Privacy Policy
1. Who I am and what this policy covers
This policy explains what personal data I collect, why, who receives it, how long I keep it and what rights you have. It covers gedaskevicius.com, my free resources and emails, mentorship applications and discovery calls, my 1-on-1 mentorship programs and the Frame Teardown.
“I”, “me” and “my” mean Vizualiniai Sprendimai, MB, the Lithuanian company through which Gediminas Daškevičius provides his services. The company is the controller of your personal data. Gediminas Daškevičius is the only person in it who works with your data.
| Company | Vizualiniai Sprendimai, MB |
| Company code | 305177025 |
| Registered address | Ašigalio g. 55-40, Kaunas 49143, Lithuania |
| Postal address | Savanorių pr. 271-301, Kaunas 50131, Lithuania |
| ge@gedaskevicius.com | |
| Phone | +370 604 06224 |
If you buy from me, my Terms and Conditions also apply. Where this policy repeats a rule from the terms, such as how long I keep your images, the two are meant to say the same thing. If you find a difference, the version that’s better for you applies.
2. What I collect and why
Each part below says what I collect, what I use it for and my legal basis under the GDPR. If you’re in the UK, the UK GDPR gives you the same protection.
When you visit my site
- Server logs. My web host, Hostinger, records your IP address, your browser, the pages you request and when. My site also logs the IP address of failed logins to its admin area. I need this to run the site and keep it secure. Legal basis: my legitimate interest in a working, secure website.
- Spam protection. On pages with a form, Cloudflare Turnstile checks that the form is filled in by a person, not a bot. It receives your IP address and reads technical details from your browser. Because it protects the form you’re using, it doesn’t need your consent. Legal basis: my legitimate interest in keeping spam out of my forms.
- Statistics. Only if you accept statistics cookies, Google Analytics records which pages you visit, where you came from (for example a link under one of my YouTube videos), your device and browser, your approximate location, and when you submit a form. I use this to see what works on my site. Legal basis: your consent.
- Advertising. Only if you accept marketing cookies, the Meta Pixel in your browser, and my server through Meta’s Conversions API, tell Meta which pages you visit and when you submit a form, together with your IP address and browser details. When you fill in a form, Meta also receives the details you enter, such as your email address, in hashed form: a code Meta matches against the details on Meta accounts. I don’t run ads at the moment. I keep the pixel so I can measure and target ads on Facebook and Instagram if I start. Meta and I are joint controllers for collecting this data and sending it to Meta, under Meta’s Controller Addendum. Meta is responsible for what it does with the data afterward, as its privacy policy explains, and you can use your rights with Meta directly. Legal basis: your consent.
- Your cookie choice. My cookie banner stores your choice on your device. Legal basis: my legal obligation to ask for your consent and to be able to show that I have it, and my legitimate interest in not asking you again on every page.
Section 6 lists the cookies.
When you sign up for a free resource or my emails
When you sign up for a free resource, you join my email list, and the form says so. MailerLite stores your email address and sends you the resource and my emails: tips, the 30-day email course and offers for my paid programs. It records which form you used, when you signed up, and whether you open my emails and click their links. Legal basis: your consent. You can unsubscribe at any time with the link in every email, including right after you get the resource, and you keep the resource.
When you download a file from my site, Download Monitor logs the download with a shortened IP address, so I can see which resources get used. Legal basis: my legitimate interest in knowing which resources help.
When you apply for a mentorship program
I collect your name, email address, where you’re based, a link to your portfolio, and your answers about your experience, what frustrates you, your goals and timing, your studio access and whether you’re financially ready. I use them to decide whether the program fits you, to reply to you and to invite you to a discovery call. The form emails your application to my business inbox at ge@gedaskevicius.com and sends you a confirmation. Legal basis: steps you ask me to take before we make a contract.
If your portfolio link points to Google Drive, Dropbox or a similar service, that service’s own terms apply to it.
