Privacy policy.

Who we are

Vindur Expeditions is an independent travel advisory service run by Viktorija Ezeudu, a sole trader based in Vilnius, Lithuania. Under the EU General Data Protection Regulation (GDPR), she is the controller of the personal data described here.

For any question about this policy, or to use your rights, write to info@vindurexpeditions.com.

What we collect

• Your enquiry: your name, email address, preferred destination, travel dates, who is travelling, and the message you write.
• Our conversation: messages you send us by email or Telegram.
• Trip details, if you decide to go ahead: traveller names and the preferences needed to arrange your journey, such as dietary or accessibility needs you choose to share.
• Technical data: your IP address and basic device information, which our hosting provider processes when you visit the site.

Please don't send health or other sensitive details unless they are needed for your trip. If they are, we will ask for your consent first.

How and why we use it

• To answer your enquiry and plan your trip. Legal basis: steps taken at your request before a booking (Art. 6(1)(b) GDPR).
• To connect you with the trusted partner who will host your trip, once you decide to go ahead. Legal basis: arranging the service you asked for (Art. 6(1)(b)).
• To keep records, protect the site and follow up on your enquiry. Legal basis: our legitimate interest in running the service safely and reliably (Art. 6(1)(f)).
• To meet accounting and tax rules. Legal basis: legal obligation (Art. 6(1)(c)).

We never sell your data, and we only send you marketing emails if you ask us to.

Who receives your data

• Trusted partners. When you go ahead, we share only what the partner needs to host your trip.
• Service providers acting on our behalf: Web3Forms (delivers your form submission to us), Hostinger (email), Cloudflare (website hosting and security), and Telegram if you message us there.
• Third-party content. The site loads fonts from Google Fonts and some images from Unsplash, so your browser connects to those services when you visit.

Some of these providers may process data outside the European Economic Area. Where they do, we rely on safeguards recognised under GDPR, such as the European Commission's Standard Contractual Clauses.

Cookies

This site does not use advertising or analytics cookies. If that changes, we will update this page and ask for your consent where the law requires it.

How long we keep your data

Enquiries that don't lead to a booking are deleted after 24 months. Records of trips we arrange are kept for as long as the law requires for accounting and tax. You can ask us to delete your enquiry sooner.

Your rights

You can ask us to give you access to your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to us and we will reply within one month.

If you are unhappy with how we handle your data, you can complain to the Lithuanian State Data Protection Inspectorate (vdai.lrv.lt) or to the data protection authority in your own country.

Changes to this policy

If we update this policy, we will change the date at the top of this page.