Privacy policy

1. Who is responsible for your data

The controller of personal data submitted through this website is Kazimieras Sadauskas. For questions about privacy or your personal data, write to hello@ksadauskas.com.

2. What information I collect

When you use the contact form, I may receive your name, email address or phone number, preferred session format, message, confirmation that you have read the privacy information and, only if you select it, separate consent to process sensitive information included in your message. If you contact me by email or through a social network, I receive the contact details and correspondence you provide through that channel.

After a session, I keep brief notes for continuity. They may include the date, topics described in general terms, relevant observations, agreed directions or next steps and, where appropriate, a recommendation to contact another professional. I deliberately avoid unnecessary intimate detail, do not assign diagnoses, and do not make audio or video recordings without separate, explicit consent.

Payment and accounting information may include your name, contact and billing details, amount, date, payment method, payment purpose, invoice or transaction reference, and other particulars required by law.

Website hosting and security providers may also temporarily process technical information such as your IP address, browser or device information, and server logs. On each visit, the site’s first-party statistics increase aggregate counters by date, page viewed, country, selected language, referring website domain or campaign source, and device-size category. Page-view and event counts are also aggregated by source and campaign label. They also count when form completion begins, whether submission succeeds or fails, and use of contact buttons, language selection, email, and social links. These statistics use no cookies or visitor identifier; IP addresses, full browser identifiers, message content, and individual visitor profiles are not stored in the statistics database. The private practice register records enquiry, booking and attended-session dates, language, source, campaign code and whether a session is a repeat. Related entries use a random code that is not linked to a website visitor identifier. It contains no names, contact details or conversation content and retains a history of corrections and removals.

Only after separate consent, Google Analytics 4 may collect information about pages viewed, approximate location, device, browser, referring source, scrolls, outbound and social-link clicks, language changes, contact-button use, and successful contact-form submissions. Contact-form fields, message content, and the contact details you provide are not sent to Google Analytics.

3. Purposes and legal bases

• To reply to your enquiry and arrange a session, information is processed at your request before entering into an agreement or while carrying it out (Article 6(1)(b) GDPR).
• To protect the website and form, and prevent spam or misuse, technical information may be processed on the basis of legitimate interests (Article 6(1)(f) GDPR).
• Aggregated first-party usage statistics are processed on the basis of legitimate interests so that I can understand how the website is found and used, and improve it in practical ways (Article 6(1)(f) GDPR).
• Google Analytics is enabled only with your consent (Article 6(1)(a) GDPR). You can change or withdraw consent at any time through “Analytics settings” in the page footer.
• If, despite the recommendation not to, you choose to include health or other sensitive information in your initial message, it is processed only when you select the separate optional explicit-consent checkbox (Article 9(2)(a) GDPR). Acknowledging the privacy policy does not provide that consent.
• Session notes are processed to carry out our agreement and preserve continuity (Article 6(1)(b) GDPR). Before health or other special-category information is recorded in the notes, I ask for separate, explicit consent (Article 9(2)(a) GDPR).
• Payment information is processed to carry out our agreement (Article 6(1)(b) GDPR), while invoices and mandatory accounting records are processed to comply with legal obligations (Article 6(1)(c) GDPR).
• Where necessary to comply with a legal obligation or establish, exercise, or defend legal claims, relevant information may be retained for as long as required.

4. Who receives the information

The contact form is submitted directly to FormSubmit over an encrypted HTTPS connection, and FormSubmit forwards the information to my Proton Mail inbox. Required fields and input length are checked in the browser before submission, and a hidden anti-spam field is used. Website hosting and security providers process technical and aggregated usage information only as needed to deliver, protect, and evaluate use of the website.

Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland, provides the Proton Mail infrastructure and acts as a processor to the extent it processes data from my practice to provide that service under the Proton Data Processing Agreement. Message bodies and attachments received in the Proton Mail inbox are stored with zero-access encryption; account and service metadata is also governed by the Proton Privacy Policy.

Brief session notes are stored separately in encrypted, access-controlled digital storage. I am the only person with routine access. Payment information may be shared with a payment provider, bank, or accountant only as needed to complete the payment and meet legal requirements.