When you book a discovery call
TidyCal collects your name, email address and the time you choose, and adds the call to my Google Calendar. The call takes place on Google Meet. Legal basis: steps you ask me to take before we make a contract.
When you buy
Stripe processes your payment. It collects your name, email address, billing address, country and card details and, if you buy for a business, your company name and VAT number. I never see your full card details. I receive the payment details, issue invoices and keep accounting records, which I share with my accountant and, where the law requires, the Lithuanian tax authority. Legal basis: our contract, and my legal obligations under tax and accounting law. Stripe also uses some of this data for its own purposes, such as preventing fraud, as its own privacy policy explains.
During a mentorship program or a Frame Teardown
- Calls. Our calls take place on Google Meet. Legal basis: our contract.
- Recordings. I may record our calls, including a Frame Teardown call, unless you tell me not to. I tell you when I start and stop recording. A recording contains my video, including anything I show you, such as your images, and both our voices. Your camera image isn’t recorded. I use recordings so you can rewatch them and to prepare my feedback. I store them in my Google Drive and give only you access to each one. Legal basis: my legitimate interest in giving you recordings to rewatch and in preparing thorough feedback. You can object at any time, including during a call. I’ll then stop recording and, if you ask, delete earlier recordings. It doesn’t change the service you bought.
- Transcripts and AI summaries. I transcribe recordings on my own computer with Whisper, so the audio doesn’t leave my computer for this. If you agree, which I ask before our first call, I may paste a transcript into Claude, an AI assistant made by Anthropic, to summarize it. On the plan I use, Anthropic handles this as an independent controller, under its own privacy policy. I’ve turned off model training, so Anthropic doesn’t use this data to train its models. Before I use Claude, I remove any part of a transcript that mentions your health, and I never upload your images to Claude. Legal basis: your consent. You can withdraw it at any time by telling me, and saying no doesn’t change the service you bought.
- Your images. You send me your images through a service you choose, usually your own Dropbox or Google Drive. I download them to my computer to review them and use them only to give you feedback. When I delete your images, I delete every copy I made. Recordings can show your images on screen while we discuss them, and I keep recordings for the period in section 5. Legal basis: our contract.
- Messages. You can message me by email or WhatsApp. WhatsApp is run by Meta, which handles it under its own privacy policy. Legal basis: our contract.
- If you’re ill. If you send me a note from a doctor or hospital under section 15 of my terms, I use it only to apply that clause and delete it once the affected call or payment is settled. No diagnosis is needed, so please don’t send one. Legal basis: your explicit consent, which you give by sending the note.
- Testimonials. I publish a testimonial or a before-and-after only with your written permission, and you can withdraw it as section 9 of my terms explains. If a before-and-after shows anyone other than you, I publish it only if that person has agreed too. Legal basis: your consent.
If a client sends me your image or details
Clients send me images of the people they photograph, and sometimes mention other people in calls and messages. I use this only to give my client feedback, and delete it as section 5 describes. My terms require clients to have permission to send me these images, and a parent’s written consent for images of children. I can’t contact the people shown, so this policy is how I inform them. If a business booked your place in a program, I received your name and email address from that business. Legal basis: my legitimate interest, and my client’s, in feedback on their photography.
When you contact me or make a data request
I use your name, email address and message to reply. Requests sent through my Data Request page are emailed to ge@gedaskevicius.com. Legal basis: my legitimate interest in answering you, and my legal obligation to handle data requests.
When I use an AI assistant to run my business
I also use Claude to draft emails and to review site statistics that don’t identify you. Sometimes I may paste an email you sent me into Claude to help me write my reply. On the plan I use, Anthropic handles this as an independent controller, under its own privacy policy, with model training switched off. I leave out anything about your health, and I don’t give Claude my email list or client files, apart from transcripts as described above. Legal basis: my legitimate interest in answering you well and on time. You can object at any time, and I’ll then write my replies to you without Claude.
