Skip to content

Your data

Privacy policy

Who processes your data

This website is run by Vilnius Culture Centre (Vilniaus kultūros centras), a budgetary institution of the Vilnius City Municipality. It is the controller of your personal data.

  • Legal entity code 302448350
  • Rinktinės g. 50, LT-09318 Vilnius, Lithuania
  • Phone (8 5) 261 9557
  • Email info@vilniuskc.lt

For anything related to the festival, write to lightfestival@vilniuskc.lt.

What data we collect

Contact form

When you write to us through the contact form, we receive and store:

  • your name;
  • your email address;
  • the subject, if you give one;
  • the text of your message;
  • the language you wrote in;
  • your browser name and version;
  • a cryptographic digest of your IP address.

We do not store your raw IP address. Instead we store a one-way digest generated with a secret key. We need it only to limit how many messages can be sent and to keep out spam and automated requests. The IP address cannot be reconstructed from that digest.

Legal basis: your consent, which you give by choosing to write to us (GDPR Article 6(1)(a)), and our legitimate interest in answering you and protecting the form from abuse (Article 6(1)(f)).

Using the form is never required. You can always email us directly instead.

Technical server records

Like any web server, ours records standard technical entries: the IP address, the time and address of the request, and the browser type. These keep the site running, secure, and diagnosable. The legal basis is our legitimate interest in the security and stability of the service (GDPR Article 6(1)(f)).

What we do not collect

This site uses no analytics, advertising, or profiling tools. We do not track your browsing, we do not build a profile of your interests, and we make no automated decisions about you. We do not sell your data or pass it on for marketing.

The site writes neither cookies nor any other data to your browser. There is more about this on the cookies page.

How long we keep it

We keep contact form messages for as long as it takes to handle your enquiry and reply to it. After that they are retained for the period set by the records management rules of Vilnius Culture Centre, and destroyed once that period ends. Technical server records are kept briefly and overwritten on a rolling basis.

If you would like your message deleted sooner, write to us and we will do so, unless the law requires us to keep it.

Who we share data with

We share your data with no one, apart from the following:

  • Supabase — the provider hosting the website database and file storage. It acts as a processor under contract and keeps the data on servers within the European Union (North Europe region).
  • An email delivery service — this is how your message reaches the inbox of the festival team.
  • Public authorities — only where the law requires it.

Loading the fonts used on this site discloses your IP address to Google. There is more about this on the cookies page.

Your rights

In relation to your data, you have the right to:

  • access it and receive a copy;
  • have inaccurate data corrected;
  • have it erased;
  • restrict how it is processed;
  • object to processing based on our legitimate interest;
  • receive it in a common machine-readable format and move it to another controller;
  • withdraw your consent at any time — this does not affect processing carried out before the withdrawal.

To exercise any of these rights, write to info@vilniuskc.lt or lightfestival@vilniuskc.lt. We reply within one month. We may ask you to confirm your identity before we act on a request.

If you believe we are handling your data improperly, you may lodge a complaint with the supervisory authority: State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), A. Juozapavičiaus g. 6, LT-09310 Vilnius, Lithuania, email ada@ada.lt. We would be grateful if you came to us first — most questions are settled quickly.

Children

The site is meant for all festival visitors and does not deliberately collect data about children. The contact form is not intended for anyone under 14; children of that age should reach us through a parent or guardian. If we learn that data about a child has reached us without a parent knowing, we delete it.

Security

The site runs over an encrypted connection (HTTPS) only. Contact form messages can be read only by authorised members of the festival team signed in with a personal account. Access rules in the database prevent public visitors from reading or altering those messages.

Updates to this policy

We may update this policy when the website or the law changes. The current version is always published on this page, with its date at the bottom. If a change is significant, we will say so on the site.

Last updated: 28 August 2026

Cookies