Privacy policy

The data controller is Dėmė, MB (company code 305718484, VAT code LT100015002918, registered office Balandžių g. 1, LT-45433 Kaunas, Lithuania), which runs the art therapy studio “Procesas”, S. Konarskio g. 35A, Vilnius. The studio's art therapist is Saulutė Monika Brazauskė. Contact: monika@procesas.studio.

When you book online, fill in the question form or write to me by email, I receive:

• – your name;
• – your email address;
• – booking details: the consultation or group you chose, its time, and when you booked or cancelled;
• – your consent record: when and what you confirmed, which agreement version, and which boxes you ticked;
• – the content of your message or note;
• – when you book: the parameters of the ad or tagged link you came from (utm tags, the link's “ref” label, the Facebook click id) and the version of the ad landing page you saw, and in any case the first page you opened, the referring site, your browser type (User-Agent) and a pseudonymous visit identifier. I do not store your IP address with the booking. If your browser sends “Do Not Track” or “Global Privacy Control”, none of this is stored with the booking.

This website uses no cookies. To understand how the site is used, it runs cookieless PostHog analytics: it records page views and a few clicks (language switch, email, Instagram and directions links, opening process details), the steps of a booking (for example that a date was picked or the form was sent — never your name, email or anything you typed), reports of errors on the site, page speed measurements and taps that did nothing, and records how you move around the page (scrolling, clicks, mouse movement) so I can see where the site is awkward to use. Anything you type or choose in the form is never part of these recordings — it is masked in your browser before anything is sent. Analytics stores nothing in your browser and does not recognise you on a later visit (for the booking form's bot check, see “Cookies”). If your browser sends “Do Not Track” or “Global Privacy Control”, analytics is off. So that I can count which pages and campaigns lead to bookings, the same pseudonymous visit identifier is added to the booking's records in analytics, but your earlier browsing is not merged into one profile with your name or email. Technical data (such as IP address and browser type) may be processed briefly for security and approximate location. To show test variants of the page (for example price or layout experiments) consistently, each request is given a pseudonymous identifier derived from technical data, valid for 24 hours; it is not stored in your browser and rotates daily. The variant of the ad landing page (“Open studio”) is picked from the same technical data, but for up to 28 days instead of one, so you see the same page when you come back; nothing is stored. Which page variant you were shown is only recorded in analytics and, if you book, with the booking (see above).

• – To answer your enquiry and register you for a process — steps taken at your request before entering into a contract, and performing it (GDPR Art. 6(1)(b)).
• – Before your first process I will send you a personal link to read and confirm the agreements; this is needed once, and I will ask you to confirm again whenever I change them — performance of the contract (GDPR Art. 6(1)(b)).
• – To process health information, if you share it before or during processes, so that I can work safely — your explicit consent (GDPR Art. 9(2)(a)), which you can withdraw at any time.
• – To keep a record of your consent, so I can show what you agreed to and when — performance of the contract (GDPR Art. 6(1)(b)).
• – To send emails about your booking — confirmation, reminder, notice of a change or cancellation — performance of the contract (GDPR Art. 6(1)(b)).
• – To stay in touch and let you know about the studio opening or session times, when you have asked for it — legitimate interest in keeping in contact with you (GDPR Art. 6(1)(f)).
• – To understand how the website is used and where the people who book come from, and to improve it, including testing different versions of the page — legitimate interest (GDPR Art. 6(1)(f)); analytics runs without cookies and does not recognise you.
• – To protect the booking form from automated abuse (bots holding places or sending emails to other people's addresses) — legitimate interest (GDPR Art. 6(1)(f)).
• – To measure and improve ads: if you booked after coming from a Meta (Facebook / Instagram) ad, I report the booking to Meta — legitimate interest (GDPR Art. 6(1)(f)). You can object by emailing me; there is no box to tick.

Providing your data is not mandatory, but without it I cannot reply. No automated decision-making or profiling takes place.

Please do not write detailed information about your health in the booking or question form, or in booking notes — we can talk about it calmly when we meet. If you do share something, I will use it only to reply to you, based on your explicit consent (GDPR Art. 9(2)(a)), which you can withdraw at any time.

