Privacy policy | White Vision Group

1. Data controller

The controller of your personal data is UAB „White Vision Group“, registered address Vilnius, Lithuania. Email: info@whitevg.com.

We process data in accordance with the General Data Protection Regulation (EU) 2016/679, the Law on the Legal Protection of Personal Data of the Republic of Lithuania, and the Law on Electronic Communications. We have not appointed a data protection officer, because our activities do not involve large-scale processing of special categories of data or systematic monitoring of individuals. We answer all data protection questions at the same email address.

This policy applies to the website https://whitevg.com and to every enquiry channel connected with it: contact forms, phone, email and social media messages, when you contact us about property services.

It also applies to the White Vision Group Academy website and its accounts — section 6 covers them separately.

2. What data we collect

In enquiry forms we ask only for what we need to contact you and prepare a reply: your name, phone number, email address and a free-text message. Depending on the type of enquiry, you may also give a property address, a budget range or a preferred viewing time. The form also records which service, property or agent your enquiry relates to, and the consents you ticked.

Marketing attribution data is collected so we know which channel brought you to the site. It consists of UTM parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the referring page address, click identifiers from advertising platforms where present in the link, and the times of your first visit and of your enquiry. This data is attached to the enquiry and helps us understand which advertising spend is worthwhile.

Technical data — IP address, browser type, device type, screen resolution, language settings and time of visit — are processed by our server provider in logs needed to keep the site running, secure, and protected from abuse.

Analytics data — which pages you viewed, how long you spent on them and what you did there — is collected only if you consented to analytics cookies in the cookie banner. Without that consent, the analytics scripts are not loaded at all. More on this in the cookie policy.

Transaction data are processed only once an agency agreement is concluded with you. In that case we need your personal identification number, home address, identity document details and information about the property — data required by the Law on the Notarial Profession, the Law on the Prevention of Money Laundering and Terrorist Financing, and performance of the contract.

We do not collect or ask for special categories of data: information about health, religious or political beliefs, ethnicity or trade union membership. If you are inclined to include such information in a free-text message, please don't — it is not needed to provide the service.

3. Purposes and legal basis of processing

Answering your enquiry and advising you. Legal basis: your consent (Article 6(1)(a) GDPR), given by ticking the box in the enquiry form, or steps taken at your request before entering into a contract (Article 6(1)(b)). Without a name and at least one contact detail we cannot technically answer an enquiry, so those fields are required.

Performing the agency agreement. Legal basis: performance of a contract (Article 6(1)(b)). On this basis we process property data, the viewing schedule, the course of negotiations, buyers' or tenants' contact details, and the documents a transaction requires.

Meeting legal requirements. Legal basis: legal obligation (Article 6(1)(c)). This covers bookkeeping, tax obligations, and the know-your-client procedures required by anti-money-laundering legislation.

Improving our service and keeping the site secure. Legal basis: legitimate interest (Article 6(1)(f)). Our legitimate interest is in keeping the site working, making sure enquiries reach the responsible agent, and being able to defend ourselves against possible claims. Before relying on this basis we assess in each case whether our interest is outweighed by your rights and freedoms.

Marketing and newsletters. Legal basis: separate consent (Article 6(1)(a)). This consent stands on its own — if you do not give it, we will still answer your enquiry. You can withdraw it at any time without giving a reason.

4. How long we keep data

Enquiries and correspondence are kept for 3 years from the last contact. We chose that period because property decisions take time to mature — someone who asked about a flat two years ago often comes back, and starting the same conversation from scratch would help neither side.

Agency agreements and transaction documents are kept for 10 years from performance of the contract. That period follows from the general limitation period for claims, the rules on keeping tax records, and anti-money-laundering legislation.

Data held on the basis of marketing consent is kept until you withdraw consent, and for no longer than 3 years from when it was given. After that we either ask for consent again or delete the data.

Server logs are kept for up to 12 months; analytics data — up to 14 months from your last visit. At the end of that period the data is deleted, or anonymised so that you can no longer be identified.

5. Who receives the data

We do not sell personal data or pass it to third parties for marketing. Data goes only to the service providers our business cannot operate without, and only to the extent their function requires. We have a data processing agreement under Article 28 of the GDPR with each of them.

Our CRM system provider — enquiries, contacts, property records and correspondence history are stored in its environment.
Our email delivery provider — replies to enquiries, proposals and, if you have consented, newsletters are sent through it.
Our server and website hosting provider — the site runs, and technical logs are stored, on its infrastructure.
Analytics and advertising platform providers — only if you have consented to the relevant category of cookies.
Notaries, valuers, surveyors, banks and insurers — where a particular transaction requires it, and only with your knowledge.
Legal and accounting service providers — where needed to meet a legal obligation or defend legitimate interests.
Public authorities — only in the cases and to the extent the law provides, for example on receiving a lawful request from a law enforcement authority.

6. The Academy: accounts, learning and purchases

This section applies when you use the White Vision Group Academy website: when you register interest in a course, create an account, buy a course or study. Academy accounts run on a separate server and in a separate database from the client management (CRM) system; a student account is not linked to property clients' records.

