legal

Privacy policy

Last updated: 23 October 2026

This Privacy Policy explains how UAB NorthSpace ("NorthSpace", "we", "us"), a private limited liability company registered in the Republic of Lithuania at A. Goštauto g. 8, Vilnius, 01122 Vilniaus m. sav., processes personal data collected through the website northspace.agency (the "Site"). We are the data controller for that processing within the meaning of the EU General Data Protection Regulation (GDPR).

1. What data we collect

Order form data. When you send a request through the contact form we receive the name, e-mail address or phone number, project description and budget range you choose to share. If you subscribe to our digest, we receive your e-mail address.
Correspondence. If you write to us by e-mail, we receive your contact details and the content of your message.
Technical logs. Our servers keep short-lived technical logs (IP address, request time, user agent) needed to run the Site securely and to prevent abuse.

The Site does not use analytics trackers, advertising pixels or third-party marketing cookies. The only cookie the Site sets is a technical session cookie for our own staff area — it is never set for visitors. Your browser's local storage keeps a single flag once you close the "Wooslow Studio is now NorthSpace" notice, so it is not shown again; it never leaves your device.

2. Why we process it (purposes and legal bases)

To answer your request and prepare a proposal — Art. 6(1)(b) GDPR (steps at your request prior to entering into a contract) and Art. 6(1)(a) GDPR (your consent given by submitting the form).
To perform a contract with you if we start working together — Art. 6(1)(b) GDPR.
To keep the Site secure and prevent abuse — Art. 6(1)(f) GDPR (our legitimate interest in running a safe service).
To comply with legal obligations (e.g. accounting) — Art. 6(1)(c) GDPR.

3. How long we keep it

Order-form requests: for as long as needed to handle your enquiry and no longer than 2 years after our last contact, unless we enter into a contract.
Contract and accounting records: for the periods required by Lithuanian law.
Technical server logs: up to 30 days.

4. Who we share it with

We do not sell or rent personal data. We share it only with service providers that help us run the Site and our business (such as hosting and e-mail providers) under data-processing agreements, and with public authorities where the law requires it. We keep data within the European Economic Area; if a transfer outside the EEA is ever needed, we will rely on safeguards recognised by the GDPR (such as the European Commission's Standard Contractual Clauses).

5. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased ("right to be forgotten");
restrict or object to processing;
receive your data in a portable format;
withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, e-mail [email protected]. We answer within one month. If you believe we process your data unlawfully, you may lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or the supervisory authority of your EU country.

6. Security

We apply appropriate technical and organisational measures: encrypted connections (HTTPS), access controls, minimal data collection and regular reviews of what we store. Access to request data is limited to NorthSpace staff who need it to reply to you.

7. Changes to this policy

We may update this Privacy Policy from time to time. The current version, with its date, is always published on this page. Material changes will be highlighted on the Site.