Privacy Policy
Version: 2026-09-14 | In force from: 14 September 2026
This privacy policy explains how MB REFIXO processes your personal data when you use the website refixo.lt — a platform that connects customers with craftsmen and specialists in construction, renovation and related services.
We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, GDPR), the Lithuanian Law on Legal Protection of Personal Data and the Lithuanian Law on Electronic Communications.
This English text is a translation. In case of any discrepancy, the Lithuanian version of this policy prevails.
1. Data controller and contact details
The controller of your personal data is:
- MB REFIXO
- Company code: 000000
- VAT number: LT000000000
- Address: Žemynos g. 21-38, Vilnius, Lithuania
- Email: info@refixo.lt
- Website: refixo.lt
We have not appointed a Data Protection Officer: our activities do not meet the criteria in Article 37(1) GDPR (we carry out no large-scale systematic monitoring and process no large-scale special categories of data). For any question about personal data, write to the address above.
2. What personal data we collect
We collect only the data a given purpose actually needs. The full list, by category:
2.1. Account data
When you register: username, email address, password (stored only as a cryptographic hash — we never see the password itself), type of activity (self-employed or company), registration IP address, registration and sign-in times, account confirmation flag.
2.2. Profile data
If you provide them: name, public email address, phone number, location, website, description of yourself, profile picture, service category, chosen language.
2.3. Advert data
Everything you put in an advert: title, description, photographs, city, address, phone number, email, website, social media links, prices and the list of services offered. This information is public — every visitor can see it and search engines may index it.
2.4. Reviews
The review text, a photograph if you attach one, the account of the person who wrote it, and the date. Reviews are published after moderation.
2.5. Requests through the "Get an offer" form
Name, email address, phone number, budget, description of the job, photographs, city and service category. These are passed on to specialists able to do the work you described.
2.6. Messages through the contact forms
Through the "Have a question?" form and the "Send a message" form on an advert page: name, email address, phone number (optional) and the text of your message.
2.7. Payment data
For paid adverts we keep the amount, date, payment status and the advert and account it relates to. We never see or store card details — they are handled entirely by the payment provider in its own secure environment.
2.8. Signing in with Google
If you choose to sign in with a Google account, Google gives us: your Google account identifier, email address and its verification flag, first and last name, and a link to your profile picture.
2.9. Device notifications
If you use the mobile app and allow notifications, we store your device's notification token (FCM token). You can remove it at any time by turning notifications off in your device settings.
2.10. Consent records
So that we can demonstrate a consent was given, we store: the type of consent, the date and time, the version of the policy and terms, the cookie categories chosen, the page the consent was given on, and a truncated IP address (the last IPv4 octet is replaced with a zero, so no individual device can be identified from it).
2.11. Technical logs
Error and security logs record the error message, request URL and method, date and time. Form contents and session cookies are not written to logs.
We deliberately do not collect special categories of data (health, religious or political beliefs, biometric data and so on). Please do not put such information into free-text fields — advert descriptions, messages or reviews.
3. Purposes and legal bases
Each purpose has a specific basis under Article 6 GDPR:
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account, signing in, password recovery | 2.1, 2.2, 2.8 | Performance of a contract (Art. 6(1)(b)) — without this data we cannot provide an account |
| Publishing and displaying adverts, search by city and category | 2.3 | Performance of a contract (Art. 6(1)(b)) |
| Forwarding a "Get an offer" request to specialists | 2.5 | Consent (Art. 6(1)(a)) — you tick the box before sending the request |
| Answering a message sent through a contact form | 2.6 | Consent (Art. 6(1)(a)) |
| Publishing and moderating reviews | 2.4 | Legitimate interest (Art. 6(1)(f)) — trust in the platform and protecting users from unreliable providers |
| Email notifications about your adverts and messages received | 2.1, 2.2 | Performance of a contract (Art. 6(1)(b)) |
| Push notifications to your device | 2.9 | Consent (Art. 6(1)(a)) — given in the app |
| Taking payments and keeping accounts | 2.7 | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) — accounting law |
| Protection against automated sign-ups and spam (reCAPTCHA) | IP address, browser data | Legitimate interest (Art. 6(1)(f)) — protecting the platform and its users from abuse |
| Analytics and marketing cookies | Section 9 | Consent (Art. 6(1)(a)) — chosen separately in the cookie dialog |
| Recording and evidencing consent | 2.10 | Legal obligation (Art. 6(1)(c) together with Art. 7(1)) |
| Keeping the site running, secure and debuggable | 2.11 | Legitimate interest (Art. 6(1)(f)) |
Where we rely on consent, you may withdraw it at any time (see section 7). Withdrawal does not affect the lawfulness of processing carried out before it.