Registering interest. If you register interest in a course, your name, email address, optional phone number and message are passed to the client management system as an enquiry and handled like any other enquiry — see sections 2–5.

Account data. When you create an account you give your full name, email address and a password. We do not know the password itself — only a cryptographic hash of it is stored. We also record whether your email address has been confirmed, which version of this policy you accepted and when, and the details of each sign-in session: IP address, browser type and how long the session is valid.

Learning data. While you study, we record which courses you have, which lessons you have completed and when. This is needed so that you can see your progress on any device.

Purchase data. When you buy a course, we record what you bought and when, the price, the payment status and the invoice details. The payment is processed by the payment service provider Paysera LT, UAB: we do not receive or store your card details or online banking credentials.

Purposes and legal basis. We process accounts, learning and purchases in order to conclude and perform the training contract with you (GDPR Article 6(1)(b)). We keep purchase and invoice data to meet accounting and tax legislation (Article 6(1)(c)). We use session IP addresses and limits on sign-in attempts to protect accounts from unauthorised access — this is our legitimate interest (Article 6(1)(f)).

How long we keep it. We keep account and learning data for as long as you have an account. You can delete the account yourself in the account settings — your name, email address, password hash, sessions and learning data are then removed from the system at once. A sign-in session is valid for up to 30 days. We are required to keep purchase and invoice data for 10 years, even if you delete your account.

In addition to the recipients in section 5, Academy data is received by:

The payment service provider Paysera LT, UAB — to the extent needed to carry out the payment. Paysera processes payment data as an independent controller under its own privacy policy.
Our video hosting provider — when you watch course videos, it receives your IP address and the browser details needed to play the video.
Our accounting service provider — invoice data, where needed to meet accounting and tax obligations.

You can change your name and password, and delete your account, yourself in the account settings. You can exercise the other rights in section 8 by writing to us.

7. Transfers outside the European Union

The main tools we use store data on servers in the European Union or the European Economic Area. The parent companies of some analytics and advertising platforms are registered in the United States, so certain technical data may be transferred outside the EEA.

Such transfers rely on a European Commission adequacy decision (the EU–US Data Privacy Framework) or on standard contractual clauses approved by the European Commission, together with supplementary safeguards: encryption, IP address truncation and pseudonymisation. If you do not consent to analytics or marketing cookies, no such transfers take place at all.

8. Your rights

The General Data Protection Regulation gives you rights you can exercise at any time by emailing us. We respond to a request within one month; in complex cases this may be extended by a further two months, and we will tell you if it is. Before acting on a request we must verify your identity.

The right of access. You can obtain confirmation of whether we process your data, and a copy of it, together with information about the purposes of processing, the recipients and the retention periods.
The right to rectification. If you notice that data we hold is inaccurate or incomplete, you can require us to correct or complete it.
The right to erasure. The so-called right to be forgotten applies when the data is no longer needed for the purpose it was collected for, when you withdraw consent, or when it is being processed unlawfully. It does not apply to the extent that the law requires us to keep the data.
The right to restrict processing. You can require us to suspend processing temporarily — for instance while the accuracy of the data is checked, or while your objection is considered.
The right to data portability. Data you provided on the basis of consent or a contract can be given to you in a structured, machine-readable format, or transferred to another controller at your request where technically feasible.
The right to object. You can object to processing based on legitimate interest. On receiving such a request we stop, unless we can show compelling legitimate grounds that override your interests. If you object to direct marketing, we stop unconditionally.
The right to withdraw consent. You can withdraw consent at any time; this does not affect the lawfulness of processing carried out before withdrawal. You can withdraw it by replying to any of our emails or by writing to the address given.
The right not to be subject to automated decision-making. You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects. We make no such decisions: enquiries are assigned to an agent by property type and district, but every decision about the service is made by a person.

9. Complaints to the supervisory authority

If you believe we are processing your data unlawfully, please come to us first — most issues are resolved within a few days. If our answer does not satisfy you, you have the right to complain to the State Data Protection Inspectorate at L. Sapiegos g. 17, 10312 Vilnius, by email at ada@ada.lt, or through the Inspectorate's online services. You also have the right to go to court.

10. Data security

The site runs over encrypted HTTPS only. Access to the client management system is granted on a need-to-know basis: an agent sees only the enquiries and properties assigned to them. We use two-factor authentication and individual staff accounts with no shared passwords, and we regularly review who still needs access.

Academy account passwords are stored only as cryptographic hashes, signing in is possible only after the email address is confirmed, and the number of sign-in and password-reset attempts is limited.

Data is backed up daily and the backups are stored encrypted. If a personal data breach occurs that could put your rights and freedoms at risk, we report it to the State Data Protection Inspectorate within 72 hours — and, where the risk is high, to you directly as well.

11. Changes to this policy

We may update this policy when the law, the tools we use or our business change. The current version is always on this page, with its date at the top of the document. For material changes, where we have your contact details and a legal basis to do so, we will also let you know by email.

12. Contact

For any question about personal data, write to info@whitevg.com. You can also send letters to UAB „White Vision Group“, Vilnius. We reply to every request in writing.