Privacy and Cookie Policy

Updated: 22 October 2026.

This policy explains how personal data is processed when you use itinstitutas.lt and its Lithuanian and English versions. Separate project websites, subdomains, learning environments and external services may have their own privacy terms.

1. Data controller

Viešoji įstaiga „Informacinių technologijų institutas“ (a public institution), legal entity code 134927830. Address: K. Petrausko g. 26–117, LT-44156 Kaunas, Lithuania. Email: info@itinstitutas.lt. Telephone: +370 618 46396. You can use these contact details for questions about your personal data and this policy.

2. What data is processed and why

• Website delivery and security. When you use the website, your IP address, request time, requested page address, technical information about your browser and device, and error and security event data may be processed. This information is needed to deliver the website, identify faults and protect against misuse. The legal basis for processing personal data is our legitimate interest in ensuring the website’s operation and security (Article 6(1)(f) of the GDPR).
• Your enquiries. When you contact us by email or telephone, we process the contact details you provide, the content of your enquiry and the information needed to respond. The legal basis is our legitimate interest in responding to enquiries; where you contact us about entering into or performing a contract, Article 6(1)(b) of the GDPR applies. Please do not provide sensitive data that is unnecessary for your enquiry.
• Storing consent preferences. CookieYes cookies store the selected status of cookie categories. They are needed to apply your choices and are not Google Analytics tracking cookies.
• Website analytics. Google Analytics 4 is used only with your consent. Data processed may include pseudonymous browser identifiers, visit and interaction data, pages viewed, traffic source, and device and browser information. The legal basis is consent (Article 6(1)(a) of the GDPR). Pseudonymous data is not considered fully anonymous.
• Sign-in and administration. Sign-in, security and administration preference cookies are used for authorised users. They do not apply to every ordinary visitor.

3. Cookies and consent management

Cookies are small data records stored in your browser. Essential cookies are needed to provide the service, maintain security and remember your preferences. Optional analytics cookies are used only with consent. You can accept all, reject optional cookies or choose individual categories. Rejecting analytics does not prevent you from reading the website’s content.

You can change your consent at any time by selecting “Tvarkyti sutikimą” at the bottom of the website, opening “Slapukų nustatymai”, disabling the analytics category and saving your choice, or rejecting optional cookies. In the English version, the corresponding control is labelled “Cookie settings”. When consent is withdrawn, the website removes its Google Analytics cookies and no longer loads the analytics tag. Withdrawal does not affect the lawfulness of earlier processing and does not automatically delete data previously transmitted to the service provider.

You can also delete or block cookies in your browser. If you delete consent cookies, you may be asked to choose again. Blocking essential cookies may prevent some features, especially sign-in, from working.

4. Cookie inventory

The inventory was updated following checks on 22 October 2026. “Observed” refers to the expiry seen during these checks, which may vary depending on your browser, sign-in status and settings. “Session” means a browsing or sign-in session. An asterisk in a name indicates a variable part. Only “_ga” and “_ga_H3GXY53R29” in the table are classified as analytics cookies; the other entries serve consent preferences, language, operation, security or administration.

A cookie’s lifetime in your browser is not the same as the retention period for data stored on the service provider’s servers. Browsers may shorten a cookie’s lifetime, and it may be renewed while you use the service. A cookie observed in an administrator session is not necessarily set for a visitor who is not signed in. An empty category in the cookie settings window does not, by itself, mean that cookies of that type are used.

5. Service providers and data transfers

Hosting, technical maintenance and security solutions are used to operate the website. Data may be accessible to providers of these services to the extent necessary for their functions, and to authorities where required by law.

If you consent to analytics, data is received by the Google service provider. Information about Google’s data processing is available in Google’s Privacy Policy and its explanation of data collected on partner websites. In providing the service, data may also be processed outside the European Economic Area. Such transfers must have an appropriate basis and safeguards under Chapter V of the GDPR. You may ask the data controller for information about the safeguards applicable to a specific transfer.

The website’s Mulish font (also used under the name Muli), Open Sans and Playfair Display fonts are served from local website files rather than Google Fonts servers.

6. Links and external content

The website contains links to project websites, social networks and other services. When you open an external service, you use an environment governed by its own privacy terms. If a page contains embedded external content, its provider may receive technical data and use its own technologies. The inventory in this policy does not cover all cookies used by other websites or subdomains.

7. Data retention

Cookie expiry periods are listed in the inventory. Enquiry data is retained for as long as needed to handle the enquiry, carry out related actions and manage potential claims; documents subject to statutory retention requirements are kept for the applicable periods. The need to retain technical and security records depends on troubleshooting, incident investigation and system protection purposes. Analytics data is subject to the retention periods configured in the Google Analytics account; these are not determined by cookie expiry. The specific server log and analytics account retention settings were not verified during this cookie check. Information about the retention period applicable to your data will be provided on request.

8. Your rights

Subject to the conditions set out in the GDPR, you may request access to, rectification or erasure of your data, restriction of processing, data portability, object to processing based on legitimate interests and withdraw consent. Please contact info@itinstitutas.lt. Where necessary, we may request proportionate information to verify your identity or clarify your request. We normally respond within one month and will inform you of any extension permitted by law.

If you believe your rights have been infringed, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania or another competent supervisory authority.

9. Policy updates

This policy is updated when the website’s features, services or cookies change. The date of the latest version is shown at the beginning of the page.