1. Who we are (data controller)

AD TRANSPORT, UAB
Company code: 303073483
VAT code: LT100007806415
Address: M. K. Čiurlionio g. 75, LT-66164 Druskininkai, Lithuania
Email: info@adtransport.lt
Tel..: +370 647 90224

This privacy policy applies to the website cowrent.lt (the "Website") and our car rental service.

2. What data we collect and why

2.1. Order and customer service data (contract performance)

• Name, surname, email, phone number, account details, rental period, pick-up/return locations, driving licence details, payment information (via payment provider), communication history.
  Background: GDPR 6(1)(b) - conclusion and performance of a contract; 6(1)(c) - legal obligation (accounting).
  Storage: Period of validity of the contract + 10 years for archiving financial documents (in accordance with legislation).

2.2. Marketing communications (consent/legitimate interest)

• Email, name, contact history.
  Background: GDPR 6(1)(a) - consent (newsletters); 6(1)(f) - legitimate interest (for existing customers for similar services under the LR e-Communications Rules).
  Storage: until the consent is withdrawn/objected to.

2.3 Website performance, security and statistics

• Technical logs (IP, device/browser identifiers, events), cookies or similar technical measures.
  Background: 6(1)(f) - legitimate interest (security, fraud prevention, essential functional cookies).
  Storage: usually up to 1 year (logs), or shorter if there is no need for longer storage.

2.4 Analytics and improving user experience (GA4, Hotjar)

• Google Analytics 4 (GA4): collects aggregated traffic data; EU traffic is received in the EU infrastructure before further processing; possible transmission in the Google ecosystem under DPF/SCC. Required Consent (no cookies required).
• Hotjar: session records, heatmaps, surveys; Hotjar declares GDPR compliance and EU/EEA data storage, with limited access to sub-processors. Requires Consent (no cookies required).
  Storage: GA4 - according to our settings (e.g. 14 months); Hotjar - according to the project configuration (e.g. 12 months). Please refer to the cookie policy for exact terms.

3. Cookies and consent management

We use a consent management solution (CMP) that allows you to select categories of cookies: Essential, analytical, marketing. Analytical (GA4) and behavioural analysis (Hotjar) are only enabled with explicit consent. You can change your selections at any time during "Cookie settings" On the website.

4. Data recipients and transfers

• Service providers: hosting, IT maintenance, email, CRM, payment providers ([insert: e.g. Opay, Paysera]), accountants, lawyers.
• Google LLC (GA4) - DPF-certified organisation; Standard Contractual Clauses and supplementary measures apply where applicable.
• Hotjar Ltd (Malta) - Data storage in the EU/EEA; access possibly granted to sub-processors under DPA.

If the data is transferred outside the EEA, we apply GDPR Section V. requirements (DPF, SCC, additional technical/organisational measures).

5. How long we keep data

Follow us at data minimisation and terms principles:

• Lease agreement data - period of the agreement + statutory time limits (e.g. 10 years for financial documents).
• Customer service history - up to 3 years since last contact, unless otherwise justified.
• GA4 / Hotjar - according to the retention set (see section 2.4 and cookie policy).

6. Your rights

You have rights under the GDPR: Available at, fix, delete, restrict, move, oppose (incl. profiling/direct marketing), withdraw consent at any time, without affecting the processing based on the processing prior to the revocation.

Applications should be submitted by email to info@adtransport.lt. We will reply within 30 days. If you feel that your rights are being violated, you can contact the State Data Protection Inspectorate.

7. Security

We implement technical and organisational measures: access control, encryption (TLS), logs, backups, need-to-know access, supplier DPA.

8. Cases not covered by Articles 14-16 (children)

The service is for adults. We do not intentionally process children's data.

9. Policy changes

We will publish changes on this page; substantive changes will be published in a separate notice (if applicable).