This policy explains what personal data MB Kreado Group collects through this website and in the course of business correspondence, why we collect it, and what rights you have over it. Last updated: July 2026.
Who we are
MB Kreado Group is the data controller for the personal data described in this policy.
MB Kreado Group
Burbiškių g. 6-20, Vilnius LT-02184, Lithuania
Company code: 304607004
VAT: LT100014403110
Email: jokubas@kreadogroup.com
Phone: +370 620 15573
Website: https://www.kreadogroup.com
We are a small company and are not required to appoint a Data Protection Officer. Questions about this policy go to the email address above.
What we collect and why
When you contact us
If you email or call us about a project, we process the information you choose to give us: your name, employer, job title, email address, phone number, and the content of your message. We use it to answer you, to prepare a quotation, and to manage the resulting commercial relationship.
When you send us drawings or tender documents
To price a package we ask for drawings, specifications, or tender material. These are commercial documents rather than personal data, but they often contain names, signatures, and contact details of designers, engineers and project staff.
We treat everything you send as confidential. We use it only to prepare a price and, if you place an order, to execute the work. To produce a quotation we share the relevant technical documents with the fabricators, coating applicators and hauliers in our network who need them to price or perform their part of the scope. We do not publish your drawings, use them for any other client, or pass them to anyone outside that chain without your agreement.
If you need a signed non-disclosure agreement before sending anything, ask and we will sign yours.
Website analytics
With your consent, we use Google Analytics (via Google Tag Manager) to understand how the site is used — which pages are read, how visitors arrive, and roughly where they are. This sets cookies in your browser and shares data, including your IP address, with Google. If you decline analytics in the cookie banner, these cookies are not set.
Cookies and your consent choice
Cookies strictly necessary to make the site work are always active. Everything else — preferences, statistics, marketing — is only set if you agree in the cookie banner. We store a record of the choice you made, so that we can prove consent was given and so that you are not asked again on every visit. You can change or withdraw your choice at any time through the cookie settings on this site.
Server logs
Our hosting provider automatically records technical information about requests to the site, including IP address, browser type, and the time of the request. These logs exist to keep the site running and secure. We do not use them to identify individual visitors.
Our legal basis
Under the GDPR we rely on the following bases:
- Legitimate interests (Art. 6(1)(f)) — for ordinary business-to-business correspondence, for answering enquiries, and for keeping the website secure. Our interest is in running a construction supply business; we consider this proportionate because the data concerns you in a professional capacity, not a private one.
- Performance of a contract (Art. 6(1)(b)) — where we are preparing or executing a quotation, order or delivery for you or your employer.
- Consent (Art. 6(1)(a)) — for analytics and any other non-essential cookies. You may withdraw consent at any time.
- Legal obligation (Art. 6(1)(c)) — where accounting, tax or customs law requires us to keep records of a transaction.
Who we share data with
We do not sell personal data and we do not share it for advertising. We share it only with:
- Our fabrication and delivery network — certified fabricators, coating applicators, galvanizers and hauliers in Lithuania and Poland, where they need project information to price or perform a scope.
- Our hosting provider — which stores the website and its logs.
- Google — where you have consented to analytics.
- Our accountants and professional advisers — where a transaction requires it.
- Public authorities — where the law requires disclosure.
Transfers outside the EEA
Our business runs inside the EU. The exception is Google Analytics, where data may be processed in the United States. Google relies on the EU–US Data Privacy Framework and on Standard Contractual Clauses approved by the European Commission. If you decline analytics cookies, no such transfer takes place.
How long we keep it
- Enquiries that do not lead to a quotation — up to 12 months, then deleted.
- Quotations and project correspondence — for the duration of the commercial relationship and up to 5 years afterwards, so that we can deal with questions or claims about work we delivered.
- Accounting records — for the period Lithuanian law requires, currently 10 years.
- Cookie consent records — up to 12 months.
- Server logs — as retained by our hosting provider, typically a short period.
Your rights
Under the GDPR you can ask us to:
- confirm what personal data we hold about you, and give you a copy;
- correct anything inaccurate;
- delete your data, where we have no overriding reason to keep it;
- restrict how we use it, or object to our use of it where we rely on legitimate interests;
- provide your data in a portable format, where we rely on consent or contract;
- withdraw consent to cookies at any time, without affecting what was lawful before.
Write to jokubas@kreadogroup.com. We answer within one month. There is no charge unless a request is clearly excessive.
Complaints
If you think we have handled your data badly, tell us first — we would rather fix it. You also have the right to complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, https://vdai.lrv.lt. If you are in another EU country, you may complain to your own supervisory authority instead.
Changes to this policy
If we change how we handle personal data, we will update this page and change the date at the top.