Where we rely on legitimate interest, we have assessed that your rights and freedoms do not override it. You have the right to object to such processing (see section 7).
4. Who we share data with
We do not sell personal data and do not pass it to third parties for their own marketing. Only the following recipients see it:
4.1. Other users of the platform
Your advert content and profile information are public. A "Get an offer" request is forwarded to selected specialists. When you contact a craftsman through an advert form, your name, email, phone number and message are sent to that craftsman.
4.2. Processors and service providers
| Recipient | Service | Data involved |
|---|---|---|
| Hostinger International Ltd (Cyprus / Lithuania) | Website and database hosting, outgoing email (SMTP) | All data stored on the site; the content of the emails we send |
| Paysera LT, UAB (Lithuania) | Payment processing (an electronic money institution supervised by the Bank of Lithuania) | Amount, order number and the payer's email address; card or bank credentials are entered directly in Paysera's environment and never reach us |
| Google Ireland Limited | Sign-in with a Google account (OAuth) | Only if you choose this sign-in method: account identifier, email, name, picture link |
| Google Ireland Limited | reCAPTCHA — protection against automated sign-ups | On the registration page only: IP address, browser data and interaction with the page |
| Google Ireland Limited | Firebase Cloud Messaging — push notifications | Device notification token and the text of the notification |
We have data processing agreements meeting Article 28 GDPR with every processor.
4.3. Public authorities
We may disclose data to law enforcement or supervisory authorities where the law requires it, or where it is necessary to establish, exercise or defend legal claims.
What we do not do: the site currently runs no analytics system, no advertising pixels and no social media tracking plugins. Fonts and icons are served from our own server, so your IP address is not handed to any third party merely for the site to look the way it does.
5. Transfers outside the European Economic Area
Data is stored in the European Union. Payments are taken by Paysera LT, UAB, registered in Lithuania, so payment data does not leave the European Economic Area. One of our providers, however, belongs to a US corporate group, and data may reach the United States for technical support purposes:
- Google LLC (USA) — Google sign-in, reCAPTCHA, push notifications.
That transfer relies on the European Commission adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework — the company is certified under it — and, in addition, on the Standard Contractual Clauses adopted by the European Commission (Art. 46(2)(c) GDPR).
A copy of those clauses is available on request at info@refixo.lt.
6. How long we keep data
| Category | Retention period |
|---|---|
| Account and profile data | While the account is active. Deleted immediately when the account is deleted |
| Adverts, including expired ones | While the account is active; deleted together with the account |
| Reviews | While the account is active; deleted together with the account of the person who wrote them |
| "Get an offer" requests | 12 months from submission |
| Messages sent through contact forms | 24 months from receipt |
| Payment and accounting records | 10 years — required by Lithuanian financial accounting law. When an account is deleted, direct identifiers (name, email, account link) are stripped from these records and only the amount, date and status remain |
| Sent email notifications (outgoing queue) | 30 days after sending |
| Account confirmation and password recovery links | Valid for up to 24 hours; the records are removed with the account |
| Consent records | 3 years from the consent |
| Technical logs | 12 months |
| Device notification token | While you use the app, or until you turn notifications off |
| Total visit counter | Indefinitely — an aggregate number from which no individual can be identified |
Data is deleted automatically once the period ends. A period may be extended only as far as needed to establish, exercise or defend a legal claim, or as required by law.
7. Your rights
Under the GDPR you have the following rights. Exercising any of them is free of charge.
7.1. Right of access (Art. 15 GDPR)
You may find out whether we process your data and obtain a copy of it. How: once signed in, go to Account settings → Your data → Download my data. The file is produced immediately. If you have no account, write to info@refixo.lt.
7.2. Right to rectification (Art. 16 GDPR)
You can correct inaccurate data yourself in Account settings and in the advert editor. If something cannot be changed there, write to us.
7.3. Right to erasure ("right to be forgotten", Art. 17 GDPR)
How: once signed in, go to Account settings → Your data → Delete my account. The account, profile, adverts and the reviews you wrote are deleted permanently and immediately. Payment records remain without your identifying details, because accounting law requires it (Art. 17(3)(b) GDPR).
7.4. Right to restriction of processing (Art. 18 GDPR)
You may ask us to suspend processing temporarily — for example while we verify the accuracy of data you dispute. Write to us by email.
7.5. Right to data portability (Art. 20 GDPR)
Data you provided on the basis of consent or a contract can be supplied in a structured, commonly used, machine-readable format. The same Download my data button does this; the file is JSON.
