IPRATE Privacy Policy

For the purposes of the GDPR, the data controller for IPRATE is:
Socialiniai algoritmai, UAB
Company code: 304068578
VAT code: LT100019931317
Email: [email protected]

IPRATE uses infrastructure and security providers. Depending on the specific service and processing activity, such providers may act as our processors (processing on our behalf) or as independent data controllers for limited purposes (for example, network security and abuse prevention). The only third parties that may act as independent data controllers in connection with the Services are hosting and website security service providers (e.g., Cloudflare and others). Where they act as independent controllers, their own privacy notices apply to that processing.

2.1 Data processed when you visit the website (technical and security data)

We do not collect visitor data beyond what is necessary for website functionality, performance, and security. When you access the Services, we and our hosting/security providers may process limited technical data such as:

• IP address (and approximate location derived from it).
• Device and browser information (user agent).
• Request metadata (time, requested URL, referrer, status codes).
• Security-related identifiers used to detect bots, abuse, and attacks.

2.2 Cookies and similar technologies

We use only strictly necessary (mandatory) cookies and similar technologies required for basic website operation and security. We do not use optional analytics, advertising cookies, or cross-site tracking cookies.

Note: Cookie names and retention periods may vary depending on the security measures in place. If you block mandatory cookies, some parts of the Services may not function correctly.

2.3 Email address and communications

If you voluntarily provide your email address (for example, by registering user account, contacting us, subscribing to updates, or requesting access to materials), we may process your email address and any information you include in your message (such as your name, organization, and the content of your inquiry).

We may use your email for legitimate purposes, including: responding to inquiries; providing service-related communications; and informing you about IPRATE products and services, news, and updates. Where applicable laws require consent for marketing messages, we will obtain consent or provide a legally required opt-in mechanism. You can opt out at any time.

2.4 Public data used in IPRATE ratings and data

IPRATE primarily processes firm data and does not aim to process any individual personal data. IPRATE may process personal data that is a small part of official intellectual property records in order to create, maintain, and publish ratings, scores, and related data. This may include, depending on the context, names, roles, professional activities, affiliations, public filings, public applications, public registrations, public legal event data, communication with public offices, and other information made available to the public through public registers, official publications, organizational websites, reputable media, or other open sources.

2.5 Free public MCP service

The free public MCP endpoint does not require an account or API key. To operate and protect it, we and our infrastructure providers may process the technical and security data described in section 2.1, together with MCP protocol metadata such as the tool requested, response status, latency, and client software information.

We do not retain raw prompts or free-text tool arguments, including client-name search text, in product analytics. Requests remain subject to short-lived infrastructure and security processing needed to deliver the response, enforce rate limits, investigate abuse, and maintain the service.

We obtain personal data from:

• You directly (e.g., when you email us).
• Publicly available sources (e.g., official registers, government sources, court decisions when public, public corporate disclosures).
• Open web sources (e.g., organizational websites and publications).
• Reputable media publications and open data sources.

We process personal data only to the extent necessary for the purposes described below. Our main lawful bases are Legitimate Interests (GDPR Article 6(1)(f)) and Public Interest (GDPR Article 6(1)(e)).

4.1 Website operation, functionality, and security

Purpose: deliver the website, ensure stability, prevent fraud and abuse, and maintain security.
Legal basis: Legitimate Interests (GDPR Article 6(1)(f)).

4.2 Producing and publishing IPRATE ratings and related data

Purpose: process publicly available information to create and present ratings and data that inform the general public.
Legal bases: Legitimate Interests (GDPR Article 6(1)(f)) and Public Interest (GDPR Article 6(1)(e)).
We also process data according to the GDPR Article 85 (freedom of expression and information) as applicable.

4.3 Communications and updates

Purpose: respond to you and provide information about IPRATE products, services, news, and updates.
Legal basis: Legitimate Interests (GDPR Article 6(1)(f)), and where required by applicable law, consent or another appropriate legal basis.

4.4 Legal compliance and protection of rights

Purpose: comply with legal obligations and protect our rights (e.g., handling complaints, enforcing terms, responding to lawful requests).
Legal basis: Legitimate Interests (GDPR Article 6(1)(f)) and, where applicable, compliance with a legal obligation (GDPR Article 6(1)(c)).

4.5 Firm and company checks, and reports requested by email

Purpose: build and deliver the report you request from the firm check or the counsel lookup, and, only if you tick the optional box, send you two follow-up messages about it.
Data: the email address you enter, an optional name, the subject you asked about, the locale of the page, a hashed form of your IP address and your browser user agent (for rate limiting and abuse prevention), and the referral or campaign parameters that were on the URL you arrived with.
Legal bases: performance of a service you asked for (GDPR Article 6(1)(b)) for the report itself; Consent (GDPR Article 6(1)(a)) for the follow-up messages, which you may withdraw at any time through the unsubscribe link in each of them; Legitimate Interests (GDPR Article 6(1)(f)) for rate limiting and abuse prevention.
Retention: 24 months from the request, after which the email address, the name, the hashed IP address and the user agent are erased and the record is kept only as a count.

4.6 Orders placed without an account

Purpose: issue a proforma invoice, take payment, deliver the report and issue the VAT invoice for a fixed-price report bought without registering.
Data: the email address and billing details you enter, including a VAT number where you give one, and the order and payment records that follow.
Legal bases: performance of a contract (GDPR Article 6(1)(b)) and compliance with a legal obligation (GDPR Article 6(1)(c)) for the accounting records.
Retention: accounting records are kept for 10 years as Lithuanian law requires. A guest account created for the order becomes an ordinary account if you later sign in with the same address.

