Skenuok.lt

GDPR overview

Implementation is detailed, but the site never claims compliance in so many words. A privacy policy and a cookie policy, both published in Lithuanian and English and in force since 11 June 2026, cite the regulation article by article: 6(1)(a) consent, 6(1)(b) contract, 6(1)(c) legal obligation, 6(1)(f) legitimate interest. Transfers outside the EEA are covered by the European Commission's Standard Contractual Clauses or equivalent safeguards. Consent is collected through a per-category banner offering Accept All, Necessary Only and Customize, and can be withdrawn at any time through a persistent "Cookies" control. Processors are named individually. The Lithuanian supervisory authority, Valstybinė duomenų apsaugos inspekcija (VDAI), is identified as the point of complaint, and no Article 27 representative is designated, which is consistent with a publisher established inside the EU. No data processing agreement is offered, and no legal entity is named as controller.

Who owns the data?

The site publishes no terms of service, so no contract states who owns what a member uploads or produces. The privacy policy establishes only this: the account created on app.skenuok.lt holds a nickname and an email address, and the publisher never receives or stores card details, LaunchPass and Stripe handling payment and passing back nothing but membership status. The controller is named as "skenuok.lt", a domain rather than a legal entity. Members hold the full set of GDPR rights — access, rectification, erasure, restriction, portability, objection and withdrawal of consent — with Lithuania's Valstybinė duomenų apsaugos inspekcija (VDAI) named as supervisory authority.

Reuse rights

Because the site publishes no terms of service, nothing tells a member what they may do with the course material, the scanner's output or the certificate they earn: no reuse licence is granted, and none is refused either. On the publisher's side the purposes are stated article by article. Performing the contract covers the service itself (Art. 6(1)(b)), consent covers analytics and marketing (Art. 6(1)(a)), legitimate interest covers security (Art. 6(1)(f)) and legal obligation covers accounting (Art. 6(1)(c)). Google Analytics 4 measures usage, while Google Ads, the Meta Pixel and the TikTok Pixel measure advertising, and none of them run before consent is given: Google Consent Mode v2 keeps analytics and marketing tags in the "denied" state by default. Two first-party cookies, _skenuok_first_touch (90 days) and _skenuok_last_touch, record where a visitor came from. Nothing in either the Lithuanian or the English documents says whether customer data is used to train models, in any direction.

Data retention & training

Hosting summary

The site says very little about where data lives. Hostinger is named as the hosting provider of the website itself, without a country; no country and no region is declared for the hosting of user data, and none can be inferred from the published documents. The privacy policy does state that where data is transferred outside the EEA, the European Commission's Standard Contractual Clauses or equivalent safeguards apply — a transfer clause, not a hosting declaration, and it should not be read as one. What the policy does name individually is the processors involved: Google (Tag Manager, Analytics 4 and Ads), Meta Platforms, TikTok, LaunchPass, Stripe, Discord and Hostinger. That level of naming is above average and makes the jurisdictions in play partly deducible, but the publisher never states a hosting location of its own. Anyone with a jurisdictional requirement, such as an internal policy demanding EU-only storage, would have to ask directly: the published material does not answer the question.