Privacy policy

Data controller and contact details

The controller of personal data described in this policy is MB The 4 group, operating under the Dev4you.lt brand. Company code: 307027686. VAT number: LT100018171410. Contact address: J. Urbšio g. 3, Panevėžys, Lithuania.

For privacy matters, email [email protected] or call +370 680 55297. You can also write to the contact address above.

This policy covers website visitors, people who contact us and representatives of our clients. We process data under the General Data Protection Regulation (GDPR), Lithuania’s Law on Legal Protection of Personal Data and applicable requirements of its Law on Electronic Communications.

Enquiry data and how we use it

We receive data from you when you complete a contact form, email us or discuss services with us. We process your name, email address and message, and, if supplied, your company name, phone number, selected service, description of your situation, deadlines or other project requirements.

Fields marked as required are needed to submit and respond to your enquiry. Optional fields can be left blank. Without the necessary contact details we cannot reply through that channel; you can always use another method listed on our contact page.

• Preparing proposals and discussing services: taking steps at your request before entering into a contract, or performing a contract to which you are a party (Article 6(1)(b) GDPR).
• Answering general questions and communicating with business representatives: our legitimate interests in handling incoming enquiries and maintaining business communications (Article 6(1)(f) GDPR).
• Meeting legal obligations: for example, processing necessary data in accounting documents when a contract is concluded and invoices are issued, under the applicable legal requirements (Article 6(1)(c) GDPR).

Please provide only the information needed to understand the task. Do not submit passwords, access tokens, payment card details or sensitive information about other people. Sending an enquiry does not constitute consent to receive advertising emails.

Website operation and assessments

Your browser and our server process technical data needed to handle requests, such as an IP address, request time, requested page address and technical information sent by the browser. Preventing abuse, identifying faults and protecting the website are based on our legitimate interest in maintaining its operation and security (Article 6(1)(f) GDPR).

Assessment answers or a public website address are sent to the server when you choose to prepare a report or start a check. This happens before you enter your email address. Preparing results is based on our legitimate interest in providing the assessment you have chosen to use (Article 6(1)(f) GDPR); these data are used only for that purpose, preparing results and preventing abuse.

Results are displayed and the PDF report is sent only after you enter an email address and confirm its use to receive the report. This separate consent (Article 6(1)(a) GDPR) does not create a marketing subscription. We use your email to send the report and a derived identifier to limit repeated deliveries and abuse. You can withdraw consent by contacting us, but we cannot recall an email already delivered to the recipient’s mailbox. See “Interactive checks and PDF reports” for more information about assessment data, recipients and temporary storage.

Assessment scores and recommendations are generated automatically from the information supplied and the assessment rules. They help you understand your situation; they do not make decisions that have legal or similarly significant effects on you. They do not determine your eligibility for a service, contract terms or price, and do not replace an individual assessment by a specialist.

Cookies and website analytics

Cookies and similar browser entries help remember choices and provide website features. Necessary entries and optional analytics are explained in our cookie policy, including their purposes and lifetimes.

We use Google Analytics 4 to understand website usage and improve usability only after you give separate consent (Article 6(1)(a) GDPR). Declining does not prevent browsing, enquiries or assessments. Reading this privacy policy does not in itself constitute consent to analytics or to all processing activities.

Analytics covers page views, defined website interactions, pseudonymous browser identifiers and technical device information. We do not include form input, contact details, assessment answers or the checked domain in our analytics events.

You can change your choice at any time using “Cookie preferences” in the footer. Withdrawing analytics consent stops new analytics transmissions and removes this website’s analytics cookies. It does not affect the lawfulness of processing before withdrawal. Deleting cookies does not itself erase data already sent to the provider’s systems.

Who may receive your data

Relevant members of our team handle enquiries. Data is shared with recipients or categories of recipients needed for the particular purpose:

• Website hosting, email and technical maintenance providers: to operate the website, process enquiries and deliver emails. PDF reports are sent through Hostinger’s email service, which processes the recipient address, email and PDF attachment containing the summary of your answers or check results.
• The Google Analytics service provider: website usage data, if you have chosen analytics.
• Assessment data providers: Cloudflare DNS for public domain records, and Google PageSpeed Insights when the corresponding speed measurement is enabled and available. We do not send questionnaire answers or the report recipient’s email address to these providers.
• Courts, law enforcement and other competent authorities: where disclosure is required by law. Data necessary to establish, exercise or defend legal claims may also be shared with legal advisers.
• The Google reCAPTCHA service provider: form security check data when you start filling in a form or activate the check within it. Google acts as a processor of these data.

