Last updated on 4 November 2026.
This policy explains what personal data we process when you visit windalux.com, send us an enquiry, call or write to us, why we do it, how long we keep the data and what your rights are.
1. Data controller
MB “Windalux”, company code 305193969, VAT code LT100012601812, address R. Jankausko g. 6D, 04310 Vilnius, Lithuania. Email info@windalux.com, phone +370 648 37530. You can contact us here about anything to do with your personal data.
2. What data we process and why
Enquiries and quotes
When you send an enquiry through a form on the site, we receive the details you enter: your name, phone number, email address, company name, who you are (developer, contractor or private client), the number of houses, your message and any attached files (PDF, ZIP). We also record the page, form and language of the enquiry, and how you came to the site (for example from a search engine or an ad campaign).
We use this data to answer your enquiry, prepare a quote, contact you about it and see which of our advertising channels work. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in handling customer enquiries and evaluating our marketing (Article 6(1)(f)).
If you give your email address, we send you an automatic confirmation in your language that we have received your enquiry. Attached files are stored in a closed folder on the server, and only our staff can download them: the notification sent to our staff contains secure links that are valid for 30 days, and small files (up to 7 MB in total) are also attached to it.
Calls and emails
When you call or write to us, we use your phone number, email address and our correspondence to answer you and prepare a quote, on the same legal bases as enquiries.
When you click a phone number or email address on the site, we record only the click itself: the time, the button, the page, the device type, the language and the traffic source. We do not record your IP address or use cookies, so these records are not personal data. They help us see which pages and campaigns bring in calls.
Site security
The site’s security system records the IP address, time and type of request when someone tries to sign in to the administration area, sends spam or scans the site for vulnerabilities. The log of missing pages stores IP addresses only in anonymised form. To stop forms being sent in bulk, the number of enquiries from one IP address is limited, using a hash of the IP address that is deleted after an hour. Rejected form submissions (such as spam) are logged with a shortened IP address. The legal basis is our legitimate interest in protecting the site and the data it holds (Article 6(1)(f)).
Emails sent by the site
Copies of the emails the site sends (enquiry notifications and confirmations) are kept in an email log so that we can check they were delivered.
Analytics and advertising — only with your consent
The site uses Google Tag Manager, Google Analytics 4 and Google Ads. On your first visit, the cookie banner lets you choose which cookies you accept.
- Until you give consent, Google tags neither set nor read cookies. They send only the consent status and technical information without user identifiers (Google Consent Mode), from which Google estimates aggregate statistics.
- If you accept analytics cookies, Google Analytics 4 collects visit statistics: the pages you view, your device, your approximate location, the traffic source and your actions on the site (such as clicks and form submissions). Google Analytics 4 does not store IP addresses.
- If you accept marketing cookies, Google Ads measures which ads led to enquiries and calls and may show our ads to visitors of the site. When you send an enquiry, your email address and phone number are passed to Google encoded as an SHA-256 hash (enhanced conversions), so that the enquiry can be matched to an ad click. We also store the ad click identifier with the enquiry: if the enquiry becomes an order, we may use it to report the conversion to Google Ads without passing on your name or contact details.
The legal basis is your consent (Article 6(1)(a)). You can change or withdraw your consent at any time with this button or the “Cookie settings” link at the bottom of the site.
NDA.lt statistics
The site uses a tag of the NDA.lt advertising network, which collects anonymous visit statistics and does not use cookies. The legal basis is our legitimate interest in measuring the effectiveness of our advertising (Article 6(1)(f)).
Map and videos
The Google Maps map on the contact page loads only when you click it. Google then receives your IP address and may use its own cookies under its privacy policy. Videos of the window systems open on YouTube.
Artificial intelligence tools
Our staff may manage the site’s content and, where needed, enquiries through AI assistants connected to the site with the M MCP plugin. An assistant works only with the rights of the signed-in staff member and receives only the data needed for the task at hand (for example, a summary of enquiries). We use only business services whose providers process the data under a data processing agreement and do not use it to train their models. The legal basis is the same as for handling enquiries.
3. Cookies and browser storage
| Name | Purpose | Duration | Type |
|---|---|---|---|
| mcc_consent | Remembers your cookie choice | 180 days | Necessary |
| wdx-landing, wdx-click, wdx-leads (browser session storage) | Links an enquiry to the first page you visited and the traffic source, and stops the same enquiry being counted twice. The data stays in your browser until you send an enquiry; the ad click identifier is sent only with marketing consent | Until you close the browser tab | Necessary |
| wordpress_*, wp-settings-* | Only for signed-in staff of the site | Up to 1 year | Necessary |
| _ga, _ga_* | Google Analytics: distinguishes visitors and visits | Up to 2 years | Analytics |
| _gcl_au, _gcl_aw | Google Ads: links ad clicks to enquiries | 90 days | Marketing |
If you accept marketing cookies, Google may also use its own cookies on its own domains (such as google.com and doubleclick.net).
4. Who receives the data
- the hosting provider whose servers run the site and keep its backups;
- the email service provider through which the site sends its emails;
- Google Ireland Limited (Google Analytics, Google Ads, Google Tag Manager, Google Maps), as described in section 2;
- NDA.lt — anonymous statistics only;
- providers of AI services, when our staff use these tools;
- manufacturers and partners — only the data needed to fulfil your order;
- public authorities, where the law requires it.
We do not sell personal data. Google and some other providers may also process data outside the European Economic Area, for example in the USA. In that case the data is transferred under the European Commission’s adequacy decision (the EU–US Data Privacy Framework) or standard contractual clauses.
5. How long we keep data
| Data | Retention period |
|---|---|
| Enquiries and their files | 24 months from receipt, then deleted automatically. If we enter into a contract, the data related to it is kept for as long as the law requires (for example, accounting records). |
| Files of forms that were never sent | 1 day |
| Copies of emails sent by the site | 30 days |
| Security and missing-page logs | 30 days |
| Log of rejected form submissions | The last 200 entries |
| Your cookie choice | 180 days |
| Google Analytics data | 14 months |
6. Your rights
You have the right to:
- access your data and get a copy of it;
- have inaccurate data corrected;
- have your data erased or its processing restricted;
- object to processing based on legitimate interest;
- receive the data you gave us in a structured format and pass it to another controller;
- withdraw your consent at any time, without affecting processing carried out before the withdrawal.
Write to info@windalux.com and we will reply within one month at the latest. We may need to confirm your identity.
If you believe your data is processed unlawfully, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt). We do, however, invite you to contact us first — we will try to resolve the matter quickly.
7. Data security
The site works over an encrypted HTTPS connection. Enquiries and their files can be seen only by our staff, signed in with personal accounts; the files are stored in a closed folder that cannot be reached directly from the internet. The site is protected by a system that guards against intrusions and spam.
8. Changes to this policy
If the way we process data changes, we will update this policy and publish the new version on this page with the date of the update.