Privacy policy.

We try to collect as little as possible. The minimum needed to plan a trip, run it safely, and keep our books straight.

Booking & itinerary

Name, address, email, phone, date of birth (for ferries and a few border-controlled sites), passport details where the law requires it, dietary requirements, accessibility needs you choose to share.

Payment

We do not store full card numbers. Card payments are processed by [Payment processor TBC]; we receive only the last four digits and a transaction reference.

Correspondence

Emails you send us and our replies, kept while a trip is being planned and for seven years afterwards for accounting reasons.

Web visits

Standard server logs (IP address, browser, page, time) kept for 14 days for security. We do not run analytics, advertising pixels, or social-network trackers.

Cookies

One first-party cookie storing your language preference. See the Cookie Policy.

Each piece of data is processed for a specific purpose. The lawful basis under GDPR Article 6 is in brackets.

• To plan, confirm and run your trip — including passing names to hotels, transport partners and guides (contract performance, Art. 6(1)(b)).
• To collect deposits, balance payments and issue invoices (contract; legal obligation under accounting law, Art. 6(1)(b) and (c)).
• To meet tax, accounting and tour-operator licensing rules in Lithuania (legal obligation, Art. 6(1)(c)).
• To respond to enquiries you send us (legitimate interest in answering you, Art. 6(1)(f)).
• To send the seasonal Field Notes newsletter, only if you actively subscribe (consent, Art. 6(1)(a)).
• To investigate suspected fraud, abuse or misuse of the website (legitimate interest, Art. 6(1)(f)).

We do not sell or rent your personal information. We share it only with parties who need it to deliver the trip you have booked.

• Hotels, ferry operators, restaurants and museums where the booking is in your name.
• Independent guides we work with — small Baltic operators, named on your itinerary, all bound by written confidentiality.
• [Payment processor TBC] for card processing.
• Sendgrid (Twilio Inc., Ireland) for transactional and newsletter emails.
• Our accountant, our auditor, and the Lithuanian tax authority — only the records the law requires.
• Public authorities when a court order or written legal request compels us.

Quote requests that don't book

12 months, then deleted.

Booking files

Seven years after the end of the trip — Lithuanian accounting and tax law.

Newsletter list

Until you unsubscribe (one-click in every issue).

Server logs

14 days.

Recorded calls

We do not record calls.

Under GDPR you can:

• Ask for a copy of the personal data we hold about you (right of access, Art. 15).
• Ask us to correct anything that is wrong (rectification, Art. 16).
• Ask us to delete it where we no longer need it (erasure, Art. 17).
• Ask us to limit how we use it while a complaint is being looked at (restriction, Art. 18).
• Ask for your data in a portable format to take to another provider (portability, Art. 20).
• Object to processing based on our legitimate interest (objection, Art. 21).
• Withdraw newsletter consent at any time, with no effect on past sends (Art. 7(3)).
• Lodge a complaint with the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) at vdai.lrv.lt.

Write to privacy@openbaltics.com. We respond within 30 days; usually faster.

Booking files live in an encrypted database hosted in the European Union. Access is limited to staff who need it for your trip. All staff laptops are full-disk encrypted. We use multi-factor authentication on every business system. We have a written incident response plan and will notify the regulator and affected travellers within 72 hours of becoming aware of a personal data breach, in accordance with Article 33.

We do not knowingly collect personal data from children under 16 except where a parent or guardian books a trip on their behalf, in which case we collect the minimum needed for hotel registration, ferry tickets and accident insurance.

We update this page when we change something material — a new sub-processor, a different retention period, a new legal basis. The last-updated date at the top changes. We do not email travellers about wording tweaks.