If you consent to analytics, the information is received by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes Google Analytics 4 customer data under the Google Ads Data Processing Terms; Google may also process limited service-usage and security data for its own purposes as described in the Google Privacy Policy.

If you choose to write through LinkedIn, Facebook, or Instagram, the privacy terms of that social network also apply. I do not sell, rent, or use personal data for advertising.

5. Transfers outside the EEA

FormSubmit, Proton Mail, social networks, or technical infrastructure providers may process data outside the European Economic Area. Where this happens, providers must rely on a lawful transfer mechanism, such as an adequacy decision of the European Commission or Standard Contractual Clauses.

If you do not want your initial message routed through FormSubmit, you can contact me directly by email. I recommend not including detailed health information in the initial enquiry; if relevant, we can discuss it during the session.

6. How long information is kept

I retain enquiry and correspondence data for up to 12 months after the last contact if no session takes place or the conversation does not continue. If sessions take place, administrative correspondence is kept for up to 24 months after the last session, except where longer retention is required for accounting, legal claims, or another legal obligation.

Session notes are kept for up to 24 months after the last session and are then deleted or irreversibly anonymised. You may request earlier deletion; I will comply unless a specific item must still be retained to meet a legal obligation or establish, exercise, or defend legal claims. If consent to special-category processing is withdrawn, I stop recording that information and delete it where no other lawful retention ground applies.

Invoices and mandatory accounting records are retained for 10 years from issue where that period is required by applicable accounting or tax law. Information that is not needed for accounting is not retained merely because a payment was made.

FormSubmit states in its help information that submissions made before a form is confirmed may be retained for up to 30 days. Its processing and retention are also governed by its own privacy policy.

First-party aggregate visit and action counters are automatically deleted after 14 months. Manual records and their revision history are deleted when every version’s event date is older than 14 months. Hosting and security logs are retained by infrastructure providers for their reasonable security and operational periods.

Google Analytics user- and event-level data retention is set to 14 months. This setting does not apply to standard aggregated Google Analytics reports, which may be subject to different service retention periods.

7. Your rights

Depending on the circumstances, you may have the right to access, correct, or erase your information; restrict or object to processing; receive information you provided in a portable format; and withdraw consent. Withdrawal does not affect processing that was lawful before the withdrawal.

To exercise these rights, write to the email address above. I will respond within the time required by law. If you believe your data has been handled improperly, you may complain to the Lithuanian State Data Protection Inspectorate.

8. Security, cookies, and external links

I use reasonable technical and organisational measures to protect information from unauthorised access, alteration, or loss. No method of internet transmission is entirely risk-free, so include only the information needed to establish initial contact.

First-party aggregate statistics use no cookies and do not link visits to the same person or device. The Google Analytics tag is not loaded and analytics cookies are not set until you select “Accept”. If accepted, the first-party cookies “_ga” and “_ga_<identifier>” may be used to distinguish the browser and session and calculate usage statistics. Their default maximum lifetime is two years, although the browser may limit it. Advertising storage, advertising user data, and ad personalisation remain disabled at all times.

Your “Accept” or “Reject” choice is stored in local browser storage until you change it, clear your browser data, or the browser removes it. You can change consent at any time through “Analytics settings” in the page footer; if you select “Reject”, the site also attempts to remove the Google Analytics cookies it set.

The main website address opens the Lithuanian page. You choose a language using the LT and EN links; it is indicated by the /lt or /en page address. Country and browser settings do not override that choice. Campaign labels may be retained on internal links without a visitor identifier or additional cookies.

The private dashboard can save an administrator-selected exclusion preference in browser local storage to exclude future visits from first-party statistics. It is not a visitor identifier. Cloudflare security features may set the essential “__cf_bm” cookie before analytics consent. It is used to identify and limit automated malicious traffic, its contents are encrypted, and it expires after 30 minutes of inactivity. This site does not use it for advertising or visitor profiling.

Essential technical information may be processed to deliver and secure the website. When you follow an external link, further processing is governed by that provider’s terms.

9. Changes to this policy

This policy may be updated when the website, service providers, or legal requirements change. The latest version will remain available on this page with its revision date.