How are broker files processed?
GPMas processes uploaded IBKR and Trading 212 files and your answers on its server to check the data and prepare your GPM311 investment-account summary. Working files and generated results are held in a temporary server folder, which the application removes after handling the request. The prepared summary is returned to your browser.
Your uploaded data is not sent to VMI, EDS or any other filing channel. You review the resulting summary and PDF yourself, and submit any declaration separately through VMI.
What is stored in your browser?
By default, files and answers remain only in the open page; refreshing or closing it clears your work. If you choose “Save in this browser”, original files and answers are stored locally in this browser. You can delete this saved copy in the tool. It expires 30 days after the last save and is removed the next time the tool is opened. Reopening the tool does not upload the saved files or recalculate the summary. Choosing to resume processes the files again and recalculates the summary from the saved inputs.
Your light, dark or system theme preference is also stored in your browser. It has no automatic expiry; you can remove it by clearing site data in your browser settings.
Which server diagnostics are recorded?
To understand use of the tool and identify failures, GPMas records ordinary server requests, file-inspection and report-processing stages, and their outcomes. Page and request categories come from a predefined list. Records may include language, demo or live mode, response status and error category.
Processing records may also include fixed broker, file-format and file-purpose categories; file-count and size ranges; review categories; report readiness; calculation completeness; and source-verification status. Records may also include ranges for account, result-row and review counts, exchange-rate retrieval and generated-output categories, and logging availability. Typed text and tax-answer values are not copied into the logs. Inspection and report requests may also record fixed categories indicating whether the work started with a fresh upload or a saved copy, and whether browser saving is enabled. These categories are supplied by the app and do not confirm that a local save succeeded. Local save and delete actions are not sent as separate events. Times are recorded to the UTC minute, and processing duration is recorded in ranges.
The server gives each operation a fresh random identifier to connect its stages. This identifier is not used to recognise visitors or connect separate requests, and is not sent to your browser. Access to these maintenance records is restricted to the operator maintaining the tool.
These application logs exclude uploaded contents and filenames, account numbers, amounts, currencies, countries, securities, declaration rows, review notes and uploaded-data identifiers. They also exclude IP addresses, browser and device data, referring sites, URLs, query parameters and visitor identifiers.
Browser usage analytics is disabled. It no longer creates a visit identifier or analytics counter in browser storage, or sends separate events for button clicks, scrolling or browser-storage actions. Optional “Save in this browser” and theme preferences work as described above.
New server logs are retained for 36 calendar months, including the UTC cutoff date 36 months before the current date. The application removes older records at startup and hourly while running. Historical records in the previous daily usage-event format retain their existing 30-UTC-day expiry: the current day and the preceding 29 days. No new usage events are collected in that format.
These periods apply to the specified application log stores. Hosting-provider technical logs and backups have separate retention rules. Removing a record from the application store does not remove previously created copies at the same time.
Can I sign up for email reminders?
Reminder signup is currently disabled. No new email addresses are saved for reminders.
Which tracking methods are not used?
- No advertising tracking.
- No session recording or screen capture.
- No profile built from uploaded files.
- No private declaration rows in analytics.
What rights do you have?
Under the General Data Protection Regulation (GDPR), you can:
- Find out whether your personal data is processed, access it and receive a copy.
- Ask to correct inaccurate data or complete missing information.
- Request deletion or restricted processing when the conditions in Articles 17–18 apply.
- Receive data you provided in a structured, commonly used, machine-readable format and transfer it to another controller, if processing is automated and based on consent or contract.
- Object for reasons specific to your circumstances where processing relies on legitimate interests, a public-interest task or official authority. Processing may continue only if the controller demonstrates overriding legitimate grounds or needs the data to establish, pursue or defend legal claims.
- Withdraw consent at any time if processing relies on it, without affecting the lawfulness of earlier consent-based processing.
Copies and portability must respect others' rights and freedoms. Send requests about your personal data to pagalba@gpmas.lt.
If you believe processing of your data breaches the GDPR, you can complain to a supervisory authority, including in the EU country where you live or work, or where the suspected breach occurred. In Lithuania, see the State Data Protection Inspectorate (VDAI) complaint guidance. VDAI requires formal submissions in Lithuanian; its English forms are for information.
Where can I ask a privacy question?
For privacy questions or to report an issue, write to pagalba@gpmas.lt.