7.6. Right to object (Art. 21 GDPR)
You may object to processing based on our legitimate interest — the publication of reviews, for instance. On receiving such a request we will stop, unless we can demonstrate compelling legitimate grounds that override your interests.
7.7. Right to withdraw consent (Art. 7(3) GDPR)
Withdraw your cookie consent at any time through "Cookie settings" at the bottom of the site — the same window in which you gave it. Consent to device notifications is withdrawn by turning notifications off in your device settings. In other cases, write to us.
7.8. How to make a request
Requests that the self-service buttons cannot handle go to info@refixo.lt. We answer within 1 month of receiving the request. If a request is complex we may extend that by a further 2 months; we will tell you within the first month and explain why.
To avoid disclosing your data to someone else, we may ask you to confirm your identity. Please send your request from the email address registered on your account.
8. Right to lodge a complaint
If you believe we process your data unlawfully, please come to us first — most questions are resolved directly. You also have the right to lodge a complaint with the supervisory authority:
- State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)
- L. Sapiegos g. 17, 10312 Vilnius, Lithuania
- Tel. +370 5 271 2804, +370 5 279 1445
- Email ada@ada.lt
- vdai.lrv.lt
You may also bring the matter before a court.
9. Cookies
A cookie is a small file a website stores in your browser. Strictly necessary cookies are used without consent, because the site would not work without them. Everything else is stored only after you have explicitly agreed — until then no optional cookie is written and no third-party resource is loaded.
You can change or withdraw your choice at any time through "Cookie settings" at the bottom of the site.
| Name | Purpose | Category | Lifetime |
|---|---|---|---|
PHPSESSID | Session identifier: keeps you signed in and preserves form state | Strictly necessary | Until the browser is closed |
_csrf | Protects forms against request forgery (CSRF) | Strictly necessary | Until the browser is closed |
_identity | The "Remember me" option on the sign-in form | Strictly necessary (functional) | 14 days |
_language | Remembers the site language you chose (lt / en / ru) | Strictly necessary | 30 days |
refixo_consent | Remembers your cookie choice and the policy version it was given against | Strictly necessary | 180 days |
_GRECAPTCHA and other Google cookies | reCAPTCHA — tells a human from an automated program. Set on the registration page only | Strictly necessary (security) | Up to 6 months (set by Google) |
| Analytics cookies | Counting visits and improving the site. Not in use at present — if any are introduced this table will be extended and your consent asked for again | Analytics — consent required | — |
| Marketing cookies | Measuring advertising. Not in use at present | Marketing — consent required | — |
You can also delete or block cookies in your browser settings. Note that disabling strictly necessary cookies may break the site — you may not be able to sign in, for example.
10. Automated decision-making and profiling
We carry out no automated decision-making, including profiling, within the meaning of Article 22 GDPR. No decision producing legal effects concerning you, or similarly significantly affecting you, is taken by automated means alone.
The ordering of adverts in search results depends only on the filters you choose yourself (city, category, sort order) and the advert date — no assessment or segmentation of your behaviour is involved.
11. Data security
We apply technical and organisational measures appropriate under Article 32 GDPR:
- Data in transit is encrypted with HTTPS/TLS.
- Passwords are stored only as one-way salted hashes (bcrypt) — the original password cannot be recovered, not even by us.
- Forms are protected against request forgery (CSRF); registration is protected against automated programs.
- Form contents, passwords and session cookies are never written to technical logs.
- Access to the administration area is limited to authorised staff bound by confidentiality.
- Database backups are taken regularly and stored encrypted.
- Data processing agreements are in place with every service provider.
No method of transmission over the internet is completely secure. If we detect a personal data breach likely to result in a high risk to your rights, we will notify you and the State Data Protection Inspectorate as required by Articles 33–34 GDPR.
12. Minors
The platform is intended for people aged 18 and over — only they can enter into the transactions the Terms of Use provide for. We do not knowingly collect children's personal data.
If we learn that an account was created by someone under 18, we will close it and delete the data. If you are a parent or guardian and believe your child has given us data, write to info@refixo.lt and we will remove it without delay.
13. Entry into force and changes
This version of the policy — 2026-09-14 — takes effect on 14 September 2026 and replaces all earlier versions. What changed: payments on the site are now taken by Paysera LT, UAB instead of Stripe.
We may change this policy when our activities, the technologies we use, or the law change. Every version carries a number and an effective date, shown at the top of this page.
- Registered users will be told of material changes by email or by a notice on the site at least 14 days before they take effect.
- When the policy changes, cookie consent is asked for again — consent given against an earlier version automatically stops being valid.
We suggest you look at this page from time to time. Any question about this policy: info@refixo.lt.