4.7 Partner programme

Purpose: assess a partner application, operate the partner relationship, attribute introductions and calculate and pay commission.
Data: the applicant's company details, contact name and email, the entities the partner registers as leads (which are public-register entities), the contact domain of a registered company lead, and the commission, statement and payout records.
Legal bases: steps taken at your request before entering a contract and performance of that contract (GDPR Article 6(1)(b)); compliance with a legal obligation (GDPR Article 6(1)(c)) for the payout and accounting records.
Retention: partner and payout records for 10 years as accounting law requires; applications that are not approved are kept for 12 months.

4.8 Promotional codes and campaign attribution

Purpose: apply a promotional code to an order or a grant, enforce one-use-per-address rules, and record which page, event or partner link an order or request came from.
Data: the redemption record, a hashed form of the email address used, and the referral and campaign parameters carried on the URL.
Legal bases: performance of a contract (GDPR Article 6(1)(b)) and Legitimate Interests (GDPR Article 6(1)(f)) in understanding which of our own surfaces produced an enquiry.

We do not use advertising cookies, third-party analytics scripts or cross-site tracking. Campaign attribution reads the parameters that are on the URL of the page you are looking at and records them on the object you create; nothing is written to cookies or browser storage for this purpose.

4.9 Objecting to marketing messages

Every non-transactional message carries a one-click unsubscribe link. We record the objection against a hashed form of your address, so that the suppression list cannot itself be used as a mailing list. Messages you asked for, such as a report you requested or an invoice for an order you placed, are transactional and continue to be sent.

4.10 Requests for quotes

Purpose: pass your request to the firms matched to it, let them answer with quotes and show you the quotes side by side.
Data: the description of your matter, your name, email address, company and country, the time of your consent, a hashed form of your network address, and the quotes the firms send.
Legal basis: steps taken at your request before a contract (GDPR Article 6(1)(b)).
Recipients: the matched firms that have claimed their IPRATE profile. Firms that have not claimed their profile receive the request without your contact details.
Retention: 24 months after the request closes or expires. Your contact details and the description are then deleted.

4.11 Case pages and rep-needed signals

Purpose: help applicants facing an opposition, a renewal or the loss of their representative to find a representative in time.
Data: facts from official trade mark registers, such as the mark, the case number, the applicant's name and country, and the stage of the case.
Legal basis: Legitimate Interests (GDPR Article 6(1)(f)) in helping applicants meet office deadlines with professional help.
Public pages show companies and other legal persons only. Natural persons appear only in the list sent to Premium subscribers, who are IP professionals. We inform applicants through this policy (GDPR Article 14(5)(b)). You may object at any time at [email protected]. We then remove your case from every list.

IPRATE may process special category data only in limited situations and only to the extent permitted by law. In particular, we may process special category personal data where it has been manifestly made public by the data subject (GDPR Article 9(2)(e)). Where applicable, we also rely on GDPR Article 85 (freedom of expression and information) as implemented in Lithuanian law.

We may share or make personal data available to:

• Hosting and website security service providers (e.g., Cloudflare and others) to deliver and protect the Services.
• IT and infrastructure vendors supporting website functionality (acting as processors where applicable).
• Resend, our email delivery provider, which processes the address and the content of messages we send to you.
• ConvertAPI, which converts a report or an invoice we have already composed into a PDF; it receives the document, not our database.
• Professional advisers (e.g., lawyers, auditors) where necessary.
• Public authorities where we are legally required to do so or where necessary to protect rights and safety.

The monthly study of what AI assistants recommend queries the assistant vendors' public APIs with country and practice-area terms only. No personal data is sent to those vendors.

We do not sell personal data. We do not share personal data for third-party advertising.

Some of our service providers may process data outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) and additional technical/organizational measures where required. You may contact us for more information about safeguards used.

We retain personal data only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Typical retention periods include:

• Technical/security logs: typically up to 30 days (may be longer in case of security incidents or abuse investigations).
• Emails and correspondence: for as long as needed to address the request and manage ongoing communications.
• Marketing/update emails: until you opt out or unsubscribe; we may keep a minimal suppression record to honor your opt-out.

Subject to conditions and limitations under the GDPR and applicable Lithuanian law, you may have the right to:

• Access your personal data (GDPR Article 15).
• Rectify inaccurate or incomplete data (Article 16).
• Erase data in certain circumstances (Article 17).
• Restrict processing in certain circumstances (Article 18).
• Object to processing based on legitimate interests (Article 21).
• Data portability where applicable (Article 20).

Where processing is carried out for purposes of informing the general public (GDPR Article 85), certain rights may be limited to protect freedom of expression and information, and to preserve the integrity of public-interest information. We will assess each request on a case-by-case basis.

To exercise your rights, contact us using the details in Section 1. We may request information necessary to verify your identity. If you object to receiving emails about products, services, news, or updates, you can unsubscribe using the link provided in the message (if available) or email us with your request.

9.1 Right to lodge a complaint

You have the right to lodge a complaint with the Lithuanian supervisory authority: Valstybine duomenu apsaugos inspekcija (State Data Protection Inspectorate, VDAI).

We do not use automated decision-making (including profiling) about website visitors that produces legal effects or similarly significant effects. Some IPRATE ratings may be generated or assisted by automated processing of public information; they are provided for informational purposes and do not constitute professional advice.

We implement reasonable technical and organizational measures designed to protect personal data, including access controls and security monitoring. However, no method of transmission or storage is fully secure, and we cannot guarantee absolute security.

IPRATE Content, including ratings and data, is provided for informational purposes and may contain errors or omissions. We do not guarantee accuracy, completeness, or fitness for a particular purpose. Any use of the Services is at your own risk.

The Services are not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us so we can take appropriate steps.

We may update this Privacy Policy from time to time. The updated version will be posted on the Website with a revised effective date. Your continued use of the Services after changes are posted indicates your acknowledgement of the updated Privacy Policy.