Privacy Policy

1. Data controller

This website presents Luknė Pleskačiauskaitė's personal brand.

Luknė is currently a minor. This website, its domain, and any collaboration inquiries are therefore administered on her behalf by her father and legal representative, Andrius Pleskačiauskas. Administration and ownership of the site may later be transferred to Luknė herself once she reaches legal adulthood.

Data controller: Andrius Pleskačiauskas.

Contact email for all privacy-related matters: hello@bylukne.com.

No physical/postal address is published here. If you require a correspondence address for legal purposes, you may request one at the email above.

2. What the contact form collects

When you submit the contact form, we collect:

• Name
• Organization (optional)
• Email address
• Inquiry type
• The content of your message
• A pseudonymous, hashed IP address token — used solely to keep the form secure (see Section 6). Your actual IP address is never stored.

No other personal data is collected from you. This site does not use analytics or marketing cookies (see Section 10).

3. Purposes of processing

• Responding to your enquiry about collaborations, photoshoots, events, or press/media
• Keeping the contact form secure and protected from spam and abuse

4. Legal basis

The data you submit through the contact form is processed on the basis of the controller's legitimate interest (GDPR Art. 6(1)(f)) in receiving and responding to enquiries sent to this site.

Where your enquiry concerns a possible collaboration, the data may, where applicable, also be processed as steps taken at your request, as the data subject, prior to entering into a contract (GDPR Art. 6(1)(b)).

The pseudonymous IP address token used for form security is processed on the basis of the controller's legitimate interest (GDPR Art. 6(1)(f)) in protecting the site against spam and abuse.

5. Retention period

Emails received through the contact form are kept for as long as needed to review and respond to your enquiry, and no longer than 12 months from the last correspondence, unless a longer period is required for legal or contractual reasons.

The pseudonymous IP address token used for form security (see Section 10) is used for active rate limiting for no longer than 1 hour from submission. Expired entries are removed during the next contact-form submission. Your actual IP address is never written to disk.

6. Recipients and processors

This site is hosted with Hostinger. Your message is forwarded by email through Hostinger's email (SMTP) service directly to hello@bylukne.com.

Your data is not sold or shared with third parties for marketing purposes.

No other additional processors or service providers are currently used. If any are introduced in the future (for example analytics or marketing tools), this Privacy Policy will be updated accordingly.

7. Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• access the data held about you;
• request correction of inaccurate data;
• request erasure of your data ("right to be forgotten");
• restrict processing;
• object to processing based on legitimate interest;
• data portability, where technically feasible.

You can exercise these rights by contacting hello@bylukne.com.

8. Contact regarding privacy

If you have any questions about how your data is handled, please write to hello@bylukne.com.

9. Supervisory authority

If you believe your personal data is being processed in breach of GDPR, you have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI): L. Sapiegos g. 17, 10312 Vilnius, Lithuania, vdai.lrv.lt.

10. Strictly necessary cookies

This site does not use analytics, tracking, or marketing cookies.

One strictly necessary cookie is used — csrf_token — solely to protect the contact form against forgery (CSRF) attacks. It is only created when the contact form is opened, expires quickly, and is never used to track or profile you. Under e-privacy rules, this kind of strictly necessary cookie does not require separate consent.

In addition to this cookie, the form security check generates a pseudonymous, irreversible token from your IP address (a cryptographic digest using a secret key — HMAC-SHA256), used only to limit excessive use of the form (spam prevention). The token remains active for no longer than 1 hour, and expired entries are removed during the next contact-form submission. Your actual IP address is never written to disk or stored — only this token, from which the IP address cannot be recovered.