Tvarka Privacy Policy
This English translation is provided for convenience. In case of any discrepancy, the Lithuanian text governs. Lietuviškas tekstas
Tvarka Privacy Policy
This Privacy Policy explains how Tvarka processes personal data.
Last updated: 2026-08-08
1. Data controllers
1.1. The controllers of personal data, according to their respective functions in Tvarka.pro, are Advokato M. Kiškio kontora INVENT (the legal services provider) and Socialiniai algoritmai, UAB (the platform operator). Their roles and contact details are provided in the Contacts section.
1.2. When processing personal data, we comply with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the applicable legal acts of the Republic of Lithuania.
2. Who this Privacy Policy applies to
2.1. The Privacy Policy applies to visitors and users of the Tvarka Platform, as well as to representatives of clients, partners and service providers when they communicate with us or use Tvarka.
2.2. Tvarka Services are provided to businesses only. Tvarka is not intended for minors. Please do not use the Platform if you are under 18 years of age.
2.3. If you submit third parties' personal data while using Tvarka, you are responsible for informing them about this processing and familiarising them with this Privacy Policy.
3. What personal data we process
Tvarka processes personal data to the extent necessary to provide and administer the Platform. The scope of the data may vary depending on the functions used.
3.1. Authentication (login) data
All users are authenticated via the identity verification solutions of Mitsoft TSP and/or the state enterprise Centre of Registers (Registrų centras), using Lithuanian electronic identification means (e.g. Smart-ID, Mobile-ID, the eID card).
We may receive and process the following data provided by the identity verification solution providers: personal code (asmens kodas), first name, surname, country code, certificate data for the audit trail.
3.2. Account and role data
Tvarka stores account and user role information related to a specific legal entity: assigned roles and rights, the date of assignment, the person who made the assignment, and audit records of role changes.
3.3. Legal entity and activity data
Tvarka processes data about the legal entity managed on the Platform and the User's actions on the Platform, e.g.: the legal entity code (company code), name, type (e.g. UAB, MB), compliance settings, participant register records, calendar events, tasks, document metadata.
In some cases, Tvarka may use publicly available or official sources (e.g. register or taxpayer data) to verify or pre-fill legal entity data, if such a function is provided on the Platform.
3.4. Documents and qualified electronic signature (QES) signing data
If you use document storage, document generation or signing, Tvarka processes uploaded documents, generated files and the technical data arising during signing (e.g. the signing time, certificate information, the signing log). QES signing is performed using the document signing infrastructure of Mitsoft TSP and/or the state enterprise Centre of Registers.
3.5. Payment and invoice data
Payments for balance top-ups, invoices and other paid actions are processed by the chosen payment service provider. Tvarka may receive payment status, balance, invoice and payment date information needed to grant access and for accounting. Tvarka does not store full payment card or bank account data.
3.6. Technical data and cookies
Tvarka uses essential cookies and similar technologies (e.g. session cookies, CSRF protection) so that the Platform operates securely. If analytics or marketing cookies are used, they are used only with your consent.
4. Purposes of data processing, legal bases and retention
The main processing purposes are set out below. Specific periods may be adjusted taking into account legal requirements and the actual nature of the provision of the Services.
| Purpose | Data categories | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Account creation and authentication | eID data (personal code, first name, surname), roles | Contract (Article 6(1)(b) GDPR) / legitimate interest (Article 6(1)(f) GDPR) | Until account deletion; audit records – based on legitimate interest and security needs. |
| Provision of the Services (register, calendar, document functions) | legal entity data, activity records, documents | Contract (6(1)(b)) | While the Services are provided and for a reasonable time after their provision ends, to the extent necessary; accounting documents – 10 years. |
| QES signing | signing log, certificate data | Contract (6(1)(b)) | According to document retention periods and audit needs. |
| Payment administration | payment status, balance and invoice information | Contract (Article 6(1)(b) GDPR) / legal obligation (Article 6(1)(c) GDPR) | Accounting documents – 10 years. |
| Security, fraud prevention, incident management | technical logs, IP, device / session data | Legitimate interest (Article 6(1)(f) GDPR) | Usually up to 12 months, unless needed longer due to an incident or dispute. |
| Communication and support | email, content of the enquiry | Contract (Article 6(1)(b) GDPR) / legitimate interest (Article 6(1)(f) GDPR) | Usually up to 2 years from the last contact, unless needed longer due to a dispute. |
5. Data recipients (data processors and/or controllers)
Tvarka may disclose personal data to third parties only to the extent necessary to provide the Services, ensure security or fulfil legal obligations.
