Privacy policy

Your data is controlled by UAB "SPA mažyliams lt", company code 307135174, registered office Įmonių g. 5D-3, LT-35101 Panevėžys, Lithuania. Our services are provided at Stoties g. 10, 35138 Panevėžys. For any data question, write to admin@spamazyliams.lt.

• The parent's name, email address and phone number.
• The baby's first name, date of birth and weight.
• Booking history: visit times, session, physiotherapist and reschedules.
• Payment details: amount, method and status. We never see full card details; Stripe handles them.
• Invoice details, and if you ask for a company invoice, the company name, code and address.
• Package and gift voucher details: code, visits left and expiry.
• If you join the waiting list: your name, email and phone, the baby's first name and date of birth, the session, the therapist and the times that suit you.
• If you fill in the optional "Let's get to know your little one" section: your observations about the baby's development and movement, whether the baby has seen a physiotherapist before, and your comment.

• Booking, visits, your account, packages and vouchers, and emails about your visits (confirmations, reminders): performance of a contract (GDPR Art. 6(1)(b)).
• We need the baby's date of birth to check age and choose a bath or the pool, and the weight to adapt the session to the baby. This is performance of a contract.
• We use the answers about the baby's development only so the physiotherapist can prepare for the visit. This is health-related data, so we process it only with your explicit consent (GDPR Art. 9(2)(a)), which you give by choosing to fill in the section. Only management and the physiotherapist of your visit can see it. You can withdraw consent at any time by writing to admin@spamazyliams.lt, and we will delete the answers.
• Invoices and accounting: legal obligation (GDPR Art. 6(1)(c)).
• Keeping the system secure and preventing misuse, for example records of voucher code checks: legitimate interest (GDPR Art. 6(1)(f)).
• News, only if you agree (GDPR Art. 6(1)(a)). You can withdraw your consent at any time.

These service providers process data on our behalf:

• Supabase: database and sign-in, servers in the European Union.
• Vercel: website hosting.
• Stripe: card, Apple Pay and Google Pay payments.
• Resend: sending emails.

If data is transferred outside the European Economic Area, the European Commission's standard contractual clauses or other GDPR safeguards apply. We never sell data.

• Account, baby and booking data: 3 years after the last visit, unless you delete your account sooner.
• Answers about the baby's development: together with the booking data. If a booking is not confirmed, we delete the answers within a day.
• Invoices and payment records: as long as accounting law requires.
• Data for news: until you withdraw your consent.
• A waiting list entry: until the last day that suits you has passed, and no longer than 3 months.

You can ask to access, correct or delete your data, restrict its processing, move it, or object to its processing. Write to admin@spamazyliams.lt and we will reply within one month.

If you think your data is handled wrongly, you can complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).

We use only the cookies needed for signing in and booking. If we start using analytics cookies, we will ask for your consent first.