Privacy Policy

1. Who is responsible for your data

The data controller responsible for the personal data described in this policy is [LEGAL ENTITY NAME], company registration number [REGISTRATION NUMBER], registered at [REGISTERED ADDRESS], [COUNTRY].

If you have any question about this policy, about how your data is handled, or if you wish to exercise any of the rights described below, contact us at [CONTACT EMAIL].

Given the nature and scale of our processing, we are not required to appoint a Data Protection Officer under Article 37 of the GDPR. Enquiries are handled directly at the address above.

2. What personal data we collect

We collect the following categories of personal data:

• Order data — your name, email address, delivery address, the items you ordered, the amount paid, the currency, and the status of your order.
• Payment data — payments are processed entirely by Stripe on Stripe's own systems. We receive a payment reference and confirmation of whether the payment succeeded. We never see, receive or store your full card number, expiry date or security code.
• Technical data — your IP address and standard request information (browser type, requested page, time of request), processed by our hosting provider to deliver the site and protect it against abuse.
• Language preference — whether you are browsing in English or Lithuanian, stored in a cookie.
• Correspondence — the content of any message you send us and the contact details you use to send it.

3. Why we process your data and on what legal basis

We may only process personal data where the GDPR gives us a lawful basis for doing so. Our purposes and bases are:

• To process, fulfil and deliver your order — necessary for the performance of a contract with you (Article 6(1)(b)).
• To send you order confirmations and delivery updates — necessary for the performance of a contract (Article 6(1)(b)).
• To handle returns, refunds, warranty claims and complaints — necessary for the performance of a contract and to comply with consumer protection law (Articles 6(1)(b) and 6(1)(c)).
• To keep accounting and tax records — necessary to comply with a legal obligation (Article 6(1)(c)).
• To prevent fraudulent transactions and keep the store secure — necessary for our legitimate interests in protecting the business and our customers (Article 6(1)(f)).
• To respond to enquiries you send us — necessary for our legitimate interests in communicating with customers and prospective customers (Article 6(1)(f)).

4. Cookies and similar technologies

Our store uses a single cookie, named NEXT_LOCALE. It records whether you are viewing the site in English or Lithuanian so that the correct language is shown to you. It contains no identifier, and it is strictly necessary for the service you have requested, so under the ePrivacy rules it does not require your consent.

We do not use analytics cookies, advertising cookies, tracking pixels or any similar technology, and we do not build behavioural profiles of our visitors.

When you proceed to payment, the checkout page is hosted by Stripe on Stripe's own domain. Any cookies set there are set by Stripe and governed by Stripe's privacy policy, not by this one.

If we introduce analytics or advertising tools in the future, we will update this policy and, where the law requires it, ask for your consent before those technologies are activated.

5. Who we share your data with

We do not sell your personal data and we do not share it for anyone else's marketing purposes. We disclose it only to service providers who help us operate the store. Each of these acts as our processor and is bound by a data processing agreement that permits them to use the data only on our instructions:

• Stripe Payments Europe, Ltd. — processes payments and performs fraud checks.
• Vercel Inc. — hosts and delivers the website.
• Neon Inc. — hosts the database in which order records are stored.
• Resend — sends transactional emails such as order confirmations.
• [COURIER COMPANY] — delivers your order, and for that purpose receives your name, delivery address and contact details.
• Our accountants and, where legally required, tax and public authorities.

6. Transfers outside the European Economic Area

Some of our service providers process data on servers located outside the European Economic Area. In particular, our website hosting (Vercel) and our order database (Neon) currently operate from data centres in the United States, and Stripe may process payment data outside the EEA.

Where personal data is transferred outside the EEA, that transfer is protected by the safeguards required under Chapter V of the GDPR. In practice we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified under it, the EU–U.S. Data Privacy Framework.

You may request further information about these transfers, including a copy of the safeguards relied upon, by writing to [CONTACT EMAIL].

7. How long we keep your data

We keep personal data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires:

• Order and transaction records, including invoices — retained for the period required by accounting and tax legislation, being [RETENTION PERIOD, e.g. 10 years].
• Delivery information — retained for as long as needed to complete delivery and to handle any return, refund or warranty claim, and thereafter as part of the order record.
• Correspondence — retained for [RETENTION PERIOD, e.g. 2 years] from our last exchange, so that we can deal with any follow-up.
• The language cookie — stored on your device until it expires or until you delete it through your browser settings.

8. Your rights

The GDPR gives you the following rights in relation to your personal data:

• The right of access — to be told whether we process data about you and to receive a copy of it.
• The right to rectification — to have inaccurate data corrected and incomplete data completed.
• The right to erasure — to have your data deleted, except where we are required to keep it, for example under tax law.
• The right to restriction — to have our processing limited while a dispute about accuracy or lawfulness is resolved.
• The right to data portability — to receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.
• The right to object — to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation.
• The right to withdraw consent — where processing is based on consent, to withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

9. How to exercise your rights

To exercise any of the rights above, write to us at [CONTACT EMAIL]. Please describe clearly what you are asking for so that we can deal with it properly.

We will respond within one month of receiving your request, as required by Article 12 of the GDPR. If your request is particularly complex, or if you have made several requests, we may extend this by up to two further months and will tell you if we do.

We may ask you to confirm your identity before we act on a request, so that we do not disclose your data to someone else.

Exercising your rights is free of charge. We may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive, and we will explain our reasons if that happens.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at [CONTACT EMAIL]. We would prefer the chance to put things right.

You also have the right to lodge a complaint with a data protection supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, 10312 Vilnius, email ada@ada.lt, website vdai.lrv.lt.

If you live or work in another EU or EEA country, you may instead complain to the supervisory authority there.

11. How we protect your data

Card payments are handled on Stripe's PCI-DSS certified infrastructure, and card details never reach our servers.

All traffic between your browser and our store is encrypted using HTTPS.

Access to the order database is limited to authorised administrators, and administrator credentials are stored only as cryptographic hashes, never in readable form.

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours, and we will notify you directly where the risk is high, as required by Articles 33 and 34 of the GDPR.

12. Children

Our products are designed for children, but our store is intended to be used by adults. We do not knowingly collect personal data from anyone under the age of 16.

If you believe that a child has provided us with personal data, please contact us at [CONTACT EMAIL] and we will delete it without undue delay.

13. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.

Stripe applies automated fraud detection to payments as part of processing your transaction. If a payment is declined by those checks, you may contact us and we will look into it.

14. Changes to this policy

We may update this policy as our store develops — for example if we begin sending marketing emails, introduce analytics, or start working with a new delivery partner.

The effective date shown at the top of this page always identifies the current version. Where a change materially affects how we handle your data, we will publish it on this page before it takes effect.