Main categories of recipients:
- IT and hosting service providers (e.g. cloud infrastructure);
- Mitsoft TSP and/or the state enterprise Centre of Registers – providers of authentication and QES signing services;
- payment service providers (e.g. Stripe or another service provider specified on the Platform);
- professional advisers (e.g. lawyers, auditors), where necessary to protect legitimate interests or under legal acts;
- state authorities and courts – where required by law or for dispute resolution.
We conclude agreements with data processors ensuring compliance with GDPR requirements.
6. Cookies and other technologies
6.1. Essential cookies. Tvarka does not use additional (analytics or marketing) cookies. Only essential cookies set by infrastructure or identity service providers may be used for the operation and security of the Platform (e.g. bot protection, traffic routing, session maintenance during identity verification). These cookies are processed on the basis of our legitimate interest (GDPR 6(1)(f)).
6.2. Optional cookies. Tvarka does not use analytics or marketing cookies and does not ask for consent for such cookies.
6.3. List of cookies used
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| __cf_bm | Cloudflare | Bot management / abuse protection (Cloudflare Bot Management / Bot Fight Mode). | Up to ~30 min after inactivity |
| _cfuvid | Cloudflare | Rate limiting / web application firewall (WAF) rules: helps distinguish visitors when several users share the same IP address (NAT). | Per Cloudflare configuration (usually session) |
| cf_clearance | Cloudflare | Proof that a Cloudflare security check has been passed successfully. | Per Cloudflare configuration |
| __cflb | Cloudflare (if applicable) | Assignment of sessions to the same origin server (Cloudflare Load Balancer session affinity). | From a few seconds up to 24 h (per settings) |
| X-Oracle-BMC-LBS-Route | OCI (Oracle Cloud Infrastructure) (if applicable) | OCI Load Balancer session assignment (session stickiness) to a backend server. | Per OCI configuration |
| HCLBSTICKY | Hetzner (if applicable) | Hetzner Cloud Load Balancer session assignment (session stickiness) to a backend server. | Per Hetzner configuration |
| sessionid | Mitsoft TSP (tsp.mitsoft.lt) (if applicable) | Session cookie required for the user to stay signed in in the eID environment (signing / identity verification). | Until the browser is closed (session) |
| cookieyes-consent | LT ID (ltid.lt) (if applicable) | Remembers the user's cookie consent preferences on the LT ID website. | 1 year |
| _GRECAPTCHA | LT ID (ltid.lt) (if applicable) | Protection against bots and abuse on the LT ID website. | 6 months |
Note: "if applicable" means that the cookie is set only if the relevant infrastructure or identity service is used in the specific environment, taking into account the user's settings.
7. Data transfers to third countries
7.1. Tvarka may use service providers that process personal data outside the European Economic Area. In such cases, we ensure appropriate safeguards (e.g. the European Commission's standard contractual clauses, adequacy decisions or other measures provided for in the GDPR).
8. Security of personal data
8.1. We apply technical and organisational measures designed to protect personal data against unauthorised access, loss or disclosure.
8.2. In the Tvarka architecture, the personal code is processed securely – an HMAC-SHA256 hash identifier is used for indexing, and encrypted data is stored separately (with keys managed separately) to reduce risk.
