Exergio, UAB (“Exergio”, “we”, “us”) respects your privacy. This policy explains what personal data we collect through exergio.com and in our business dealings, why we collect it, and what rights you have.

1. Who we are

Exergio, UAB is the controller of the personal data described in this policy. Our legal entity code is 304848763 and our registered address is Ozo g. 12A-1, LT-08200 Vilnius, Lithuania. Full company details are in our Legal Notice.

Our data protection officer is Lukas Stankevičius. You can reach him, and send any privacy request, at [email protected].

2. What this policy covers

This policy applies when you visit exergio.com and its subdomains, contact us, book a meeting, subscribe to our updates, register for one of our events, or deal with us as a representative of a client, partner, supplier or media outlet.

It does not cover data that the Exergio platform processes inside our clients’ buildings. There we act under a contract with the client, and the client’s own privacy notice applies.

3. Data we collect, why, and on what legal basis

Answering enquiries

Data: name, work email, phone, company, job title and the content of your message.

Legal basis: our legitimate interest in replying to business enquiries (Art. 6(1)(f) GDPR), or steps taken at your request before a contract (Art. 6(1)(b)) where you ask for an offer.

Kept for: 2 years after the last contact.

Booking and holding meetings

Data: name, email, company, meeting time and anything you add to the booking. Meetings are booked through Calendly.

Legal basis: steps taken at your request before a contract (Art. 6(1)(b)).

Kept for: 2 years after the meeting.

Proposals, pilots and contracts

Data: contact details of client and partner representatives, building and portfolio information you share, and correspondence.

Legal basis: performance of a contract (Art. 6(1)(b)) and our legitimate interest in managing a business relationship (Art. 6(1)(f)).

Kept for: the term of the relationship plus 10 years.

Newsletter and marketing emails

Data: name, email, company, subscription preferences, and whether messages are opened or clicked.

Legal basis: your consent (Art. 6(1)(a)). For existing clients, our legitimate interest in telling them about similar services (Art. 6(1)(f)), with an opt-out in every message.

Kept for: until you unsubscribe, and no longer than 3 years after your last interaction.

Events

Data: name, email, company, job title, attendance, and dietary or access needs if you tell us.

Legal basis: performance of a contract (Art. 6(1)(b)) for registration; your consent (Art. 6(1)(a)) for photos or video in which you are the main subject.

Kept for: 1 year after the event.

Running and securing the website

Data: IP address, device and browser data, pages requested, date and time, and referrer.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f)).

Kept for: short-term server logs held by our hosting provider and deleted on its standard schedule.

Website statistics

Data: pages viewed, referrer, approximate country and device type, collected by Framer Analytics without cookies and without building a profile of you.

Legal basis: our legitimate interest in understanding how the website is used (Art. 6(1)(f)).

Kept for: aggregated statistics only.

Accounting, tax and legal claims

Data: invoices, contracts, payment records and related correspondence.

Legal basis: legal obligation (Art. 6(1)(c)) and our legitimate interest in defending legal claims (Art. 6(1)(f)).

Kept for: 10 years, as Lithuanian accounting rules require.

Job applications

Data: your CV and any details you send us.

Legal basis: our legitimate interest in assessing the application (Art. 6(1)(f)); your consent (Art. 6(1)(a)) if we keep it for future roles.

Kept for: 6 months after the decision, or up to 2 years with your consent.

We collect most of this directly from you. We may also receive business contact details from your colleagues, our partners, event co-organisers, and public sources such as company websites and LinkedIn.

You are not obliged to give us data, but without contact details we cannot reply, book a meeting or send an offer. We do not ask for special categories of data, and we do not make decisions based solely on automated processing that produce legal or similarly significant effects.

Our website and services are aimed at businesses. They are not intended for anyone under 16.

4. Who receives your data

We do not sell personal data. We share it only with:

• Service providers acting on our instructions: Framer B.V. (website hosting and statistics, Netherlands), Calendly, LLC (meeting booking, USA), Google Ireland Limited (delivery of web fonts), and the providers of our email, office, customer-relationship and newsletter software.

• Event co-organisers and venues, where needed to admit you to an event you registered for.

• Exergio sales partners, where your enquiry concerns a market that a partner serves. They may use the data only to respond to that enquiry.

• Professional advisers, such as lawyers, auditors and accountants.

• Public authorities, where the law requires it.

• A successor business, if Exergio is merged, sold or reorganised.

5. Transfers outside the EEA

Some providers are based in, or reachable from, countries outside the European Economic Area, mainly the United States. In that case we rely on a European Commission adequacy decision (including the EU–US Data Privacy Framework for certified companies) or on the Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

6. Security

We use technical and organisational measures suited to the risk, including encrypted connections, access limited to staff who need it, and contracts with our providers. No online service is fully secure. If a breach is likely to put your rights at high risk, we will tell you without undue delay.

7. Your rights

Under the GDPR you can ask us to:

• give you access to your data and a copy of it;

• correct data that is inaccurate or incomplete;

• erase your data;

• restrict how we use it;

• transfer it to you or to another controller, where processing rests on consent or contract;

• stop processing based on legitimate interest, and stop direct marketing at any time;

• withdraw consent at any time, which does not affect earlier processing.

Write to [email protected]. We reply within one month. In complex cases the law lets us extend this by two more months, and we will tell you if we do. We may ask for information to confirm your identity. Requests are free unless clearly unfounded or excessive.

You can also complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt), or to the authority in the EU country where you live or work.

8. Cookies

Our Cookie Policy explains what the website stores on or reads from your device.

9. Links and social media

Our site links to third-party sites such as LinkedIn and Calendly. Those services process your data under their own privacy policies once you follow the link.

10. Changes

We will post any changes on this page and update the effective date. If a change materially affects you and we have your contact details, we will tell you directly.