Privacy Policy

1. Who we are

The service provider and website operator is Ruslan Kačalov, sole proprietor (individual activity) “Verdika”, individual activity certificate No. 1552877, address Žėručio g. 10-23, Vilnius, Lithuania (“we”). For any data protection question, write to info@verdika.lt (subject: “Data protection”). We have not appointed a data protection officer, as this is not required under Article 37 GDPR.

2. Two different roles

Verdika is a procurement management platform for companies. Who is responsible for data depends on whose data it is:

• When a client company manages its purchases on the platform — uploads supplier contacts, sends invitations, receives and evaluates offers, creates employee accounts, views the activity log, publishes a purchase on the marketplace — the CLIENT is the controller of that data. We process it only on the client’s behalf and on its instructions (Data Processing Agreement).
• For website visitors, demo and support requests, emails to info@verdika.lt, client contact persons (contract and invoices) and server security logs (including technical data from supplier forms), WE are the controller.

This policy mainly describes data for which we are the controller. Information about data we process on a client’s behalf is provided by the client; we help it do so (see section 3).

3. Information for suppliers

If you received an invitation to submit an offer via Verdika or are submitting an offer on the marketplace, the controller of your data is the company running the purchase: it decides whom to invite, how to evaluate offers and how long to keep them. It usually uploads your contacts to the platform itself.

On its behalf we process: your name, email, phone, company name, the offer you submitted and attached documents, the time of submission, correspondence via the platform and the rating the company gives you.

If the company uses AI features, your document may be processed by an AI service so that prices, deadlines and other terms are moved into a comparison table. A person checks the results, the company makes the decision, and your documents are not used to train AI models (see section 8).

When you open the offer form, we as controller keep technical data (IP address, browser type, request time) in server security logs for up to 90 days to protect against abuse.

For questions about your data, please contact the company running the purchase first. If you contact us, we will forward your request to it and help it respond. If you no longer wish to receive that company’s invitations, write to it (a reply to the invitation goes directly to the company).

4. What data we process, why and on what legal basis

• Demo request: name, company, email, phone, message — to contact you and arrange a demo. Legal basis: steps at your request before entering into a contract (GDPR Art. 6(1)(b)) and our legitimate interest in presenting the service (Art. 6(1)(f)).
• Client account: name, email, password hash (we never know the password itself), language, login time — so that you can use the platform. Legal basis: performance of a contract (Art. 6(1)(b)).
• Record of consent to the terms: who agreed, when and to which version — as evidence of the contract (Art. 6(1)(b) and (f)).
• Activity log: who changed what and when on the platform — for security, dispute resolution and on the client’s instructions (Art. 6(1)(f); for client data — under the Data Processing Agreement). The client, as employer, informs its employees about this log.
• Support requests and correspondence, including emails to info@verdika.lt — to answer and solve the problem; a reply draft may be prepared by AI, but a person reviews and sends it (Art. 6(1)(b) and (f)).
• Technical data (IP address, browser type, request time) — to protect against abuse (e.g. too many login attempts) and to fix errors (Art. 6(1)(f)).
• Where you came from: when you sign up or send a demo request, we record the campaign tags in the link you followed (utm_source, utm_campaign, etc.) and the domain of the previous website — to know which of our promotions work. No cookies are used for this (Art. 6(1)(f)).
• Invoices and payments (for paid plans): client details, contact person, invoice and payment data — accounting (Art. 6(1)(c), legal obligation).
• Establishing and defending legal claims — only data related to the dispute (Art. 6(1)(f)).

The legitimate interest we rely on is a secure, working service, answering enquiries, evidence of contracts, defending our rights and presenting the service to businesses. We have assessed that it does not override your rights, as we process only the necessary minimum and only briefly.

You are not required by law to provide data, but without an email address we cannot create an account or answer an enquiry, and without company details we cannot issue an invoice.

Most data is provided by you; client users’ data may be provided by the client administrator and supplier data by clients; technical data is generated by your browser and our servers.

We do not collect special categories of data (health, ethnicity, etc.) and ask you not to upload such data to the platform.

5. Cookies and browser storage

We use no advertising or tracking cookies. In the browser storage (localStorage) we keep only what the platform cannot work without: the login token, your chosen language and light / dark theme. We do not collect website visitor statistics. That is why we show no consent banner — such strictly necessary storage does not require consent.