8.3. Although we make reasonable efforts, no method of data transmission or storage is 100% secure.
9. Your rights
You have the rights established by the GDPR: the right to access your data, to rectify or erase it, to restrict processing, to object to processing, the right to data portability (where applicable) and the right to lodge a complaint with a supervisory authority.
To exercise your rights, contact us at the email address specified in Section 12. We will respond no later than within 1 month, unless the GDPR allows the period to be extended.
The supervisory authority in Lithuania is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, 10312 Vilnius, email [email protected].
10. Changes to the Privacy Policy
10.1. We may update this Privacy Policy. Updates are published on the Platform. We may additionally inform you about material changes.
11. Responsibility and account security
11.1. Tvarka users are responsible for the security of their devices, electronic identification means and actions on the Platform. We recommend using up-to-date software and taking appropriate cybersecurity measures.
12. Data controllers and contact details
The Tvarka.pro project is operated by Advokato M. Kiškio kontora INVENT and Socialiniai algoritmai, UAB. Their roles, legal entity codes, VAT payer codes and addresses are provided on the About us page.
General Tvarka.pro contact details and the enquiry channel are provided on the Contact page.
13. Tvarka Sign Free personal plan
13.1. This section applies when the free personal plan of the Tvarka Sign app is used by a natural person without a Tvarka account. By way of derogation from clause 2.2, to this extent the service is also provided for personal (non-business) purposes. The controller of the processing described in this section is the platform operator, Socialiniai algoritmai, UAB.
13.2. The following data is processed:
- device registration data: a randomly generated device identifier and access token, technical logs and the IP address (for security, rate limiting and abuse prevention);
- signing data: the qualified certificate data read from the eID card during signing (first name, surname, personal code, certificate information) and the signing log, as described in Section 3.4;
- the monthly limit accounting record: a hash (HMAC) value of the personal code derived from the certificate, the calendar month and the number of signatures – the personal code is not stored in plain text for limit accounting;
- a notification (push) token, if notifications are enabled on the device.
13.3. The PDF document being signed is uploaded to the platform solely to perform the signing operation and is not used for any other purposes. The document and its signed version are deleted once the app confirms the download of the signed document, and in any case no later than 48 hours after upload.
13.4. Legal bases: provision of the service – contract (Article 6(1)(b) GDPR); limit accounting, rate limiting and abuse prevention – legitimate interest (Article 6(1)(f) GDPR); marketing notifications in the app – only a separate consent (Article 6(1)(a) GDPR), which is off by default and can be withdrawn at any time in the app settings.
13.5. Recipients: qualified timestamping service providers in the European Union (e.g. ACCV, Spain) – only a cryptographic digest (hash) is transmitted in the timestamp request, not the content of the document; certificate validity (OCSP) requests are made to the qualified trust service provider that issued the certificate; Google Firebase Cloud Messaging is used for notification delivery (if enabled); as well as the IT and hosting service providers referred to in Section 5.
13.6. Since only technical and de-identified records are stored after the document is deleted, when GDPR rights are exercised we may ask for additional information to link your identity to the records (Article 11 GDPR). To exercise your rights, contact us using the contact details specified in Section 12; the device registration can be terminated at any time by deleting the app or by submitting a request.
13.7. Tvarka Sign data deletion request
Selecting "Settings" and "Clear and start over" in the app removes the activation, the linked card data and the app history from the phone. This local action does not submit a request to delete server records.
To submit a server data deletion request, write to [email protected], enter "Tvarka Sign data deletion" in the subject line and state that you used the free personal plan. If the device identifier is still visible in the app, include it with the request. We may ask for additional information to link your identity to the requested records.
Upon receiving a justified request, we remove or de-identify the data linked to the device registration that is no longer needed. Documents and their signed versions are deleted within the period set in clause 13.3. Technical security logs are usually kept for up to 12 months, support enquiries – for up to 2 years, and data that we must retain due to legal obligations, security, fraud prevention or a dispute remains only for the relevant period specified in Section 4.