Privacy policy
This page sets out what personal data hrcentras.lt holds about you, why, who else sees it and how long it is kept.
Last updated on October 12, 2026.
Who handles your data
hrcentras.lt is provided by Gerbora, MB, a Lithuanian mažoji bendrija, which is a small partnership under Lithuanian company law. It is the data controller for the data this page describes.
| Detail | Value |
|---|---|
| Name | Gerbora, MB |
| Company registration code | 304022869 |
| Postal address | Nartavos g. 1-18, LT-47489 Kaunas, Lithuania |
| Email for data questions | mbgerbora@gmail.com |
That address takes post only. There is no office where visitors are received. There is no telephone number for data questions, and no data protection officer has been appointed. Write to the email address above about anything to do with your own data.
Your employer's records about you
hrcentras.lt is an HR management system that companies use. When a company puts its employees' data into hrcentras.lt, that company is the controller of it. Gerbora, MB handles it on the company's instructions and only so that hrcentras.lt works, which makes it the processor.
The same applies to what a company records about an employee's family members, such as a child's date of birth.
A record that a person has a disability is a special category of personal data under GDPR Article 9. As the controller, the company must have a lawful basis for everything it records, including that. The company chooses which lawful basis it relies on. It also decides which of its people get access, and it is responsible for following the law.
Gerbora, MB provides data management and hosting for this data, and commits to doing that securely.
So if you want to reach data your employer entered about you, ask your employer. We help the company when it asks us to, but the decision about an employee's data is the employer's.
Company record search runs on our own Meilisearch server. We do not send its search metadata to MeiliCloud. The search copies contain record identifiers and selected display text: names, employee numbers, candidate invitation email addresses, and account email addresses for people who are allowed to search them. They also contain entered document and template titles, signing titles, asset names and serial numbers, invoice numbers, and billing names or job titles. Text people enter in these fields may itself contain personal data.
Search copies do not contain separate fields for phone numbers, addresses, personal codes, bank accounts, dependents, disability or salary. Search results are limited to the company records this request is allowed to read. Changing, deleting or erasing a record creates a different search copy for later searches.
Old search copies become eligible for deletion after 48 hours plus a 30-second search deadline. Cleanup runs when another search is made, at most once an hour. If no search is made, an old copy can remain longer. This describes the temporary search copies, not how long the original company records are kept.
A written data processing agreement between the company and Gerbora, MB is concluded separately from this page. hrcentras.lt has no standard text for one yet. We will give it to the company before we handle its employees' data.
Everything below is about the data Gerbora, MB is the controller of: people who have an hrcentras.lt account, and people who have asked for one.
What we hold
| Group | What is in it | Where it comes from |
|---|---|---|
| Account data | First and last name, sign-in email address, contact email, contact phone, notes, up to three links, chosen language and account status. | Entered by hrcentras.lt, or by you in your own profile. |
| Requests for an account | First and last name, email address and a free-text reason for the request. | Entered by the person asking. |
| One-time sign-in codes | An email address and a code. | Created when you ask for a sign-in code. |
| Sign-in sessions | Sign-in email, browser and operating system name, IP address, country code, and the times you signed in, were last active and signed out. | Created when you sign in. |
| Sign-in rate counters | Short-lived counters keyed on an email address or an IP address. | Created when a sign-in is attempted. |
| Security and administration records | Who did what in the system, when, and from which IP address. A record of an administrator's action also holds that administrator's email address. | Created when the action happens. |
| A job candidate's own data | Name, personal code, date of birth, address, citizenship, contact details, bank account (IBAN) and the account holder's name, previous employer, and photographs of identity and qualification documents. | The candidate, on a form link their prospective employer sent them. No account and no sign-in. |
| Reminders and the daily digest | The name of a company employee and the date being reminded about: the end of a probation period or a contract, an unsigned document, a leave balance about to expire, an asset not returned. The same records make up the daily digest email. | Created inside the system from the employee data the company entered. Nobody types them in. |
