Last updated: 5 November 2026

Privacy Policy

Welcome to https://bafi.lt/, the website and learning platform of the Aleksandras Brokas Film Institute (BAFI) for film, video and photo creators (the Website). The Website is run by OMNIA MEDIA, UAB. This policy explains which personal data we process, why and on what legal basis, who we share it with, how long we keep it and what rights you have. The Lithuanian version of this policy prevails.

1. Who processes your data

1.1. The controller of personal data for the Website, accounts, lessons and related services is OMNIA MEDIA, UAB, company code 303292833, J. Savickio g. 4-7, LT-01108 Vilnius, Lithuania, phone +370 659 86 444, email aleksandras@omnia.cool (we, us, the Controller).

1.2. The author of the lessons and the mentor is Aleksandras Brokas, director of OMNIA MEDIA, UAB. He runs sessions, mentorship and project reviews on our behalf.

1.3. We have not appointed a data protection officer. Please send all data protection questions to the contacts in point 1.1.

2. What data we process, why, and on what basis

2.1. Running and securing the Website

Data: IP address, browser and device data, request times, the device identifier in the bafi_v cookie, the sign-in session cookie bafi_s.

Purpose: keep the Website running and secure, protect it from abuse (for example repeated sign-in attempts) and save what you do (progress, application, booking) before you sign in.

Basis: Article 6(1)(f) GDPR (legitimate interest in running and securing the Website) and, for a service you ask for, Article 6(1)(b). Strictly necessary cookies do not require consent.

Retention: as set out in the Cookie Policy. Server logs are kept for up to 7 days.

2.2. Account and sign-in

Data: email, full name, the experience level you choose, the consent flag and date, language, the one-time sign-in code (stored only in hashed form, valid for 10 minutes), sign-in sessions.

Purpose: create and run your account, let you sign in from different devices without a password, link your purchases and progress to the account.

Basis: Article 6(1)(b) GDPR (entering into and performing a contract).

Retention: while the account is active and for 2 years after the last sign-in. You can ask us to delete the account at any time.

2.3. Lessons and progress

Data: frames watched and marked as watched, daily goal and streak, subscription status and validity.

Purpose: provide the lessons, show your progress and unlock paid content.

Basis: Article 6(1)(b) GDPR. Some of this data (language, theme, frames watched) stays only in your browser until you sign in.

Retention: as for account data (2.2).

2.4. Purchases and payments

Data: full name, email, the service or plan bought, amount, VAT, payment date and status, Stripe payment and subscription identifiers, the student or teacher discount flag.

Purpose: take payments, activate or renew the subscription or service, issue invoices and keep accounts.

Tools: payments are processed by Stripe. Card details are entered only on Stripe's page; we never receive or store them.

Basis: Article 6(1)(b) GDPR (contract), 6(1)(c) (legal obligation to keep accounts) and 6(1)(f) (fraud prevention, handling claims).

Retention: for the term of the contract and 2 years after it ends. Accounting records are kept as long as the Lithuanian Law on Accounting requires (usually 10 years).

2.5. Private sessions, career mentorship and project reviews

Data: session time and length, format (in person or online), session topic, your answers in the mentorship questionnaire about your experience, skills and goals, your questions and our answers, your career roadmap, links to your work.

Purpose: plan and run sessions, prepare your personal career plan, answer your questions, review your project.

Tools: confirmed bookings (name, email, topic) appear in Aleksandras Brokas' Google Calendar. Online calls use a video platform (for example Google Meet) named in the invitation. We do not record calls unless agreed in writing in advance.

Basis: Article 6(1)(b) GDPR (contract and steps before entering into it).

Retention: while the service lasts and for 2 years after it ends.

2.6. Applications and enquiries

Data: full name, email, chosen service, experience level, your goal, a link to your work and anything else you send.

Purpose: reply, offer the right service, handle complaints.

Basis: Article 6(1)(b) GDPR (steps before a contract) and 6(1)(f).

Retention: until the application is handled and for 2 years after.

2.7. Student and teacher discount

Data: the discount code used, the group or institution it was issued for, discount type (student or teacher) and date of confirmation.

Purpose: grant the 50% discount based on a code issued to an educational institution.

Basis: Article 6(1)(b) and (f) GDPR.

Retention: as for purchase data (2.4).

2.8. Referral programme

Data: your referral code, who came through your link (account identifier), that person's purchase amount excluding VAT, the commission earned and its status.

Purpose: calculate and credit the 15% commission for referred members.

Basis: Article 6(1)(b) GDPR (programme terms) and 6(1)(c) (accounting).

Retention: while the programme is active and for 2 years after the last credit; accounting records as required by law.

2.9. Visit statistics

Data: date of first and last visit, number of visits per day, frames watched and locked frames opened, checkout steps, traffic source (UTM tag or referral code), language, device type (desktop or mobile), whether you are a member.

