Privacy policy

This privacy policy explains how aha.lt collects, uses and protects your personal data under the General Data Protection Regulation (GDPR) and the Law on the Legal Protection of Personal Data of the Republic of Lithuania. This is a translation for convenience; in case of discrepancies the Lithuanian version prevails.

1. Data controller

The controller of personal data is aha.lt. Contact for data protection matters: [email protected].

2. What data we collect

2.1. Data you provide:

At registration: name, email, password (stored encrypted).
When posting a listing: title, description, price, photos, contact phone (if provided), city, address (optional).
In messages: the content of the correspondence.
In a dating profile (if you use the feature): photos, „about me“ text, gender, age range, search criteria.

2.2. Data collected automatically:

IP address, browser type, device type, login time, IP address at registration.
Visit log — IP address and the country and city derived from it, pages visited and listings opened, where you came from, device type. Used only for security and fraud prevention (e.g. detecting multiple accounts and spam), not used for advertising and not shared with third parties. We do not use cookies for this.
Activity on the website (listings viewed, search queries) — used for statistics and security. Visit statistics are collected by Matomo on our own server without cookies and with a truncated IP address; listing impressions and views are counted as aggregate numbers for seller statistics (without personal data).
Cookie information (see the Cookie policy).

3. Purposes of processing

To enable you to use the platform (registration, posting listings, messages).
To keep the platform secure and prevent abuse.
To answer enquiries and provide support.
To improve the platform's functionality (anonymised statistics).
To comply with legal obligations (e.g. requests from law enforcement).

4. Legal basis

We process your data on the following GDPR grounds:

Performance of a contract (Art. 6(1)(b) GDPR) — to provide services to registered users.
Consent (Art. 6(1)(a) GDPR) — for optional features (marketing, analytics cookies).
Legitimate interest (Art. 6(1)(f) GDPR) — for security, fraud prevention and service improvement.
Legal obligation (Art. 6(1)(c) GDPR) — where we are required by law to retain data.

5. Retention periods

Account data — while the account is active. After the account is deleted — up to 30 days for the recovery period, then anonymised or deleted.
Listings — while active or for 90 days after expiry.
Messages — 12 months after the last activity.
Visit log (IP address, country, pages visited) — 24 months, then deleted automatically.
Registration IP address and country — for as long as the account exists.
Unconfirmed registrations (email not confirmed within 7 days, no content in the account) — deleted automatically.
Security and audit logs — up to 12 months.
Payment data (once introduced) — 10 years under the Lithuanian Law on Accounting.

6. Disclosure to third parties

We may disclose personal data only to:

Our hosting provider — data is stored on a server located in Lithuania (EU).
Our email service provider — when sending transactional messages (registration, password reset).
Law enforcement authorities — upon an official lawful request.

We do not sell data or share it with third parties for marketing purposes.

7. Transfers outside the EU

Your data is currently stored and processed only in the EU (Lithuania). If in the future we use service providers outside the EU (e.g. cloud infrastructure), we will ensure appropriate GDPR safeguards (Standard Contractual Clauses, adequacy decisions).

8. Your rights

Under the GDPR you have the following rights:

Right of access — to obtain information about the data we process about you.
Right to rectification — to correct inaccurate data (you can do this in your profile settings or by writing to us).
Right to erasure („right to be forgotten“) — to ask us to delete your account and data.
Right to restriction of processing — to temporarily suspend the processing of your data.
Right to data portability — to receive your data in a structured format.
Right to object — to processing based on legitimate interest.
Right to withdraw consent — at any time, where we process data on the basis of consent.
Right to lodge a complaint with the State Data Protection Inspectorate (vdai.lrv.lt).

To exercise these rights, write to [email protected]. We will reply within 30 days.

9. Cookies

We use only essential cookies (login session, security). Visit statistics are collected without cookies. Details are in the Cookie policy.

10. Data security

We take technical and organisational measures to protect data: HTTPS encryption, password hashing (bcrypt), regular backups and access control. However, no online service can guarantee 100% security — use strong passwords and keep your login details safe.

11. Changes to this policy

We may update this policy. Material changes will be published on the website and, where necessary, communicated by email. The latest version will always be on this page with its update date.

12. Contact

Data protection questions: [email protected]
General contacts: aha.lt/kontaktai