| Exchanges with a company's Rivilė | Each request hrcentras.lt makes to a company's Rivilė ERP or Rivilė GAMA, and each answer, in full. Rivilė answers with everything it holds on the entry asked for, so an answer carries more than hrcentras.lt uses. About an employee that includes the name, personal code, date of birth, sex, citizenship or country, home address, email address, phone number and employment dates. It can also carry what hrcentras.lt ignores: the passport or other identity document number, the Sodra number, family status and the salary advance. Rivilė ERP adds the number of children and a personal email address. Rivilė GAMA adds length of service, the salary account code, free-text notes and a GAMA user name. A department in Rivilė GAMA comes with its code and name. It can also carry the manager's name, a phone number, a fax number and GAMA user names. What hrcentras.lt ignores stays in the record of that exchange and is copied nowhere else. | Created each time hrcentras.lt calls the company's own Rivilė. It calls only for a company whose owner or an admin entered the company's own Rivilė API key: to test the key, and to run the parts of the integration they switched on. hrcentras.lt sends Rivilė GAMA no personal data. |
| Billing data | The company's name, company code, VAT code and address, the email address invoices go to, the invoices issued and the payments made. About the card we keep only its brand, the last four digits of its number, its expiry date and the email address of the person who added it. We never receive or store the full card number or the security code. | Entered by the person who creates a company, or by the company's owner in the billing settings. The card details are typed straight into Stripe's fields. |
There is nothing else. The hrcentras.lt page you are reading collects nothing about you unless you agree to it. If you accept the cookie notice, we turn on Google Analytics and it collects visit statistics. Until you accept, nothing is requested from Google at all. The cookie policy sets all of this out.
Why we hold it, and on what basis
| What for | Which data | Legal basis |
|---|---|---|
| So that we can give you an account and you can use it. | Account data, one-time codes, sessions. | Performance of a contract, GDPR Article 6(1)(b). |
| So that we can answer a request for an account. | Requests for an account. | Steps before entering into a contract, GDPR Article 6(1)(b). |
| So that nobody else gets into your account, and so that you can see where and when it was used. | Sessions, sign-in rate counters, security records. | Legitimate interest in keeping accounts and the system safe, GDPR Article 6(1)(f). |
| So that we can issue an invoice and take payment for hrcentras.lt. | Billing data. | Performance of a contract, GDPR Article 6(1)(b). |
hrcentras.lt sends no marketing, does no profiling, and makes no decision about a person by automated means alone.
Who else receives it
| Recipient | What it receives today |
|---|---|
| Cloudflare, Inc. | Every request to an hrcentras address goes through Cloudflare. It terminates the encrypted connection, so it sees the request body, the IP address, the browser string and the address being asked for. The country code stored on a session record comes from it. |
| Hostinger | The servers and the database holding every hrcentras.lt record run on Hostinger machines. |
| GitLab Inc. | The program code and the builds of it. It receives none of your personal data. |
| Stripe Payments Europe, Limited | The payment card processor. When you create a company or add a card, Stripe receives the company's name, an internal company identifier, the email address invoices go to (when a company is created, that is your sign-in email address) and the card details you type straight into its fields, among them the number, the expiry date and the security code. When a charge is made it receives the amount and the currency. The card form runs on Stripe's code, so Stripe also sees your IP address and the browser and device details it uses to prevent fraud. Stripe receives no employee data. |
| The Gerbora data API (data-api.gerbora.lt) | When you create a company and type into the company name field, the text you typed is sent here so the company can be found in Lithuanian company directories and the form filled in. It receives that text and nothing else: not your name, not your email address and not your IP address. It is run by Gerbora, MB, the company that runs hrcentras.lt. |
| Mailjet | Every email hrcentras.lt sends goes out through Mailjet. Mailjet receives the recipient address, the subject and the full contents of each one. Those emails are one-time sign-in codes, invitations to join a company, invitations for a candidate to fill in the form, notices about data change requests, about documents to sign, about company property handed over and about invoices, and the daily digest with employee names and the dates being reminded about. Mailjet is part of the Sinch group. |
| The company employee the reminder is for | The daily digest email goes to the person the reminder is for, usually a company owner or an HR person. It lists other employees of that same company by name, with dates. One email covers one company; somebody who works at two gets two separate emails. It can be turned off: there is a link at the bottom of every one, and the same switch is on the Notifications screen. |
| Rivilė ERP (your company's own account) | Only when your company's owner or an admin connects the company's own Rivilė ERP account with its own API key and switches the timesheet send on. Then, each time one of them sends a locked month, Rivilė receives, for each employee linked to a Rivilė employment agreement, the agreement code, the dates, and for each date the timesheet code with its days and hours, absence codes such as annual leave and sick leave among them. It receives no names, no personal codes and no day notes from hrcentras. A company that has not connected Rivilė sends it nothing. |
| A backup object store | Nothing today: none is connected. |
| A monitoring collector | Nothing today: none is connected. |
Nobody else receives it. hrcentras.lt does not sell personal data and does not pass it on for advertising.
