Privacy Policy

Last updated: 2026-09-03

This privacy policy explains how Elixir Secret ("we") processes your personal data when you use the elixirspa.lt website and our services in Vilnius and Kaunas.

1. Data Controller

Data controller: Tatiana Svets.
Address: Savanorių pr. 59, kab. 6, LT-03149 Vilnius, Lithuania.
Phone: +370 641 09990.
Email: blackrabbit442@gmail.com.

2. What data we collect

When you book a treatment through the website, we collect your name, phone number and/or email, the selected service, salon, preferred time, and any notes you provide. Standard server log data (IP address, browser type, visit time) may be processed technically while browsing the site.

3. Purposes and legal basis

• Accepting and fulfilling your booking — GDPR Art. 6(1)(b) (performance of a contract/order).
• Sending newsletters and offers — GDPR Art. 6(1)(a) (your consent), where given.
• Protection against fraud and automated requests (Google reCAPTCHA) — GDPR Art. 6(1)(f) (legitimate interest in service security).

4. Retention period

We keep booking data for as long as necessary to provide the service and for accounting/tax purposes (up to 10 years under Lithuanian law, where applicable). You may request earlier deletion at any time, unless we are legally required to retain it longer.

5. Who we share data with

We are assisted by: our hosting provider (server), notification services (email, Telegram) — solely to inform us of a new booking, and Google reCAPTCHA — for bot protection. These providers act as processors or independent controllers within the scope of their service and are required to comply with data protection law.

6. Transfers outside the EU/EEA

Some of the services listed above (e.g. Google, Telegram) may process data on servers outside the European Economic Area. Where this occurs, transfers are based on safeguards approved by the European Commission (such as Standard Contractual Clauses) or another legal basis provided by the GDPR.

7. Your rights

You have the right to access your data, request its correction or deletion, restrict or object to its processing, request data portability, and withdraw consent at any time (without affecting the lawfulness of processing carried out before withdrawal). To exercise these rights, contact hello@elixirspa.lt.

8. Filing a complaint

If you believe your data is being processed in breach of the GDPR, you have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, Vilnius, www.vdai.lrv.lt).

9. Cookies

For information about cookies and similar technologies used on this site, see our separate: Cookie Policy

10. Changes to this policy

This policy may be updated from time to time. The current version is always published on this page.