Technical providers may act as processors; authorities or particular service providers may act as independent controllers according to their role. Contact us for information about recipients connected with your enquiry.

Processing outside the EEA

Some data may be processed outside the European Economic Area (EEA) when international providers are used. This may apply to analytics, form protection and public website measurement services. A website intended for Lithuanian visitors does not necessarily use services operating only in Lithuania.

A transfer outside the EEA requires an applicable basis under Chapter V GDPR: a European Commission adequacy decision or appropriate safeguards, such as standard contractual clauses and supplementary measures where necessary. Article 49 derogations concern specific exceptional situations and are not a general substitute for safeguards for ongoing transfers.

You can request information about particular recipients, processing countries and safeguards applicable to a transfer, including a copy of those safeguards, at [email protected]. Provider terms and the technical processing chain depend on the service used.

How long data is retained

Different purposes do not share a single retention period. We determine retention according to the purpose, necessity, contractual relationship and applicable legal obligations.

• Enquiries and correspondence: ordinary enquiries that do not lead to a contract are retained for 24 months from the last communication. After that period, data is deleted or anonymised unless specific information remains necessary for a legal obligation or to establish, exercise or defend legal claims. Information relating to a concluded contract is subject to the contract and document retention criteria below.
• Temporary assessment reports: available on the server for one hour after preparation. Expired temporary entries are cleaned automatically. This is not the retention period for a delivered email or a copy in a mailbox.
• Abuse-prevention entries: temporary request counters and derived identifiers expire according to the time window of the particular protection. They are used to limit request rates.
• Analytics cookies and the preference record: expire after up to 180 days. Browser-entry lifetimes differ from retention of data already collected in the analytics provider’s systems.
• Contracts, accounting and dispute documents: for the statutory periods applicable to the document and as necessary to establish, exercise or defend specific legal claims.

If data is required for an ongoing investigation or dispute, only information necessary for that purpose is kept while a basis for retaining it remains. Contact us about the period or criteria applying to your particular data.

Protecting your data

Data protection depends on technical measures and their appropriate use. The website uses HTTPS, validates form input and limits assessment request rates. PDF reports are attached to emails rather than published in a public download directory.

We ask you to include only necessary information in enquiries. If a service requires confidential files or access credentials, an appropriate transfer method is agreed separately. Assessment and contact forms are not intended for passwords or other login secrets.

Your rights

Subject to the conditions set out in the GDPR, you can exercise the following rights:

• Access: find out whether we process your data, receive information about processing and obtain a copy of your personal data.
• Rectification: ask for inaccurate data to be corrected or incomplete information to be completed.
• Erasure: where there is no longer a basis for processing or another statutory condition applies. This right may be limited where data is needed for a legal obligation or legal claims.
• Restriction: for example, while accuracy is being checked or a valid objection considered.
• Objection: on grounds relating to your particular situation where we rely on legitimate interests. We will stop processing unless there are compelling overriding legitimate grounds or the data is needed for legal claims.
• Portability: receive data you supplied in a structured, commonly used and machine-readable format where automated processing is based on consent or a contract; where technically feasible, have it transmitted to another controller.
• Withdrawal of consent: at any time for future activities relying on consent. Processing lawfully carried out before withdrawal remains lawful.

If a solely automated decision with legal or similarly significant effects were used, the safeguards in Article 22 GDPR would also apply. The assessment recommendations on this website do not themselves produce such effects.

Making a request or complaint

Email [email protected] explaining which right you want to exercise and which enquiry or report your request concerns. Where possible, use the same email address you used to contact us. You can withdraw analytics consent immediately through “Cookie preferences” in the footer.

We do not require an identity document copy by default. Only if there are reasonable doubts about identity will we request additional information necessary to confirm it, using a proportionate method. A representative may need to demonstrate their authority to act for you.