Cloudflare, Inc. is registered in the United States, so some data may be handled outside the European Economic Area. Stripe Payments Europe, Limited is registered in Ireland, but it passes some data to its group companies in the United States, so the data it receives may be handled outside the European Economic Area too. Mailjet stores data in data centers inside the European Union, but Sinch group companies and Mailjet subcontractors may be outside the European Economic Area.
The day we connect either of the two recipients that receive nothing today, we update this page in the same change, not later. That is an internal hrcentras rule.
How long we keep it
| What | How long |
|---|---|
| A one-time sign-in code | 10 minutes. The database then deletes it itself. |
| A sign-in session record and the device it is tied to | Until you sign out, or 90 days without use. Each use starts the 90 days again, and there is no fixed maximum. The database then deletes it itself. |
| Sign-in rate counters | Until the counting window is past. The database then deletes them itself. |
| A reminder and its record | 90 days. The database then deletes it itself. The app shows a reminder for exactly the same 90 days, so keeping it longer would serve nobody. |
| A record of each exchange between hrcentras.lt and a company's Rivilė | 90 days. The database then deletes it itself. It holds each request and each answer in full, with any employee data in them. An answer from Rivilė GAMA can also hold a department manager's name, a phone number and GAMA user names. |
| Account data | For as long as the account exists. |
| Security and administration records | Indefinitely. These records are deliberately never changed and never deleted, so that what happened stays legible. |
| Requests for an account | Indefinitely. |
| A candidate onboarding form and its files | No longer than 180 days. After that the files and the personal sections are deleted and only a shell remains: who was invited, when, and what the company decided. |
The “Account data”, “Security and administration records” and “Requests for an account” rows have no fixed retention period. We say so openly. When those periods are set, they go into this table.
A sign-in session is tied to the browser it was created from. We store that browser's name, its platform and its major version on the session record itself, and a session cookie that arrives from a different browser or platform is refused. It is deleted when the session record is, so it has no retention period of its own.
The records a company keeps about its employees are the company's, as set out above. A record about an employee's family member is kept for as long as that employee's record is. The company can delete it from the employee's card at any time.
Your rights
For the data Gerbora, MB is the controller of, the General Data Protection Regulation gives you the right to:
- see your data and get a copy of it;
- have data that is wrong or inaccurate corrected;
- ask for your data to be erased;
- ask for the handling of your data to be restricted;
- receive your data in a structured, commonly used, machine-readable format and move it to another controller;
- object to the handling of your data where it rests on legitimate interest.
Write to mbgerbora@gmail.com. We answer within one month of receiving the request.
hrcentras.lt has no button that downloads your data or deletes your account by itself. Every request is handled by hand. We say so because you should know what to expect.
Some data we cannot delete. We deliberately never change or delete the security and administration records, because what they hold is the account of what happened. When you ask, we answer specifically: what was deleted, what was not, and why.
If you think your data is being handled unlawfully, you can complain to the supervisory authority. In Lithuania that is the State Data Protection Inspectorate, Valstybinė duomenų apsaugos inspekcija (VDAI), L. Sapiegos g. 17, 10312 Vilnius, email ada@ada.lt, telephone +370 5 271 2804, website vdai.lrv.lt.
Children
hrcentras.lt is for companies and the work of their HR people. It is not directed at children, and we give no child an account. The onboarding form a job candidate fills in asks nothing about a child: not who the candidate supports, not a child's date of birth, and not whether a child has a registered disability. Where a company's own HR person records an employee's family on that employee's card inside hrcentras.lt, that company is the controller of it and Gerbora, MB handles it only on that company's instructions, under the written data processing agreement between them.
When something changes
If hrcentras.lt starts collecting new data or passing it to a new recipient, we update this page in the same change, not later. That is an internal hrcentras rule, and it applies here exactly as it applies to the cookie policy.