6. Who receives the data

We do not sell data. It may be received only by:

• Hostinger International Ltd. (Cyprus) — server hosting (data centre in Lithuania) and email service (system emails, invitations, the info@verdika.lt mailbox); processor;
• Mistral AI SAS (France) — artificial intelligence service (see section 8); processor;
• sub-processors of these processors — infrastructure, email delivery, spam and attack protection (lists — Annex 1 of the Data Processing Agreement);
• the bank through which payments are received — independent controller;
• accounting — for now we keep the accounts ourselves; if we engage an accounting service provider, we will list it here;
• lawyers, auditors — when legal assistance or defence of rights is needed; bound by confidentiality;
• public authorities and courts — only where required by law;
• a successor (a company we establish) — if we transfer the business to a legal entity; we will notify you in advance.

An offer submitted by a supplier, together with the supplier’s contacts, is passed to the company running the purchase — that is the purpose of submitting it. The public marketplace shows only what a company has chosen to publish.

Platform data is stored in the European Union (Hostinger data centre in Lithuania), and the AI service is provided from the EU. However, some sub-processors of our processors (e.g. email delivery, spam and attack protection providers) are established outside the European Economic Area, e.g. in the USA, so some data (especially email data) may be transferred there. In that case the safeguards of Chapter V GDPR apply — a European Commission adequacy decision or standard contractual clauses (Decision (EU) 2021/914). We will send information about them on request.

7. How long we keep data

• Demo requests — 24 months from the last contact (once a contract is concluded, the contacts are processed as client account data).
• Client accounts and client data (including the activity log) — for the duration of the contract; after it ends, the client may export the data within 30 days, after which it is deleted (Terms of Use, section 10).
• Records of consent to the terms and contract documents — up to 10 years after the contract ends (general limitation period).
• Support requests — 24 months after they are closed.
• Emails received at info@verdika.lt — 24 months from the last correspondence; automated notices (bounces, out-of-office replies) — 30 days.
• Accounting documents — as long as required by law (usually 10 years).
• Backups — daily backups are kept on the server for 7 days and a separate copy on our computer in Lithuania for up to 12 months; deleted data is never restored from backups to the live system and disappears as old backups are overwritten.
• One-time link records (password reset, email confirmation) — 30 days after use or expiry; sent email records — 30 days (failed ones — 90 days).
• Server security logs containing IP addresses — up to 90 days; application error logs — limited in size and overwritten automatically.

The periods for demo requests, support requests, received and sent emails, and one-time links are enforced automatically — whatever has reached the end of its period is deleted daily.

8. Artificial intelligence and automated decisions

We use AI in two cases: (a) on the platform, when a client user runs an AI feature (e.g. reading an offer, a text draft); (b) when preparing drafts of replies to support requests and emails — a person reviews and sends every reply.

The AI service is provided by Mistral AI SAS (France, EU). Only the information needed for the specific task is sent: the text of the document or, if the document is scanned, the document itself for text recognition. Mistral AI’s option to use this data to train its models is switched off; it may briefly retain requests for abuse monitoring under its terms.

We make no automated decisions that have legal or similarly significant effects on you. AI and the comparisons and ratings calculated by the platform only suggest — a person sees and confirms every value, and the winner is always chosen by the company running the purchase.

9. How we protect data

Connections are encrypted (HTTPS), passwords are stored only as hashes, failed logins are limited, each company’s data is separated from other companies (verified by automated tests before every update), access is granted by roles and permissions, important actions are logged, and daily backups are made. We can view a client account only with the client’s permission; every view is logged.

10. Your rights

You have the right to access your data and get a copy, rectify it, erase it, restrict its processing and receive the data you provided in a portable format.

Right to object. You may at any time object to processing of your data based on our legitimate interest. We will then stop, unless we demonstrate compelling legitimate grounds that override your interests or the data is needed to establish or defend legal claims.

Send requests to info@verdika.lt — we will reply without delay and within one month at the latest (extendable by two further months in complex cases, with notice). We may ask you to confirm your identity first. If we process your data on a client’s behalf (e.g. you are a client’s employee or a supplier), we will pass your request to the client and help it respond.

If you believe your data is processed unlawfully, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt) or the supervisory authority of your EU country. We would appreciate it if you contacted us first.

11. Changes and languages

We may update this policy. The current version and its date are always published on this page; clients are notified of material changes on the platform and by email.

The policy is published in Lithuanian and English; in case of discrepancies, the Lithuanian version prevails.