What I don’t do
I don’t sell your personal data. I don’t make decisions about you by automated means alone. My services are for adults, and I don’t knowingly collect data from anyone under 18, apart from images of children that clients send with a parent’s written consent.
Visiting my site means my host and Cloudflare see your IP address. Beyond that, you don’t have to give me personal data. Without the details a form asks for, I can’t reply to you, send you a resource or deliver a program. If you buy, tax and accounting law requires me to record the details on your invoice, such as your name and country, and your VAT number if you buy for a business.
3. Who receives your data
I share personal data only with the companies below, and only as section 2 describes. Most of them handle it only on my instructions. Google, Meta, Stripe and Anthropic also use some of it for their own purposes, under their own privacy policies. I use Google Calendar, Google Meet and Google Drive on a personal Google account.
| Company | What it does for me |
|---|---|
| Hostinger | Hosts my website and my email at ge@gedaskevicius.com, and sends the emails my site’s forms send |
| MailerLite | Stores my email list and sends my emails |
| Cloudflare | Turnstile spam protection on my forms |
| Google Analytics (only with your consent), Google Calendar, Google Meet and Google Drive | |
| Meta | Meta Pixel (only with your consent) and WhatsApp |
| TidyCal | Booking discovery calls |
| Stripe | Payments |
| Anthropic | Claude, my AI assistant |
| My accountant | Bookkeeping and tax |
I also share data with authorities, such as the Lithuanian tax authority, where the law requires it, and with courts or legal advisers if I need to establish, exercise or defend a legal claim. Legal basis: my legal obligations, and my legitimate interest in establishing, exercising or defending legal claims.
If I transfer our contract to another company that Gediminas Daškevičius controls, as section 15 of my terms allows, I’ll tell you by email first, and that company takes over the data it needs under this policy. If I move my email list to such a company, I’ll tell subscribers first, so you can unsubscribe. Legal basis: my legitimate interest in keeping my business running.
4. Transfers outside the EU
Some of these companies are based in the US or process data there, including Google, Meta, Cloudflare, TidyCal, Stripe and Anthropic. Google, Meta and Stripe serve people in the EU through companies in Ireland. These transfers rely on the EU-US Data Privacy Framework where the company is certified under it, or on the European Commission’s standard contractual clauses, as each company’s terms describe. For people in the UK, they rely on the UK’s equivalent safeguards. You can ask me for a copy of these safeguards. My website’s server is in Lithuania.
5. How long I keep it
I keep personal data only as long as I need it for the purpose I collected it for, then delete it. If you dispute a payment or make a claim, I may keep what relates to it until the dispute is resolved. Companies that use data for their own purposes, such as Google, Meta, Stripe and Anthropic, keep it as their own privacy policies say.
| Data | How long I keep it |
|---|---|
| Server logs | As long as Hostinger needs them for security, as its privacy policy describes |
| Failed login records | Up to 12 months. I clear the log at least once a year |
| Download log (with a shortened IP address) | Up to 12 months. I clear the log at least once a year |
| Copies of emails my site sends, such as applications | 14 days in my site’s email log |
| Google Analytics statistics | Detailed visit data: 2 months. Data linked to your browser’s identifier: 14 months |
| Email list | Until you unsubscribe. After that, MailerLite keeps your email address marked as unsubscribed, so you don’t get my emails again (my legitimate interest in respecting your choice) |
| Applications from people who don’t become clients | 12 months after you apply |
| Applications from people who become clients | 3 years after the program ends, with the client’s messages |
| Discovery call bookings | 12 months after the call |
| Images you send for a mentorship program | No later than 30 days after our last call |
| Images you send for a Frame Teardown | 7 days after the call, unless you enroll in a mentorship program |
| Call recordings and transcripts | No longer than 6 months after the program ends, or after the Frame Teardown call |
| Claude chats with your transcript or email | Until I delete them, no later than the matching data above. Anthropic then deletes them within 30 days, apart from exceptions its privacy policy describes, such as content flagged in a safety review |
| Doctor’s or hospital notes | Until the affected call or payment is settled |
| Emails and WhatsApp messages with clients | 3 years after your program or Frame Teardown ends |
| Other emails and messages, including with applicants | 12 months after our last contact |
| Invoices, accounting records and the contract documents behind them | 10 years, as Lithuanian accounting law requires |
| Testimonial permissions | As long as I use the testimonial, then 3 years |
| Data requests and how I handled them | 3 years after the request |
| Your cookie choice | 12 months |
6. Cookies and similar technologies
Cookies are small files a website stores in your browser. Until you choose, my site sets only functional cookies, which it needs to work. Statistics and marketing cookies are set only after you accept them in my cookie banner, and you can refuse them as easily as you accept them. You can change or withdraw your choice at any time on my Cookies page, and you can delete cookies in your browser settings.
