FDD24Privacy Policy
fdd24.com · pay.fdd24.com · law24.lt · app.law24.lt · version of 12 September 2026
1. Who processes your data
1.1. The data controller is MB „Martin Solutions", company code 305587540, VAT number LT100013258113, registered office at Čiurlių str. 4, 54462 Lithuania, tel. +370 650 02077. E-mail info@fdd24.com.
1.2. This policy applies to four websites: fdd24.com (information site), pay.fdd24.com (ordering of modules and plans), law24.lt (legal self-help portal) and app.law24.lt (case and deadline management application).
1.3. No data protection officer has been appointed, because none of the cases listed in Article 37(1) of the General Data Protection Regulation (GDPR) applies. That decision is supported by a documented necessity assessment. For any data protection matter, write to info@fdd24.com.
2. Our two distinct roles in the app.law24.lt application
2.1. When you use app.law24.lt we act in two different roles, and whom you should address about your rights depends on which one applies.
2.2. For user account data (name, e-mail address, firm, login records, subscription data) we are the controller. Contact us directly.
2.3. For the data a user enters into the application — case files, data of clients and parties, documents — the controller is the user or their firm, and we act only as a processor, on their instructions. If your data reached the application through a lawyer, a law firm or another user, address your request to them; we forward such requests to the controller and assist them (Article 28(3)(e) GDPR).
3. What data we collect, for what purpose and on what basis
3.1. Enquiries. Name, e-mail address, telephone number and the message you write. Purpose — to reply to your enquiry and, if you wish, to make an offer. Basis — Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) and, where no contract follows, Article 6(1)(f) (legitimate interest in replying and in keeping a record of the correspondence).
3.2. Ordering modules and plans (pay.fdd24.com). Name or company name, company details, e-mail address, order and payment data. Purpose — to perform the order, activate the service and issue a VAT invoice. Basis — Article 6(1)(b) GDPR (contract) and Article 6(1)(c) (legal obligation under the Law on Financial Accounting and the Law on Value Added Tax). We neither see nor store payment card or bank login details — these are handled by the payment service provider.
3.3. Account in the app.law24.lt application. Name, e-mail address, firm, role, login and activity records, two-factor authentication data. Purpose — to provide the service and to ensure security and traceability. Basis — Article 6(1)(b) GDPR; for security records, Article 6(1)(f).
3.4. Technical website data. Server logs record the time of access, IP address, requested address and browser type. Purpose — operation and security of the website. Basis — Article 6(1)(f) GDPR.
3.5. We do not buy your data, do not collect it from social networks and do not use it for automated decision-making or profiling producing legal effects concerning you (Article 22 GDPR).
4. How long we keep it
4.1. Enquiries and correspondence — 1 year from the date of our reply, or together with the contract documents where a contract results.
4.2. Order and accounting documents — 10 years. This period is set by law, not by our choice; we cannot shorten it even at your request.
4.3. app.law24.lt account data — while the account is active and for 6 months after it is closed. After that it is deleted or anonymised.
4.4. Server logs — 6 months.
4.5. In backup copies data remains only for as long as that copy is kept. Copies are made by the hosting provider: nightly (kept 24 hours) and weekly (kept until the following Friday). Data therefore disappears from backups no later than 8 days after deletion from the live system.
5. Who receives the data
5.1. We do not sell your data and do not disclose it to third parties for marketing purposes. We pass it only to those service providers without whom the service would not work, and only to the extent necessary. Data processing agreements have been concluded with all of them (Article 28 GDPR).
5.2. UAB „Interneto vizija" (Lithuania) — hosting of all four websites and of e-mail.
5.3. Paysera LT, UAB (Lithuania) — acceptance of payments for modules and plans.
5.4. Enable Banking Oy (Finland) — collection of bank transaction data for the accounting module, where the client enables that function.
5.5. Anthropic PBC (United States of America) — artificial intelligence functions. See section 6 on this transfer.
5.6. We also disclose data to public authorities where required by law, and to legal advisers where necessary to bring or defend legal claims.
5.7. Contact forms. Form data is processed on our own server and arrives by e-mail directly in our mailbox. We use no external intermediary, and the form pages load no third-party scripts.
6. Transfers to third countries
6.1. The only transfer outside the European Economic Area is to Anthropic PBC (United States of America), used for recognition of invoices and receipts, for the e-mail assistant and for internal working tools.
6.2. The transfer is based on the standard contractual clauses (Article 46(2)(c) GDPR) adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Three (processor to processor). They are incorporated into the Anthropic data processing addendum.
6.3. A transfer impact assessment has been carried out in line with European Data Protection Board Recommendations 01/2020 (version of 15 September 2026). A copy is available on request.
6.4. Permanent restrictions apply: payroll documents, health data, data relating to criminal convictions, children's data and court case pleadings are not submitted to artificial intelligence functions. The provider's terms prohibit the use of our content to train models.
7. Cookies
7.1. fdd24.com and law24.lt set no cookies. These sites use neither Google Analytics, nor social network tracking, nor advertising cookies. There is therefore no consent banner on these sites — and there should not be one.
7.2. app.law24.lt sets a single cookie — PHPSESSID. It is needed so that you stay logged in. The cookie lasts 30 days and is extended on each visit; it is marked Secure, HttpOnly and SameSite=Lax.
7.3. This cookie is strictly necessary: it is required for a service the user has themselves requested. Article 73(4) of the Law on Electronic Communications does not require consent for such storage, but information about it must be given — which is what this section does.
7.4. You may delete the cookie at any time in your browser settings. If you do, you will be logged out and will need to log in again; there are no other consequences.
8. Your rights
8.1. You have the right: to access your data (Article 15); to have inaccurate data rectified (Article 16); to erasure (Article 17); to restriction of processing (Article 18); to data portability (Article 20); to object to processing based on legitimate interests (Article 21); and to withdraw consent where consent was given (Article 7(3)).
8.2. Send your request to info@fdd24.com. We reply within one month; in complex cases we may extend that period by a further two months, informing you within the first month and stating the reason (Article 12(3)).
8.3. Before replying we must be satisfied as to your identity. We ask for additional documents only where there are reasonable doubts, and only to the extent necessary (Article 12(6)).
8.4. Some rights may be limited. For example, we cannot erase accounting documents until the 10-year period laid down by law has expired. In such a case we say so, citing the specific provision, rather than simply stating that we "cannot".
8.5. If you consider that your data is processed unlawfully, you have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt) or to go to court. We would be grateful if you wrote to us first — most matters can be resolved faster that way.
9. Security and notification of breaches
9.1. We apply technical and organisational measures: encrypted connections (TLS), access limited by role, two-factor authentication in the app.law24.lt application, activity logging and backup copies made by the hosting provider UAB „Interneto vizija" under the hosting agreement.
9.2. In the event of a personal data breach we notify the State Data Protection Inspectorate within 72 hours and, where the breach is likely to result in a high risk to your rights, we also inform you without undue delay (Articles 33 and 34 GDPR).
10. Changes to this policy
10.1. The policy is reviewed at least once a year and whenever the purposes of processing, the recipients or the applicable law change.
10.2. We announce material changes on the website and, for users, by e-mail. Earlier versions are kept and provided on request.
10.3. This version — 12 September 2026.
Related: Terms of sale (in Lithuanian) · Contacts