card details or bank sign-in details.
• Gift voucher purchase: the buyer’s name and email, the recipient’s name, the message, the voucher code, the price and the payment status.
• A stable’s payout account: the account identifier and its status. We do not receive identity, business or bank account details from the payment provider.
• Visit statistics: the pages visited, the link you came from, browser, device type, language and country. We collect them with a system we run ourselves, without cookies, and we do not store the IP address, so they cannot be tied to you.
• Bank transfer sales: the account holder and account number (IBAN) the stable gives, shown to voucher buyers so they can pay.
• Competition listing: the competition's details, photos, programme, results and the organizer's contacts (name, phone, email, website). These contacts are shown publicly on the competition's page.

Stable details in the directory

The catalog shows the details stable owners submit and confirm themselves. While building it we collected stable names, addresses, services and public contacts from public sources such as the stables' own websites. We do not publish these details until the stable's owner checks and confirms them. We only use them to invite the stable to join the catalog, in no more than two emails. If you do not want these invitations, or want the details deleted, use the link in the email or write to [email protected].

Why we process data and on what basis

• We send the newsletter only with your consent (GDPR Article 6(1)(a)). You can withdraw it at any time with the link at the bottom of every email or by writing to [email protected].
• We process your account so you can use it (GDPR Article 6(1)(b)).
• We process messages to reply and agree on a partnership (GDPR Article 6(1)(b) and (f)).
• We publish stable details based on our legitimate interest in helping visitors find stables (GDPR Article 6(1)(f)).
• We process technical data to protect the site from abuse (GDPR Article 6(1)(f)).
• We handle your stable or competition listing and process payments to perform the listing contract (Article 6(1)(b) GDPR). We keep invoices to meet our accounting obligations (Article 6(1)(c) GDPR).
• We use stables' public contacts to invite them to join the catalog on the basis of our legitimate interest (Article 6(1)(f) GDPR). You can object to this at any time.
• We process a gift voucher buyer’s name and email and the recipient’s name and message to sell the voucher (Article 6(1)(b) GDPR). The stable that issues the voucher receives this data.
• We process a stable’s payout account status to pay it for vouchers sold (Article 6(1)(b) GDPR).
• We process data on refunds and payment disputes to settle them and defend our rights (Article 6(1)(f) GDPR).
• We collect visit statistics on our legitimate interest in improving the site based on how it is used (GDPR Article 6(1)(f)).
• We process the bank account details a stable gives under the contract for selling vouchers by bank transfer (GDPR Article 6(1)(b)).

Who we share data with

We do not sell your data. We share it only with service providers that help run the site and process the data on our instructions:

• the hosting provider whose servers run the site
• the email delivery provider we use to send confirmation and other emails
• the bot protection provider whose tool shields the site's forms from automated requests
• the storage provider that holds the stables' photos, the invoice files and our data backups
• the messaging platform through which our team is notified of new applications and messages
• licensed payment service providers, which process payments. They handle card and bank details, and we only receive the payment status.

We may also disclose data to public authorities when the law requires it.

Transfers outside the EEA

Some providers may process data outside the European Economic Area, for example in the United States. These transfers are protected by the safeguards the GDPR provides for: the European Commission's decision on the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep data

• Newsletter data is kept until you unsubscribe. Once you do, we delete it at once. An unconfirmed subscription is deleted after 30 days.
• Account data is kept until you delete the account, which you can do in your account settings.
• Contact form messages are kept for up to 2 years, then deleted automatically.
• Data backups are kept for up to 2 years.
• We keep a stable listing until you delete it or your account.
• We keep payment and invoice records for 10 years, as accounting law requires.
• We keep the details collected from public sources until the stable joins the catalog or asks us to delete them.
• Gift voucher and payment records are kept for 10 years, as accounting law requires.
• A payout account identifier is kept until you delete your account.
• The bank account details a stable gives are kept until the stable changes them or deletes its account.
• We keep a competition listing, the archive of past competitions included, until you delete it or your account.

Children’s data

The site is meant for adults: only adults create accounts and buy vouchers. If you give a voucher to a child, enter only their first name as the recipient. We do not knowingly collect any other children’s data.

Automated decisions

We make no automated decisions with legal effects on you and do not profile you.

How we protect data

Data travels only over encrypted connections, passwords are stored in a form that cannot be reversed, and signing in to the admin system takes two-factor authentication. If a data breach were likely to put your rights at high risk, we would tell you without delay.

Cookies

We use only necessary cookies, so we do not ask for consent to them. We use no analytics or advertising cookies.

• The session cookie keeps you signed in and keeps form state. It is deleted after 120 minutes of inactivity.
• The security cookie protects forms from forged requests and lasts as long.
• The language cookie remembers your language. The account menu cookie remembers whether the side menu is open. These cookies are kept for up to 1 year.
• The tool that protects the forms may use technical browser data to recognise bots.
• The remember-me cookie is set only when you tick “Remember me” and lasts up to 400 days. It saves you signing in again on the same device.

Your rights

Under the GDPR you have the right to:

• access your personal data
• have inaccurate data corrected
• have your data erased
• restrict or object to processing
• receive your data in a machine-readable format
• withdraw consent at any time

To use these rights, write to [email protected]. We may ask you to confirm your identity before answering. We answer within one month, and in complex cases we may extend this by two more months, telling you so.

Where to complain

If you think your data is handled improperly, please write to us first. You also have the right to complain to the State Data Protection Inspectorate (L. Sapiegos g. 17, 10312 Vilnius, www.vdai.lrv.lt).

Changes to this policy

We may update this policy. The latest version is always published on this page with the date it was updated. We tell account holders about material changes by email.