Privacy policy
1. Data controller
The controller of your personal data is Maksimas Joda, a self-employed individual (individuali veikla), email info@cvpagalba.lt (“we”). This policy applies to the website cvpagalba.lt and the services offered on it.
It is drawn up under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Lithuanian Law on Legal Protection of Personal Data.
2. What we process and why
Fulfilling your order (performance of a contract, Art. 6(1)(b)): name, email address, phone number, order configuration and amount, payment status (no card data — the payment provider handles it), your questionnaire answers, the CV you upload and the documents we prepare, your messages with the specialist. Without these we cannot write your CV.
Free CV review (consent, Art. 6(1)(a)): email address and the uploaded CV. You may withdraw consent at any time by emailing us — we then delete the file.
Marketing emails (consent): email address — only if you ticked the separate box to receive tips and offers. Unsubscribe in any email or by writing to us.
Collecting and publishing reviews (Art. 6(1)(f) and (a), plus the Lithuanian electronic-communications rules): after your order is completed we email you once (with one reminder) to rate the service and your specialist — you can opt out in every such email or on the order page. The rating (stars, comment, order number, language) is processed under our legitimate interest in monitoring quality and in calculating the specialist’s bonus; a public review with your first name and surname initial is published only with your separate consent, which you can withdraw at any time on the order page or by writing to us.
Site analytics and advertising (consent via the cookie banner): browsing data described in the cookie policy. These tools are not enabled without consent.
Legal obligations (Art. 6(1)(c)): accounting records and invoices — kept for the statutory period.
Handling complaints and defending claims (legitimate interest, Art. 6(1)(f)): correspondence and order history.
3. Retention
Your uploaded CV: while the order is in progress and for 30 days after completion or refund — then deleted automatically.
Documents we prepared (CV, cover letter): 365 days from delivery so you can download them again. After a refund or a cancellation they can no longer be downloaded, and we delete the files 30 days later.
A CV uploaded for the free review, its text and the review itself: 90 days after the upload — then deleted automatically (only anonymised statistics remain).
A file uploaded with an order that was never paid: 7 days.
Order data and correspondence: 3 years after completion (limitation period for claims). Accounting records: 10 years under the Accounting Law.
The rating record: 3 years with the order data; a published review — until you withdraw the consent to publish it.
The bonus record (the specialist stars, the percentage and the amount): kept with the accounting data — 10 years.
Marketing consent: until withdrawn. The cookie-consent record: 12 months.
4. Who we share data with (processors)
Hostinger International Ltd. / UAB Hostinger (Lithuania) — hosting of the site and database, file storage, email delivery. Data is stored in the European Union.
Paysera LT, UAB (Lithuania) and Montonio Finance UAB (Lithuania) — payment processing (bank links, payment cards); one of them is in use. The payment intermediary processes payment data as an independent controller under its own privacy policy.
Our CV specialists — individuals working under contract with us; they see only the questionnaire, files, messages and phone number of the order assigned to them, never your payment details.
Google Ireland Ltd. (Google Analytics, Google Ads), Meta Platforms Ireland Ltd. (Meta Pixel), LinkedIn Ireland Unlimited Company (LinkedIn Insight) — only if you consented to analytics or marketing cookies. These providers may transfer data to the USA under the EU–US Data Privacy Framework or standard contractual clauses.
Google Cloud EMEA Ltd. (Ireland) — the AI platform "Gemini Enterprise Agent Platform", European Union multi-region ("eu") data centres: the content of a CV uploaded for the free review is passed to an AI model that drafts the review; a CV specialist reviews and approves it. We never pass your e-mail address to the model; the data is processed in the EU only and is not used to train models.
Cloudflare, Inc. (USA; EU standard contractual clauses) — protection against automated abuse ("Turnstile") on the free review form: to check that a human is filling in the form, Cloudflare processes your IP address and browser signals; it does not use cookies for tracking. Applies only while the protection is switched on.
We do not sell data or share it for purposes other than those described here.
5. Your rights
You have the right to access your data, rectify it, erase it (“right to be forgotten”), restrict processing, port it, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).
Send requests to info@cvpagalba.lt. We reply within 30 days at the latest. To confirm the request is yours we may ask for verification (for example, replying from the email address used for the order).
If you believe your rights are infringed you may complain to the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, ada@ada.lt).
6. Security
Data travels only over encrypted connections (HTTPS). Access to orders is password-protected and limited by role; customer order pages are reachable only through a unique link sent to your email. Files are stored on servers in the EU and deleted automatically when their retention period ends.
We never store card data — only the payment provider handles it.
7. Changes
We may update this policy when our services or the law change. The current version is always published on this page with its update date.