Privacy Policy
Website: https://gresalaivai.lt/
Last updated: November 2, 2026
1. General Provisions
This Privacy Policy explains how personal data of visitors and customers is collected, used, stored, and protected on the website https://gresalaivai.lt/ (hereinafter referred to as the "Website").
The Website presents the services of "Gresa laivai", including boat and motorboat rentals, excursions, private cruises, celebrations, and other events on the Curonian Lagoon.
We respect your privacy and are committed to processing personal data lawfully, fairly, and transparently.
Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter referred to as the "GDPR"), the applicable Lithuanian data protection legislation, and other relevant legal requirements.
2. Data Controller
The controller of personal data processed through the Website is:
MB "Marių Gidas"
Company registration number: 302646072
Registered office address: [Insert registered office address]
Contact / business address: Naglių g. 18B, Nida, 93123 Neringa Municipality, Lithuania
Email: info@gresalaivai.lt
Phone: +370 638 38999
You can use these contact details to submit questions regarding the processing of your personal data or to exercise your data protection rights.
3. What Personal Data Do We Collect?
Depending on how you use the Website and our services, we may process the following categories of personal data.
3.1. Contact Information
When you contact us through the Website's contact form, by email, or by phone, we may process:
First name.
Last name, if provided.
Email address.
Phone number, if provided.
Content of your inquiry or message.
Any other information you voluntarily provide.
3.2. Booking and Service Order Information
When you inquire about boat rentals, excursions, private cruises, or event arrangements, we may process:
Customer's first and last name.
Contact details.
Requested service or route.
Date and time of the cruise or event.
Number of participants.
Additional requests and booking details.
Information relating to booking administration and payments.
We only process data that is necessary to respond to inquiries, administer bookings, or provide the requested services.
3.3. Technical Browsing Data
When you use the Website, the following data may be processed automatically:
IP address.
Browser type and version.
Device and operating system information.
Date and time of the visit.
Information about technical requests and Website functionality.
Cookies and other technology identifiers, where applicable.
3.4. Website Analytics Data
The Website uses Google Analytics 4 to collect website traffic statistics and evaluate Website performance.
Depending on the applicable consent mechanism and the technology settings, the following data may be processed:
Information about Website pages visited.
Visit time and duration.
Information about the device and browser used.
Approximate geographical location.
Browsing session information.
Information about visitor interactions with the Website.
Analytics identifiers, where the necessary consent has been obtained.
Analytics technologies are used in accordance with the applicable visitor consent requirements.
4. Purposes and Legal Bases of Personal Data Processing
We process personal data for the following purposes:
4.1. Responding to inquiries and providing information
We process personal data to respond to visitors' inquiries and provide requested information about our services.
Legal basis: Article 6(1)(f) GDPR (legitimate interests) or Article 6(1)(b) GDPR (taking steps prior to entering into a contract).
4.2. Administration of bookings
We process personal data to administer bookings for boat rentals, excursions, and events.
Legal basis: Article 6(1)(b) GDPR (entering into and performing a contract).
4.3. Communication with customers
We process personal data to communicate with customers regarding booked services.
Legal basis: Article 6(1)(b) GDPR (performance of a contract) or Article 6(1)(f) GDPR (legitimate interests when communicating with representatives of legal entities).
4.4. Compliance with legal obligations
We process personal data to comply with accounting and other applicable legal obligations.
Legal basis: Article 6(1)(c) GDPR (compliance with a legal obligation).
4.5. Website security and functionality
We process technical data to ensure Website security and proper functionality.
Legal basis: Article 6(1)(f) GDPR (legitimate interests).
4.6. Website traffic analytics
We use Google Analytics 4 to analyze Website traffic and improve its performance.
Legal basis: Article 6(1)(a) GDPR (consent), where the processing requires consent.
When processing personal data, we follow the data minimization principle and collect only the information necessary for specific purposes.
5. Contact Form and Communication
The Website provides a contact form that allows you to contact us regarding our services.
When using this form, you are asked to provide your first name, email address, and message. Providing your last name is optional.
We use this information to:
Respond to your questions.
Provide information about boat rentals, excursions, or events.
Prepare a personalized offer.
Contact you regarding a requested service.
Manage further communication.
Information submitted through the contact form is not used for direct marketing solely because you have submitted an inquiry.
6. Service Bookings
When you book a boat rental, excursion, or event organization service, we may request additional information necessary to fulfil your booking.
We use this information to plan services, inform customers, fulfil contractual obligations, and administer payments.
If you do not provide certain information required for a booking, we may be unable to fulfil your order or provide the requested service.
7. Personal Data Retention
We retain personal data only for as long as necessary to achieve the purposes for which it was collected, fulfil contractual obligations, and comply with applicable legal requirements.
7.1. Contact inquiries and correspondence
Retention period: [Specify actual period, e.g. 12 months from the last correspondence].
7.2. Service orders and booking information
Retention period: [Specify period according to contract administration and potential legal claims].