Purpose: understand which frames help and improve the lessons. We count statistics ourselves on our own server and do not use third-party analytics (Google Analytics, Meta Pixel).

Basis: your consent (Article 6(1)(a) GDPR and the Lithuanian Law on Electronic Communications). Statistics are collected only after you click "Allow statistics" in the cookie bar. You can withdraw consent at any time.

Retention: up to 2 years from the last visit.

2.10. Notifications and newsletter

Service emails: we send sign-in codes and payment, booking and service messages to your email because the service needs them (Article 6(1)(b) GDPR).

Newsletter: we send new frames and offers only if you tick the separate box in the sign-up form (Article 6(1)(a) GDPR and the Lithuanian Law on Electronic Communications). The box is not ticked in advance. You can withdraw in your account settings, through the unsubscribe link or by writing to us. We stop within 2 working days.

Retention: while consent is valid, but no longer than 2 years from your last activity.

2.11. Supplier contracts, accounting and disputes

Data: identification and contact data, financial data (payments, debts), contents of contracts and correspondence.

Purpose: enter into and perform contracts, keep accounts, defend our rights.

Basis: Article 6(1)(b), (c) and (f) GDPR.

Retention: for the term of the contract and 2 years after; accounting records as required by law; in a dispute, 2 years after it is resolved or 10 years after court proceedings end.

3. Where we get your data

From you directly (when you sign up, fill in an application or questionnaire, book a session or write to us), automatically when you use the Website (statistics only with your consent), from Stripe (payment confirmation and amount) and from the partner whose link you followed (the referral code only).

4. Who we share your data with

4.1. Processors (acting on our instructions)

We do not upload your personal data to artificial intelligence tools or pass it to their providers. Voice-over and visuals for the frames use only lesson texts, never your data.

4.2. Independent controllers

Stripe Payments Europe, Limited (Ireland) processes payments and card data under its own privacy policy and acts as an independent controller for payment and financial compliance purposes.

The partner whose link you followed sees only a summary of their own commission, not your name or email.

4.3. Authorities

We give data to public authorities only on lawful and justified requests, court decisions and as required by law.

5. Transfers outside the European Economic Area

We process data in Lithuania and other EU or EEA countries. Where a provider is outside the EEA or can access data from there, transfers follow the GDPR:

• Cloudflare, Inc. (USA) and Google LLC (USA): the European Commission adequacy decision (EU-US Data Privacy Framework) and, where applicable, standard contractual clauses.
• Stripe, Inc. (USA): the adequacy decision and standard contractual clauses, under Stripe's policy.

6. Retention periods

Periods may be extended where data is or may be used as evidence in an investigation (including by the State Data Protection Inspectorate) or in civil, administrative or criminal proceedings. When a period ends, data is securely destroyed.

7. Security

We apply technical and organisational measures under Article 32 GDPR: all traffic is encrypted (HTTPS), sign-in uses a one-time code instead of a password, codes and session keys are stored only in hashed form, access is separated (each user sees only their own data; only the administrator, Aleksandras Brokas, sees all data), sign-in attempts are rate-limited and no manual copies of data are made to personal devices. If a personal data breach is likely to put your rights at risk, we notify the State Data Protection Inspectorate within 72 hours and, where the risk is high, you as well.

8. Your rights

You have the right to:

• be informed about how your data is processed;
• access your data;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten"), including the whole account;
• restrict processing;
• receive your data in a machine-readable format and transfer it (data portability);
• object to processing, including for direct marketing and processing based on legitimate interests;
• withdraw consent at any time (this does not affect processing before withdrawal);
• not be subject to a decision based solely on automated processing;
• lodge a complaint with the State Data Protection Inspectorate (vdai.lrv.lt) or a court. Please contact us first so we can try to resolve it.

How to use your rights. Send a request by email to aleksandras@omnia.cool or by post to J. Savickio g. 4-7, LT-01108 Vilnius. Write from the email you use to sign in to BAFI so we can identify you, or we may ask for more information. We reply within 1 month of receiving the request (this can be extended by 2 more months where the law allows). A representative must provide proof of authority.

9. Automated decisions and profiling

We do not make decisions with legal or similarly significant effects based solely on automated processing. Switching on a subscription after payment is a technical step in performing the contract. We do not profile you for advertising.

10. Minors

You can create a BAFI account from the age of 14. Paid services can be bought by adults; anyone under 18 needs consent from a parent or guardian.

11. Changes and contacts

We may update this policy. The current version is always published on this page with the date of the last update. We notify registered users of material changes by email. This version was approved on 5 November 2026.

Data protection contacts: OMNIA MEDIA, UAB, company code 303292833, J. Savickio g. 4-7, LT-01108 Vilnius, phone +370 659 86 444, email aleksandras@omnia.cool.

More about cookies: Cookie Policy.