Privacy Policy

1. Who is responsible for your data

The data controller responsible for the personal data described in this policy is [LEGAL ENTITY NAME], company registration number [REGISTRATION NUMBER], registered at [REGISTERED ADDRESS], Lithuania.

If you have any question about this policy, about how your data is handled, or if you wish to exercise any of the rights described below, contact us at info@growlet.lt.

Given the nature and scale of our processing, we are not required to appoint a Data Protection Officer under Article 37 of the GDPR. Enquiries are handled directly at the address above.

2. What personal data we collect

We collect the following categories of personal data:

• Order data — your name, email address, delivery address, the items you ordered, the amount paid, the currency, and the status of your order.
• Payment data — payments are processed entirely by Stripe on Stripe's own systems. We receive a payment reference and confirmation of whether the payment succeeded. We never see, receive or store your full card number, expiry date or security code.
• Technical data — your IP address and standard request information (browser type, requested page, time of request), processed by our hosting provider to deliver the site and protect it against abuse.
• Language preference — whether you are browsing in English or Lithuanian, stored in a cookie.
• Visit counting — the page you opened, the language and the site you arrived from, tied to a random number that lasts only while the page is open. Nothing here identifies you.
• Cart — product identifiers and quantities, kept in your browser until you clear them or complete an order.
• Correspondence — the content of any message you send us and the contact details you use to send it.
• Discount signup — if you leave your email to claim a discount, we store that address and whether you agreed to receive our news.

3. Why we process your data and on what legal basis

We may only process personal data where the GDPR gives us a lawful basis for doing so. Our purposes and bases are:

• To process, fulfil and deliver your order — necessary for the performance of a contract with you (Article 6(1)(b)).
• To send you order confirmations and delivery updates — necessary for the performance of a contract (Article 6(1)(b)).
• To handle returns, refunds, warranty claims and complaints — necessary for the performance of a contract and to comply with consumer protection law (Articles 6(1)(b) and 6(1)(c)).
• To keep accounting and tax records — necessary to comply with a legal obligation (Article 6(1)(c)).
• To prevent fraudulent transactions and keep the store secure — necessary for our legitimate interests in protecting the business and our customers (Article 6(1)(f)).
• To respond to enquiries you send us — necessary for our legitimate interests in communicating with customers and prospective customers (Article 6(1)(f)).
• To give you the discount we offered — necessary to honour that offer (Article 6(1)(b)). To send news and offers — only on the basis of your consent (Article 6(1)(a)), which you may withdraw at any time.
• To measure how our adverts perform and show them to people likely to be interested, using the Meta Pixel — only on the basis of your consent (Article 6(1)(a)), given through the cookie notice and withdrawable at any time through Cookie settings. Storing and reading the pixel's cookies on your device requires that same consent under the Lithuanian Law on Electronic Communications.

4. Cookies and similar technologies

Our store uses three cookies of its own, each strictly necessary for the service you asked for. NEXT_LOCALE records whether you are viewing the site in English or Lithuanian. growlet_discount is set only if you claim a discount offer, and lets that discount be applied at checkout. growlet_checkout is set when you come back from payment, and lets this browser show you your order confirmation for up to seven days, including once a delayed payment has cleared. The last two hold only a reference our server uses to find your offer or your order; scripts on the page cannot read them, and they are never passed to anyone.

Your cart is kept in your own browser (localStorage), not with us. It holds product identifiers and quantities only — no prices and nothing about you. Prices are calculated by our server every time. This entry is necessary for the service you asked for, namely buying something, so it needs no separate consent, and you can clear it at any time in your browser settings.

We count visits for our own statistics, but we do so without writing anything to your device — no cookie, no other marker. Your browser makes up a random number that exists only while the page is open, and sends it along with the page you opened and the site you came from. We do not store your IP address, a device fingerprint or anything else that would let us recognise you, we build no behavioural profiles, and we pass none of this to anyone. Visits are counted this way whether or not you accept the cookie notice described below.

If you accept the cookie notice, we switch on the Meta Pixel, a tool provided by Meta Platforms Ireland Limited. It sets the cookie _fbp and, if you arrived by clicking one of our adverts, the cookie _fbc — each kept for up to 90 days — and it sends Meta the pages you view on our store, together with technical data such as your IP address and information about your browser. We use it to measure how our adverts perform and to show them to people likely to be interested in our products. Until you accept, the pixel is not loaded at all and nothing is sent to Meta. The pixel's automatic collection of form fields and button clicks is switched off, and it sends nothing from pages whose address carries anything private, such as the unsubscribe page. When you add a product to the cart or start checkout, we also tell Meta which product it was — by our internal product reference, not its name — how many items, and their value in euros. If you place an order and have accepted, we also tell Meta that a purchase took place — once, and only after Stripe has confirmed the payment to our server: the amount you paid, the currency, and a reference we generate for the order. Your name, email address, phone number, delivery address and payment details are never sent.