7.3. Accounting documents
Retention period: For the period required by applicable laws.
7.4. Technical Website logs
Retention period: [Specify actual retention period].
7.5. Google Analytics 4 data
User-level and event-level data are retained according to the settings selected in the Google Analytics account.
Retention period: [Specify the actual period selected in the Google Analytics account].
7.6. Cookie data
Retention period: According to the retention periods specified in the Cookie Policy.
The retention period may be extended where necessary to comply with legal obligations or to establish, exercise, or defend legal claims.
After the applicable retention period expires, personal data is deleted or irreversibly anonymized unless another lawful basis for its retention exists.
8. Disclosure of Personal Data to Third Parties
Personal data may be shared with service providers that assist us in administering the Website and conducting our business activities.
Such service providers may include:
Website hosting, development, and technical maintenance providers.
Email and communication service providers.
Website analytics and tag management providers.
Technical security and external content delivery providers.
Accounting and other necessary service providers.
The following third-party technologies were detected on the Website:
Google Analytics 4 and Google Tag Manager
Google services are used for Website traffic analysis and the management of technical tags.
For services provided within the European Economic Area, the relevant Google service provider is Google Ireland Limited.
When these technologies are used, certain technical and analytics data may be transferred to Google, depending on the visitor's consent and the actual technology settings.
Further information: https://policies.google.com/privacy
Cloudflare
Cloudflare technologies are used to protect external resources displayed on the Website.
These technologies may process technical data, including IP addresses, request information, and security identifiers, in order to protect services against automated or unwanted traffic.
Further information: https://www.cloudflare.com/privacypolicy/
Zyrosite and Pexels
The Website uses external visual or technical resources delivered from the domains zyrosite.com and pexels.com.
When these resources are accessed, the relevant service providers may receive technical information about the request and the user's device.
Other Data Recipients
Personal data may also be disclosed to competent public authorities where required by applicable law.
We share only the personal data necessary for the relevant service providers to perform their functions.
9. International Transfers of Personal Data
When third-party technologies, including Google and Cloudflare services, are used, personal data may in certain circumstances be transferred outside the European Economic Area, including to the United States of America.
Such transfers are carried out only where there is a valid transfer mechanism under the GDPR and appropriate data protection safeguards are applied.
Depending on the recipient and the specific transfer, these may include a European Commission adequacy decision under the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
You may contact us using the details provided in this Privacy Policy to obtain information about the safeguards applicable to specific transfers.
10. Cookies and Tracking Technologies
The Website uses technical cookies and website analytics technologies.
Technical cookies may be used to ensure the security of external resources, protection against automated traffic, and request management.
The Website also uses Google Analytics 4 and Google Tag Manager technologies for Website traffic analysis and technical tag management.
Non-essential analytics or other tracking technologies are used only in accordance with applicable prior consent requirements.
Detailed information about cookies, their purposes, providers, retention periods, and how to manage your preferences is provided in the Website's Cookie Policy.
11. Your Rights
Under the GDPR and subject to the conditions set out therein, you have the right to:
Access your personal data – obtain information about the personal data we process and receive a copy of it.
Rectify your personal data – request correction of inaccurate data or completion of incomplete data.
Erase your personal data – request deletion of your personal data in certain circumstances.
Restrict processing – request temporary restriction of the processing of your data.
Object to processing – object to processing based on legitimate interests, subject to the conditions set out in the GDPR.
Data portability – in certain circumstances, receive your data in a structured, commonly used, and machine-readable format.
Withdraw consent – withdraw your consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, please contact us at info@gresalaivai.lt.
We will respond to your request within one month of receipt, unless an extension is permitted under the GDPR.
Where necessary, we may request additional information to verify your identity.
12. Personal Data Security
We apply appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, loss, or disclosure.
Access to personal data is granted only to persons who need it to perform their duties.
13. Links to Other Websites and Social Media
The Website may contain links to social media platforms, including Instagram, and other external websites.
When you follow such links and visit external websites, the privacy policies of the respective service providers may apply.
If you contact us through social media, we process the information you provide in order to respond to your inquiry and manage related communication.
14. Right to Lodge a Complaint
If you believe that your personal data is being processed unlawfully, we encourage you to contact us first.
You also have the right to lodge a complaint with the competent data protection supervisory authority.
In Lithuania, the supervisory authority is:
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)
Website: https://vdai.lrv.lt
15. Changes to This Privacy Policy
MB "Marių Gidas" may update this Privacy Policy if our personal data processing practices, Website functions, technologies, or applicable legal requirements change.
The current version of this Privacy Policy will always be available on the Website.
16. Contact Information
For any questions concerning personal data protection, please contact:
MB "Marių Gidas"
Company registration number: 302646072
Email: info@gresalaivai.lt
Phone: +370 638 38999
Contact address: Naglių g. 18B, Nida, 93123 Neringa Municipality, Lithuania.