What you share during sessions is confidential and kept in line with the professional ethics of art therapy.

I do not sell your data or pass it to third parties for marketing. It is handled only by the service providers the website and email depend on:

• – website hosting and the booking database — Cloudflare, Inc.; its Turnstile check on the booking form tells people from bots using technical data (IP address, browser type) and does not see what you type. Cloudflare also uses these technical signals, as its own controller, to improve its bot detection (see the Cloudflare Turnstile Privacy Addendum, https://www.cloudflare.com/turnstile-privacy-policy/);
• – website analytics, the question form and booking emails — PostHog, Inc. (EU cloud, data stored in the European Union; your booking and message are linked to your email address so I can reply and send the confirmation);
• – email and calendar — Apple Distribution International Ltd. (iCloud Mail and iCloud Calendar; the booking time, your name and contact details are written to my work calendar);
• – only if you came from a Meta ad and booked — Meta Platforms Ireland Ltd. (ad measurement and optimisation; see below).

Where data is transferred outside the European Economic Area, this is done with the safeguards the GDPR provides for — EU standard contractual clauses or the EU–US Data Privacy Framework.

If you came to the website by clicking a Meta (Facebook or Instagram) ad and then booked, I report the booking to Meta Platforms Ireland Ltd. so I can tell whether the ad works and improve it. I send only this:

• – your email address, hashed with SHA-256 (the address itself is not sent);
• – the ad click id (fbclid / fbc);
• – your browser type (User-Agent);
• – the booking time and number, the price and the currency.

I do not send the name of the service or anything about what a session involves. If you did not come from a Meta ad, nothing is sent to Meta.

The legal basis is my legitimate interest in measuring and improving ads (GDPR Art. 6(1)(f)). You can object at any time by emailing monika@procesas.studio; there is no consent box. Meta may transfer the data to Meta Platforms, Inc. (USA) under the EU–US Data Privacy Framework.

So that I know which ad led to a booking, the booking page keeps the ad parameters of that visit (utm tags, fbclid) with the booking for 90 days, then they are deleted.

If you enquire, book or we write to each other but never start working together, I keep the data for no longer than 12 months after our last contact. This also covers a place that was held, whose booking you did not confirm within 48 hours (or before the first process started, if that was sooner), so the hold expired.

Once we start working together, I keep contact details, my short notes and health information, if you share it, for 3 years after your last process, and invoices for 10 years, as the law requires.

I keep your consent record — when and what you confirmed, which agreement version and which boxes you ticked — for as long as the data it covers, so I can show what you agreed to and when.

The ad and link parameters stored with a booking (utm tags, the “ref” label, fbclid, the page variant, first page, referring site, browser type and visit identifier) I keep for 90 days, then delete. In analytics they stay on the booking's records (confirmation, agreement, cancellation and move): the utm tags, the “ref” label, the page variant, first page, referring site and visit identifier, and on the booking confirmation also the click id and browser type. Your record in analytics notes which campaign or link first brought you. These records are kept as long as the rest of the booking data (see above).

At any time you can:

• – find out what data I hold about you and get a copy;
• – ask me to correct inaccurate data;
• – ask me to delete your data;
• – ask me to restrict its use;
• – object to processing based on legitimate interest;
• – receive your data in a portable format;
• – withdraw any consent you have given.

Write to monika@procesas.studio — I will reply within one month.

If you believe your data is being handled improperly, you can contact the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, 10312 Vilnius), ada@ada.lt, +370 5 279 1445, vdai.lrv.lt. But please write to me first — I will do my best to put it right.

This website uses no cookies, and its analytics stores nothing in your browser — it lives only in memory while the page is open. The identifier used for variant testing is generated server-side on each visit and is not stored in your browser. The one exception is the booking page: Cloudflare Turnstile, the form's bot check, keeps one technical entry in its own frame (challenges.cloudflare.com), strictly necessary to protect the booking form. It is not linked to your booking and is not used for analytics or ads, so no consent banner is needed.

If the way data is handled changes, the updated policy will be published on this page.