Your answer to the cookie notice is remembered in your browser (localStorage, under growlet_consent) for twelve months, after which we ask again. You can change your mind at any time through Cookie settings at the foot of every page. If you withdraw consent, the pixel stops sending data and we delete its cookies from your browser; withdrawing does not affect anything that happened while your consent was in place.

When you proceed to payment, the checkout page is hosted by Stripe on Stripe's own domain. Any cookies set there are set by Stripe and governed by Stripe's privacy policy, not by this one.

5. Who we share your data with

We do not sell your personal data and we do not share it for anyone else's marketing purposes. We disclose it only to service providers who help us operate the store. Except for Meta, each of these acts as our processor and is bound by a data processing agreement that permits them to use the data only on our instructions:

• Stripe Payments Europe, Ltd. — processes payments and performs fraud checks.
• Vercel Inc. — hosts and delivers the website.
• Neon Inc. — hosts the database in which order records are stored.
• Resend — sends transactional emails such as order confirmations.
• Meta Platforms Ireland Limited — only if you accept the cookie notice, receives the data collected by the Meta Pixel. For collecting that data on our store and passing it to Meta, we and Meta are joint controllers; what Meta does with it afterwards is Meta's own responsibility and is described in Meta's privacy policy.
• [COURIER COMPANY] — delivers your order, and for that purpose receives your name, delivery address and contact details.
• Our accountants and, where legally required, tax and public authorities.

6. Transfers outside the European Economic Area

Some of our service providers process data on servers located outside the European Economic Area. In particular, our website hosting (Vercel) and our order database (Neon) currently operate from data centres in the United States, and Stripe may process payment data outside the EEA. If you accept the cookie notice, data collected by the Meta Pixel may also be processed by Meta Platforms, Inc. in the United States.

Where personal data is transferred outside the EEA, that transfer is protected by the safeguards required under Chapter V of the GDPR. In practice we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified under it, the EU–U.S. Data Privacy Framework.

You may request further information about these transfers, including a copy of the safeguards relied upon, by writing to info@growlet.lt.

7. How long we keep your data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires:

• Order and transaction records, including invoices — retained for the period required by accounting and tax legislation, being 10 years.
• Delivery information — retained for as long as needed to complete delivery and to handle any return, refund or warranty claim, and thereafter as part of the order record.
• Correspondence — retained for 2 years from our last exchange, so that we can deal with any follow-up.
• The language cookie — stored on your device until it expires or until you delete it through your browser settings.
• Discount signup records — kept until you withdraw consent or ask us to delete them; where no marketing consent was given, for one year from signup.
• Visit records — deleted automatically after 90 days.
• Cart — kept on your device until you clear it or clear your browsing data.

8. Your rights

The GDPR gives you the following rights in relation to your personal data:

• The right of access — to be told whether we process data about you and to receive a copy of it.
• The right to rectification — to have inaccurate data corrected and incomplete data completed.
• The right to erasure — to have your data deleted, except where we are required to keep it, for example under tax law.
• The right to restriction — to have our processing limited while a dispute about accuracy or lawfulness is resolved.
• The right to data portability — to receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• The right to object — to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation.
• The right to withdraw consent — where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

9. How to exercise your rights

To exercise any of the rights above, write to us at info@growlet.lt. Please describe clearly what you are asking for so that we can deal with it properly.

We will respond within one month of receiving your request, as required by Article 12 of the GDPR. If your request is particularly complex, or if you have made several requests, we may extend this by up to two further months and will tell you if we do.

We may ask you to confirm your identity before we act on a request, so that we do not disclose your data to someone else.

Exercising your rights is free of charge. We may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive, and we will explain our reasons if that happens.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at info@growlet.lt. We would prefer the chance to put things right.

You also have the right to lodge a complaint with a data protection supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, 10312 Vilnius, email ada@ada.lt, website vdai.lrv.lt.

If you live or work in another EU or EEA country, you may instead complain to the supervisory authority there.

11. How we protect your data

Card payments are handled on Stripe's PCI-DSS certified infrastructure, and card details never reach our servers.

All traffic between your browser and our store is encrypted using HTTPS.

Access to the order database is limited to authorised administrators, and administrator credentials are stored only as cryptographic hashes, never in readable form.

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours, and we will notify you directly where the risk is high, as required by Articles 33 and 34 of the GDPR.

12. Children

Our products are designed for children, but our store is intended to be used by adults. We do not knowingly collect personal data from anyone under the age of 16.

If you believe that a child has provided us with personal data, please contact us at info@growlet.lt and we will delete it without undue delay.

13. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Stripe applies automated fraud detection to payments as part of processing your transaction. If a payment is declined by those checks, you may contact us and we will look into it.

14. Changes to this policy

We may update this policy as our store develops — for example if we begin sending marketing emails, introduce analytics, or start working with a new delivery partner.

The effective date shown at the top of this page always identifies the current version. Where a change materially affects how we handle your data, we will publish it on this page before it takes effect.