We will inform you of action taken without undue delay and within one month of receipt. This period may be extended by up to two further months because of the complexity or number of requests; we will explain the extension and its reasons within the first month. If we do not act on a request, we will explain why and how you can challenge the decision.

Requests are normally handled free of charge. The exceptions provided by the GDPR may apply to manifestly unfounded or excessive requests.

If you believe your rights have been infringed, you can complain to Lithuania’s State Data Protection Inspectorate or another competent EEA supervisory authority and seek a judicial remedy. The procedure set by the relevant supervisory authority applies to complaints.

External links and policy updates

This website links to clients, service providers and our social media pages. When you follow a link to LinkedIn, Facebook or another external website, its operator also processes data under its own rules. Please read the privacy information provided by that service.

We update this policy when website features, processing arrangements or applicable requirements change. Where a change requires fresh consent or additional information, updating this text alone does not replace that obligation.

Updated on 19 October 2026. For questions about this policy or your data, contact [email protected].

Protecting forms against automated submissions

We use Google reCAPTCHA to protect contact forms and PDF report requests against automated submissions. It loads when you start filling in the form or activate the check within it; opening a page or form window alone does not load its code. Loading the check does not enable Google Analytics or change your analytics preferences.

Once protection is enabled, your browser connects directly to Google. The provider processes your IP address, browser and device information, and signals from your interaction with the check; it may set the _GRECAPTCHA cookie to assess risk. Our server sends the check’s response token to Google. We do not include the form message, name, email address or questionnaire answers in that server verification request.

The purpose is to prevent spam and abuse of website forms. Google acts as a processor of these data under the Google Cloud data-processing terms. This is a separate security service, not website usage analytics. If verification fails, the form is not sent; you can retry or contact us directly at [email protected].

Interactive checks and PDF reports

When you submit a check, we process your questionnaire answers or the public website address to prepare the requested results. Results are stored temporarily on our server for PDF preparation; reports are available for one hour after preparation. A short summary is shown only after you enter an email address and agree to its use for the report; the detailed report is sent as a PDF attachment. Expired temporary records are cleaned automatically.

Your email address is used to send the requested PDF and administer your request. We retain your email, the check source, consent timestamp and delivery status for up to 12 months from the latest request; detailed reports still expire after one hour. You can request deletion at [email protected]. This does not create a marketing subscription. The report is attached to the email and is not published as a publicly accessible file. Technical request-rate records are kept temporarily to limit abuse.

Public domain records are requested from Cloudflare DNS. When a browser speed measurement is available, the public website URL is sent to Google PageSpeed Insights. Questionnaire answers and your email address are not sent to these measurement providers. Checks start only when you submit the form.

Do not enter passwords, access tokens, private system addresses or confidential information. For questions about these data, contact [email protected].

Enquiry contacts and PHP security checks

When you submit an enquiry or request a report, we retain your email, your name and phone number if provided, request source, language, submission time and delivery status to administer the request and discuss its results. Where a one-time code is used, we also record whether the email was verified. Contact records are accessible only to authorized website administrators and are retained for up to 12 months from your latest request. Older history is deleted automatically; technical storage limits may shorten retention. This does not create a marketing subscription.

The PHP2Shell tool requires an email confirmation code before checking a website. It makes ordinary public HTTP requests, validates the public destination, and compares observed PHP version information with the official security releases. It does not send exploit or memory-exhaustion payloads. A hidden version, a failed request or a fixed version banner does not establish overall website security. The detailed PDF is emailed as an attachment; no public report download is created.

Private PHP check sessions, email confirmation records and report data expire after 24 hours and are cleaned automatically. Email codes expire after 15 minutes. Contact administration records have the separate 12-month retention period described above. An optional diagnostic file can read a limited list of PHP runtime settings on a website you control; it expires with the assessment and should be removed after use. Submitted email addresses are not sent to the checked website or public DNS resolver.

For access, correction or deletion of your contact record, email [email protected]. Anti-spam verification uses the existing reCAPTCHA protection described in this policy. Do not submit passwords, tokens or private system addresses.