1. Who processes your personal data

This privacy policy explains how personal data is processed on the siulubangos.lt website.

This policy applies to website visitors, customers, account users, newsletter subscribers and people who contact us.

2. What data we process, why we process it and the legal basis

Placing and fulfilling an order. We process your first name, surname, email address, telephone number, customer type, delivery details, order contents, chosen payment and delivery method, and payment status. For legal entities, we also process the company details required for the invoice and contract. The legal basis is taking steps to enter into and performing a contract (Article 6(1)(b) GDPR).

Accounting and compliance with legal obligations. We process data contained in order, invoice, payment and refund documents to the extent required by accounting, tax and other applicable laws. The legal basis is compliance with a legal obligation (Article 6(1)(c) GDPR).

Customer service, returns and disputes. We process your contact details, the content of your enquiry or complaint, correspondence and submitted documents. The legal basis is performance of a contract or our legitimate interest in responding to enquiries and establishing, exercising or defending legal claims (Article 6(1)(b) and (f) GDPR).

Customer account. If you choose to create an account, we process your login and account details and the order history shown in your account. The legal basis is the account service provided at your request and performance of a contract (Article 6(1)(b) GDPR).

Website operation and security. We process data from essential cookies, sessions, shopping carts, IP addresses, devices, browsers and technical logs where necessary to operate and secure the website and to detect fraud or misuse. The legal basis is our legitimate interest in providing a secure and functioning online store (Article 6(1)(f) GDPR).

Analytics and advertising. Only with your consent may we use analytics and marketing cookies and related identifiers, information about pages viewed, clicks, devices and purchase events. We use Google Analytics, Google Ads and Meta Pixel. The legal basis is consent (Article 6(1)(a) GDPR).

Newsletters. If you separately consent to receiving newsletters, we process your email address, name, consent record and newsletter interaction data. We use a newsletter delivery service provider. The legal basis is consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time using the unsubscribe link in any newsletter.

3. Where we obtain data and which data you must provide

We obtain data directly from you when you place an order, create an account, complete a contact form or subscribe to a newsletter. We also receive data from the website and service providers when you use the online store or choose a payment or delivery method.

Required fields are marked with an asterisk. If you do not provide the data required for ordering, payment or delivery, we will be unable to enter into or perform the contract. A full address is required from a private customer only when courier delivery is selected; a legal entity must provide the company and address details required for the invoice and contract.

4. Who may receive your data

We disclose data only to the extent necessary to provide a particular service or comply with a legal obligation:

  • website hosting, technical maintenance, security and email service providers;
  • the payment service provider Montonio and the bank or other payment service provider you select;
  • the delivery service provider you select, currently Omniva or Unisend (LP Express);
  • accounting and invoice administration service providers;
  • a newsletter delivery service provider, if you consent to receive newsletters;
  • Google and Meta, if you consent to analytics or marketing cookies;
  • public authorities, courts or law enforcement bodies where disclosure is required by law.

We do not receive or store payment card details or online banking login credentials in the online store. They are processed by the payment service provider you select.

5. Transfers of data outside the EEA

When services provided by Google, Meta or other international providers are used, some data may be processed outside the European Economic Area. In such cases, transfers are based on a European Commission adequacy decision, Standard Contractual Clauses or other safeguards provided for in Chapter V of the GDPR. You may request information about the safeguards applicable to a particular transfer by emailing [email protected].

6. How long we retain data

  • order, invoice, payment and refund documents – for 10 years or for another mandatory period prescribed by law;
  • account data – for as long as you use the account; after the account is deleted, data related to orders or legal obligations is retained for the relevant mandatory period;
  • customer service and contact form data – generally for up to 1 year after the matter has been resolved; if the information relates to a contract, return or dispute, for as long as necessary for the contract, legal obligation or legal claims;
  • newsletter data – until you withdraw your consent or the data is no longer needed; evidence of consent or opt-out may be retained for as long as necessary to demonstrate compliance with the law;
  • cookie and related data – for the periods specified in the cookie management tool and by the relevant service provider;
  • technical and security logs – only for as long as necessary to secure the website, investigate an incident or comply with a legal obligation.

When the applicable period expires, data is deleted or anonymised unless it must be retained for longer to comply with a legal obligation or for legal claims.

7. Cookies

Essential cookies are used to operate the website, shopping cart, checkout, language selection and security features. Analytics and marketing cookies are enabled only with your consent. You can withdraw consent by deleting this website’s cookies and making a new choice, or by contacting us. You can also block or delete cookies in your browser, but some online store functions may then not work.

8. Your rights

Subject to the conditions set out in the GDPR, you have the right to:

  • find out whether we process your data and obtain a copy;
  • request correction of inaccurate data or completion of incomplete data;
  • request erasure of data or restriction of its processing;
  • object to processing based on legitimate interests and object to direct marketing at any time;
  • receive the data you provided in a structured, commonly used and machine-readable format where the right to data portability applies;
  • withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal;
  • lodge a complaint with the Lithuanian State Data Protection Inspectorate or seek a judicial remedy.

To exercise your rights, email [email protected]. We will respond as quickly as possible and in any event within the one-month period set by the GDPR. Where necessary, we may request information to verify your identity.

9. Automated decision-making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. With your consent, advertising service providers may use cookie data to create audiences and personalise advertising, but this does not change the order price, payment or your ability to purchase goods.

10. Changes to this policy

We may update this policy if laws, services or data processing practices change. The current version is always published on this page.

Last updated: 27 August 2026