| Name | Set by | What it does | Type | Kept for |
|---|---|---|---|---|
| cmplz_banner-status, cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing, cmplz_policy_id, cmplz_consented_services | My site (Complianz) | Remember your cookie choice | Functional | 12 months |
| wc_facebook_signals_state | My site (Meta Pixel plugin) | Remembers whether Meta tracking is on hold, so your choice is respected | Functional | 12 months |
| wpEmojiSettingsSupports | My site (WordPress) | Checks whether your browser can show emoji | Functional (session storage) | Until you close the tab |
| _ga | Google Analytics | Tells visits from different browsers apart | Statistics | 2 years (Chrome limits this to about 13 months) |
| _ga_JH29PGDPDE | Google Analytics | Keeps track of your visit | Statistics | 2 years (Chrome limits this to about 13 months) |
| _fbp | Meta | Recognizes your browser for measuring and targeting Meta ads | Marketing | 90 days |
| _fbc | Meta | Records that you came from a Meta ad, if you did | Marketing | 90 days |
| PHPSESSID | My site (Meta Pixel plugin) | Gives your browser a random ID that my server sends to Meta with your events | Marketing | 90 days |
Once you accept marketing cookies, Meta may also read its own cookies on facebook.com, such as fr, as Meta’s cookie policy explains. Cloudflare Turnstile runs only on pages with a form, to protect it from bots, so it doesn’t need your consent.
Emails. My emails contain a small invisible image and tracked links, so MailerLite can tell me whether you opened an email and which links you clicked. I use this to see which emails help and to keep my list clean. Turning off images in your email app stops the open tracking, but not the link tracking. Unsubscribing stops both.
7. Your rights
Under the GDPR, and the UK GDPR if you’re in the UK, you have the right to:
- get a copy of the personal data I hold about you,
- have wrong or incomplete data corrected,
- have your data deleted,
- have my use of your data restricted,
- receive the data you gave me in a common format, or have it sent to someone else, where the GDPR gives this right,
- object to my use of your data where I rely on my legitimate interest, and to direct marketing at any time,
- withdraw your consent at any time, without affecting what I did before you withdrew it.
How to use them. Using your rights is free. Email ge@gedaskevicius.com or use my Data Request page. I answer within one month. If a request is complex, I may take up to two more months, and I’ll tell you within the first month. If I’m not sure a request comes from you, I may ask you to confirm your identity. Some rights have limits, for example I must keep accounting records even if you ask me to delete them.
Complaints. If you think I’ve handled your data wrongly, please contact me first. You can also complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or to the data protection authority where you live or work, such as the Information Commissioner’s Office in the UK.
8. Security, changes and contact
Security. I protect your data with reasonable technical and organizational measures, such as password-protected accounts, limits on login attempts to my site and encrypted connections (HTTPS). If a data breach is likely to put you at high risk, I’ll tell you without undue delay.
Changes. I may update this policy when my services or tools change. The date below shows the latest version. If a change affects clients in an important way, I’ll tell them by email.
Contact. ge@gedaskevicius.com, +370 604 06224, or by post to Savanorių pr. 271-301, Kaunas 50131, Lithuania.
Last updated: October 3, 2026