1. Who we are
Profna UAB (registration code 307481105), a company registered in Lithuania with its seat at Klaipėdos g. 4A, Jokūbavas, LT-97210, is the data controller for personal data processed in connection with profna.online. You can reach our data protection contact at [email protected].
2. What data we collect
- Account data: name, business email, password hash, company, role.
- Billing data: billing address, VAT number, invoice references, payment method metadata. Card and bank account numbers are handled by our payment processors and are not stored on our servers.
- Operational data: machine identifiers, defect events, throughput, configuration that you connect to the platform.
- Usage data: log files, IP address, device and browser information, pages viewed, feature interactions.
- Communications: messages you send to support, sales or recruiting.
3. Why we process it
- To provide and operate the Profna platform (performance of a contract).
- To bill you, collect payments and meet accounting obligations (legal obligation).
- To secure the platform, detect abuse and debug issues (legitimate interest).
- To send service announcements and, with your consent, product news.
4. Legal basis (GDPR)
We rely on Article 6(1)(b) (contract), 6(1)(c) (legal obligation), 6(1)(f) (legitimate interest) and, where applicable, 6(1)(a) (consent — for analytics cookies and marketing emails).
5. Sharing
We share data only with vetted processors that help us operate the service: cloud hosting in the EU, payment providers, email delivery, error monitoring and customer support tools. We do not sell personal data.
6. International transfers
Production data is hosted within the European Union. Where a sub-processor is outside the EU, we rely on Standard Contractual Clauses and supplementary safeguards.
7. Retention
- Account data — for the lifetime of your account and 12 months after deletion.
- Invoices and tax records — 5 years, as required by Lithuanian law.
- Server logs — up to 90 days.
- Operational telemetry — for the term of your subscription, then archived for up to 24 months.
8. Your rights
You have the right to access, rectify, erase, restrict and port your data, to object to processing and to withdraw consent. You can also lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI).
9. Security
We use encryption in transit and at rest, role-based access, audit logging, code review and routine penetration testing. No system is perfectly secure, but we work hard to make ours close.
10. Changes
We will post material changes here and notify account owners by email at least 14 days in advance.