- 1. Who is responsible
- 2. What we collect
- 3. Why we use it, and on what legal basis
- 4. Who we share it with
- 5. Transfers outside the EU/EEA
- 6. How long we keep it
- 7. Security
- 8. Your rights
- 9. Cookies
- 10. Changes
- 11. Contact
This policy explains how Ofski, MB collects and uses personal data in connection with OFSKI EMS (the “Service”).
1. Who is responsible
Ofski, MB, company code 304215619, Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania. Email: info@ofski.dev.
We have not appointed a data protection officer; data protection questions go to the address above.
Data inside a Workspace. A Workspace holds the customer’s own data — events, contacts, offers, finances and files. For that data the customer is the controller and we act only as a processor, on the customer’s instructions. Our Data Processing Agreement governs that processing. This policy covers the data for which we are the controller: account, billing and technical data.
2. What we collect
- Account data: name, email address, phone number if you give one, password (stored only as a hash), and the Workspace you belong to.
- Workspace data: the information you or your colleagues enter into the Service. See the note in section 1.
- Billing data: company details, VAT code, invoices and payment status.
- Technical data: IP address, browser and device type, sign-in times, actions recorded in audit logs, and server logs.
- Correspondence: the messages you send us by email.
We do not knowingly collect data about children, and we do not use automated decision-making that has legal effects on you.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing and supporting the Service | Performance of a contract |
| Issuing invoices and keeping accounting records | Legal obligation |
| Keeping the Service secure, preventing abuse, investigating incidents | Legitimate interests |
| Improving the Service from aggregated, non-identifying usage data | Legitimate interests |
| Replying to your questions | Performance of a contract, legitimate interests |
4. Who we share it with
We use the following service providers (processors), only to provide the Service:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting servers and backups | EU (Germany/Finland) |
| Hostinger International Ltd | Sending emails | EU (Lithuania) |
They process data on our instructions and are bound by written data protection terms. We may also disclose data to authorities when required by law, and to professional advisers such as our accountant. We do not sell personal data.
5. Transfers outside the EU/EEA
Personal data is processed in the European Union. If a transfer outside the EU/EEA becomes necessary, we will rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses, and will update this policy.
6. How long we keep it
- Account data: while your account exists, and up to 60 days after it is closed.
- Workspace data: as described in our Terms. Trial Workspaces are deleted 30 days after the trial ends; cancelled Workspaces 30 days after the subscription ends; Workspaces locked for non-payment 60 days after locking.
- Backups: deleted data may remain in encrypted backups until those backups expire, normally within 12 months.
- Billing and accounting records: 10 years, as required by Lithuanian law.
- Server and security logs: up to 14 days, unless needed longer to investigate an incident.
7. Security
- Data is encrypted in transit (HTTPS).
- Each Workspace has its own separate database.
- Passwords are stored only as hashes.
- Access is limited to staff who need it, through individual accounts.
- Logs are kept free of passwords and session tokens.
- Backups are encrypted and stored in the EU.
8. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy;
- correct it;
- have it deleted;
- restrict its processing;
- object to processing based on legitimate interests;
- data portability;
- withdraw consent at any time.
To use these rights, email info@ofski.dev. We will reply within one month. You can also complain to the Lithuanian data protection authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the authority in your country.
9. Cookies
We use only cookies that are strictly necessary for the Service to work:
- the sign-in session cookie;
- a security token that protects forms;
- a cookie that remembers your preferences, such as theme.
These do not need consent. We do not use analytics or marketing cookies, so no cookie consent banner is shown.
10. Changes
We may update this policy. We will post the new version here with a new effective date, and tell customers by email about material changes.
11. Contact
Ofski, MB · Naugarduko g. 26-13, LT-03225 Vilnius, Lithuania · info@ofski.dev