Privacy Policy
Last updated: 17 July 2026
This Policy explains personal-data processing when the FormiBook public website and system are used. The controller for the processing described as its own is the legal entity identified under “Controller details” (the Controller).
We aim to collect only necessary data and clearly distinguish when the Controller determines the purposes of processing and when it acts on a user’s instructions.
1. Controller
The Controller provides the FormiBook service and is responsible for the processing described in this Policy as its own. Its legal and contact details appear at the bottom of this page.
2. FormiBook’s roles
The Controller determines the purposes of processing public-site visitor data, account users, billing, support, security and its own contract administration.
For data that a user enters about customers, guests or employees, the user is normally controller and the Controller acts as processor. The Data Processing Agreement governs that relationship.
3. Data processed
- Account: name, organisation, contact details, language, role and protected login data.
- System use: resources, services, availability, bookings, customers, messages, statuses, prices and payment records.
- Payments: plan, amount, currency, status and transaction identifier. Full card details are handled by the payment provider.
- Support and security: requests, IP address, action times, device, browser, error and security logs.
- Public website: the cookie choice and, only with consent, Google Analytics data.
- Illegal-content reports: reporter contact details, URL and report information.
4. Purposes and legal bases
- account creation, features, support and billing — entering into and performing the contract;
- accounting, taxes and authority requests — legal obligation;
- security, abuse prevention, legal claims and reliability improvement — legitimate interests of the Controller and users;
- Google Analytics on the public website — consent;
- the user’s customer data — documented user instructions and the DPA.
Irreversibly anonymised and aggregated information may be used for statistics, security and product improvement and is no longer personal data.
5. The user’s customer data
The user determines the purposes, scope, legal basis, retention and access rights for their customer data. If special categories are entered, the user must have an Article 9 GDPR condition and appropriate restrictions. For such data, the Controller acts as processor only to provide and protect the service and follow lawful instructions.
6. Sources and required data
Data comes from the individual, an account user, their organisation, the user’s customer, the browser, the system and the payment provider. Required registration and payment fields are necessary for the contract; the relevant feature or paid plan cannot be provided without them. Optional fields may be left empty.
7. Recipients
Hosting and infrastructure providers, the payment provider, the public-site analytics provider, authorised support specialists and public authorities where required by law may receive access. The Controller does not sell personal data.
The current register of processors relevant to user data is available to an authorised user in the system or on request to info@expooffice.lt. Material changes are communicated under the DPA.
8. Transfers outside the EEA
Where a provider processes data outside the European Economic Area, the Controller uses an applicable GDPR mechanism: an adequacy decision, Standard Contractual Clauses and, where needed, supplementary safeguards.
9. Retention
- account and customer data — while the account is active or until earlier deletion on the user’s lawful instruction, followed by 30 days for export after service termination;
- residual data in isolated backups — up to 90 days after deletion from the active system;
- security logs — up to 6 months;
- support correspondence — up to 1 year after the request is closed;
- accounting and tax records — for the statutory period;
- data relevant to a dispute or incident — until it is resolved and the applicable claim period ends.
10. Cookies
The public website uses necessary storage for the user’s choice and Google Analytics only after consent. See the Cookie Policy.
The authenticated FormiBook system uses technically necessary cookies for authentication, security and the user session; consent is not required for them.
11. Security
The Controller applies proportionate technical and organisational measures, including access controls, protected transmission, account controls, security logging, backups and supplier management. No system can guarantee absolute security.
12. Rights
Where provided by GDPR, an individual may request access, correction, deletion, restriction or portability, object to processing or withdraw consent. The Controller may verify identity to protect data. A response is normally provided within one month; GDPR conditions, exceptions and possible extensions apply.
A user’s customer should first contact that user as controller. The Controller assists the user under the DPA while acting as processor.
13. Automated decisions and messages
The Controller does not make decisions based solely on automated processing that produce legal or similarly significant effects for an individual. Only service and transactional messages are sent; this Policy does not provide for marketing newsletters.
14. Complaint
You may first contact the Controller. You also have the right to complain to the State Data Protection Inspectorate: vdai.lrv.lt.
15. Changes
The current version is published on the website. Where a change materially affects processing or rights, the Controller follows the applicable notice period and method.
16. Contact
Data-protection questions and requests: info@expooffice.lt.