ESB
Start a project

Privacy policy

Last updated

This policy explains what personal data ESB collects through this website and in client work, why we collect it and what rights you have. It follows the EU General Data Protection Regulation (GDPR).

Who we are

ESB is a web studio based in Vilnius, Lithuania. We are the controller for the personal data described here.

Email: hello@esb.studio

What we collect and why

Project enquiry form

When you send the enquiry form, we receive your name, email address, company, website, budget, message and time zone. We use them to reply, to check whether we are a good fit and to prepare a quote.

The form is processed for us by Formspree, a US company acting as our processor. The transfer of your form data to the US is covered by the European Commission’s standard contractual clauses.

Email

If you email us, we receive your email address, your name and whatever you include. We use it to reply and, if you become a client, to run your project. Our email hosting provider stores these messages for us.

Call booking

If we send you a Cal.com link to book a call, Cal.com processes your name, email address, the time you choose and any notes you add, so the call can be scheduled. Cal.com is based in the US, and its privacy policy explains how it handles this data.

Payments

Clients pay through Stripe. Stripe collects card or bank details directly, so we never see full card numbers. We receive the payer’s name, email address, billing details, the amount and whether the payment succeeded.

Depending on the activity, Stripe acts as our processor or as a controller in its own right, under its privacy policy.

Client records

If you become a client, we keep the signed agreement, quotes, invoices, payment records and project correspondence.

Analytics

We count visits with Plausible Analytics. It sets no cookies, collects no personal data and stores its data in the EU. We see totals, such as page views and referring sites, and cannot see individual visitors.

Hosting and security logs

The site is hosted and delivered through Cloudflare’s content delivery network. Cloudflare’s servers log technical details of each request, including IP addresses, to keep the site secure and block abuse. Cloudflare’s privacy policy explains how it handles this data.

We rely on these legal bases under Article 6 of the GDPR:

  • Steps before a contract, and the contract itself (Article 6(1)(b)): replying to project enquiries, booking calls, preparing quotes, running projects and taking payments.
  • Legitimate interests (Article 6(1)(f)): answering general emails, keeping enquiry records in case you come back to us, and keeping the site secure. You can object to this processing at any time.
  • Legal obligations (Article 6(1)(c)): keeping accounting and tax records.
  • Consent (Article 6(1)(a)): only where we ask for it. You can withdraw it at any time.

Who receives your data

We share personal data only with the providers named above, our email hosting provider and the software we use to draft, build and test sites. Each handles it under contract or under its own privacy terms. We also share data with public authorities, such as the tax authority, when the law requires it.

We do not sell personal data or use it for advertising. We do not make automated decisions about you that have legal or similarly significant effects.

Transfers outside the EU

Formspree processes form data in the US under standard contractual clauses. Cal.com, Stripe and Cloudflare may also process data outside the European Economic Area. Where a provider does, the transfer relies on standard contractual clauses or another safeguard the GDPR allows.

Storage in your browser

The site sets no tracking cookies. It saves only these preferences in your browser’s storage:

  • the currency you chose for prices
  • whether the intro animation has already played in this session
  • which case studies you have opened, so they can be marked as visited

This data stays on your device and is not sent to us. To clear it, delete this site’s data in your browser settings, usually under privacy or site data. The animation setting is forgotten when your browsing session ends.

How long we keep data

  • Enquiries that do not become projects: 24 months after our last exchange, then deleted.
  • Client records: as long as Lithuanian accounting law requires.
  • Security logs: only as long as needed to keep the site secure.
  • Browser storage: until you clear it.

Your rights

Under the GDPR, you have the right to:

  • access the personal data we hold about you
  • have inaccurate data corrected (rectification)
  • have your data erased
  • restrict how we use it
  • receive your data in a portable, machine-readable format
  • object to processing based on legitimate interests
  • withdraw consent at any time, where we rely on it

Email hello@esb.studio to use any of these rights. There is normally no charge, and we reply within one month, as the GDPR requires. We may ask you to confirm your identity first.

Complaints

If you think we have handled your data wrongly, please tell us first so we can put it right. You can also complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija) at vdai.lrv.lt, or to the data protection authority in the country where you live or work.

Changes to this policy

We update this policy when our services or providers change. The date on this page shows the latest version. If a change affects data we already hold about you, we will email you before it takes effect.