Privacy information
Updated 10 September 2026.
The data controller is Silver bess park, UAB. For privacy enquiries and to exercise your rights, email info@silverbess.lt.
This information is for website visitors and people who submit an expression of interest.
What information we process
If you specify an exact number of batteries, we also store that number. When handling your enquiry, we may add an internal note and a next-contact date; these have the same retention period as the submission. If the link contains campaign tags, we store only utm_source, utm_medium, utm_campaign, utm_content and utm_term with the submission (up to 200 characters each). We do not store the visitor’s full URL. The tags help us understand where the enquiry came from.
When submitting the form, you provide your name, email address, the number of batteries you are considering and your funding choice. Your phone number and question are optional. Please do not enter sensitive information or other people’s data in the question field. We also store the submission ID, submission and expiry times, processing status and the time of status changes. The technical status of the notification may be stored with the record.
We also store the website language used to submit the form. This does not establish nationality or a preferred language for communication.
Providing information is voluntary. The form cannot be accepted without a name, a valid email address and the required selections. Registering does not create a visitor account or commit you to entering into a contract.
Purposes and legal basis
We use your contact details and answers to respond to your interest in the battery park and discuss participation. For enquiries about your potential participation, the legal basis is taking steps at your request before entering into a contract (GDPR Article 6(1)(b)). For general enquiries and contact details of organisation representatives, we rely on our legitimate interest in responding to enquiries (Article 6(1)(f)).
Website security and administrator login data are needed for our legitimate interest in protecting the system from automated abuse and unauthorised access. We limit data collection, access and retention. Reading this privacy information is not consent or a separate legal basis for processing. The form does not create a marketing subscription.
Retention periods
We retain the submission for 6 calendar months from submission. The ‘Continuing’ status does not extend this period. After expiry, the record is no longer listed in administration and its details cannot be accessed. Automatic physical deletion is asynchronous; according to Firestore documentation, it usually occurs within 24 hours. Any subsequent contractual relationship is subject to separate arrangements.
To limit submission frequency, we use an HMAC identifier instead of a plain email address and a counter valid for up to 2 hours after a request; the global counter lasts up to 2 minutes. These data are pseudonymous, not anonymous. Expired counters are deleted automatically. Administrator sessions last up to 8 hours; expired session records are also deleted automatically.
Technical infrastructure logs may contain IP addresses, browser information, request times and URLs. Standard project logs are retained for 30 days and mandatory infrastructure audit logs for 400 days. Application logs do not copy contact details or questions from the form. These periods do not extend the use of a submission.
Who receives the information
Only an authorised administrator can view submissions. We use Google Firebase Hosting and Cloud Run to serve the website, and Firestore to store submissions. The project’s Firestore and Cloud Run region is Belgium (europe-west1). Firebase Authentication is used only for the administrator’s Google login; visitors do not need to sign in.
Cloudflare Turnstile checks technical browser signals to distinguish people from bots. Cloudflare may process the IP address, browser headers, TLS characteristics and site identifier. We do not send the form’s name, email, phone number or question to Cloudflare in our Siteverify request. Cloudflare’s notice distinguishes website protection on our behalf from improvements to detection carried out as a controller in its own right.
Processing across these services is not limited to the EU: Firebase Authentication operates in the United States, and Google and Cloudflare may use global infrastructure. Their documentation explains their processing terms and safeguards for international transfers; you may also contact us about the applicable safeguards and copies of them.
An administrative notification of a new submission is sent via the Gmail API, with a link to the protected administration area. The applicant’s name, email, phone number, question and other form data are not copied into the email. Applicants are not sent automated emails.
Cookies and analytics
With analytics consent, Google Analytics uses _ga and _ga_* cookies (up to 180 days). With advertising consent, Meta uses _fbp and, when an advertising click identifier is present, _fbc (up to 90 days). These associate visits and advertising results. Cookie expiry may be refreshed on visits. Withdrawing consent removes accessible cookies from these providers and stops new measurement; it does not delete data already sent to them.
Optional Google Analytics 4 and Meta Pixel measurement is enabled only after the services are configured and you separately consent to analytics or advertising measurement. These scripts do not load before consent. Your choice is remembered in your browser for 180 days and can be changed in Cookie settings. Declining does not prevent form submission.
With consent, Google and Meta may receive your IP address, browser and device information, page URL, cookie identifiers, and events for visits, scrolling, starting the form and successful submission. This helps assess traffic and advertising results. Form names, email addresses, phone numbers and questions are not sent in analytics events. Google advertising signals and automatic contact matching are not enabled. Data may be processed outside the EEA under the providers’ terms.
Campaign tags are held temporarily only in browser session storage so they persist between pages; no separate visitor identifier is created. Fonts are served with the website. The administration area uses the essential ‘__session’ cookie: before login it lasts 10 minutes to protect against forged requests; after login, up to 8 hours, and it is removed on logout. Firebase login state is held in memory, not persistent browser storage.
The Turnstile script loads in the public form only when submissions are enabled. In administration, it also loads when the administrator opens the integration check. The Cloudflare privacy information linked below applies to this security measure; it is not our visitor analytics.
Your rights
You may request access to, correction or deletion of your data, or restriction of processing. Where the GDPR conditions apply, you have the right to data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Send requests to info@silverbess.lt; before disclosing information, we may ask for proportionate verification of your identity. We normally respond within one month and will inform you of any lawful extension and its reasons.
You can lodge a complaint with the Lithuanian State Data Protection Inspectorate. We do not use the form to make solely automated decisions that have legal or similarly significant effects on you.