1. CONCEPTS
1.1. Personal Data Controller – MB „ED baldai“, legal entity code 306393798, registration address Jaunimo St. 11, Berniūnai village, LT-38365 Panevėžys District, e-mail address [email protected], contact phone number +370 668 48911, whose goods are sold in an online store https://www.nolla.lt/.
1.2. Online Store – an Online Store operated by the Personal Data Controller at https://www.nolla.lt/.
1.3. Goods – any products and/or goods offered by the Personal Data Controller on the Online Store.
1.4. A Customer - a natural person - a Customer, including website visitors, whose personal data is collected by the Personal Data Controller.
1.5. Personal Data – any information directly or indirectly related to the Customer whose identity is known or can be directly or indirectly determined using the relevant data.
1.6. Personal Data Processing – any operation performed on Personal Data (including collection, recording, storage, editing, modification, provision of access, submission of requests, transfer, archiving, etc.).
1.7. A Partner – a person providing goods/services to the Personal Data Controller related to the activities carried out by the Personal Data Controller.
1.8. Direct Marketing – activities aimed at offering goods/services to individuals by mail, telephone or other direct means, including (but not limited to) sending newsletters, special offers, invitations to participate in promotions/games, and/or activities aimed at asking individuals' opinions on the goods/services offered by mail, telephone or other direct means.
1.9. A Cookie is a small piece of text information that is automatically created when browsing a website and is stored on the visitor's computer or other device.
1.10. Privacy Policy – this document establishes the principles and rules for processing Personal Data when using the Online Store.
2. GENERAL TERMS AND CONDITIONS
2.1. The Customer grants the Personal Data Controller the right to perform all Personal Data processing activities within the scope and for the purposes provided for in this Privacy Policy.
2.2. Personal Data is processed following Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the Law of the Republic of Lithuania on the Legal Protection of Personal Data and other legal acts regulating the processing and protection of Personal data, and this Privacy Policy.
2.3. Personal Data is processed following the following principles:
2.3.1. Personal Data is collected for specified and legitimate purposes;
2.3.2. Personal Data is processed accurately, fairly and lawfully;
2.3.3. Personal Data is adequate and limited to the extent necessary for their collection and further processing;
2.3.4. Personal Data is constantly updated;
2.3.5. Personal Data is stored in a form that allows the identification of the Customer for no longer than is necessary for the purposes for which the data were collected and processed;
2.3.6. All information about Personal Data is confidential;
2.3.7. The Customer's Personal Data and other information will not be used for unlawful purposes.
2.4. The Personal Data Controller implements organizational and technical measures to protect Personal Data against accidental or unlawful destruction, alteration, disclosure, as well as against any other unlawful processing.
2.5. The Customer is responsible for the accuracy, correctness, completeness, and updating of the Personal Data provided when using the Online Store if the Personal Data changes.
2.6. The Customer must familiarize themselves with and agree to this Privacy Policy before purchasing Goods in the Online Store.
2.7. The Customer is not entitled to order Goods in the Online Store if the Customer is not familiar with and does not agree to this Privacy Policy. In cases where the Customer does not agree with the Privacy Policy or a certain part thereof, they may not order Goods in the Online Store.
2.8. The Personal Data Controller has the right to change and/or supplement the Privacy Policy. The changed Privacy Policy is published in the Online Store. All changes and/or supplements to the Privacy Policy come into force from the moment of their publication in the Online Store.
2.3.1. Personal Data is collected for specified and legitimate purposes;
2.3.2. Personal Data is processed accurately, fairly and lawfully;
2.3.3. Personal Data are adequate and limited to the extent necessary for their collection and further processing;
2.3.4. Personal Data is constantly updated;
2.3.5. Personal Data is stored in a form that allows the identification of the Customer for no longer than is necessary for the purposes for which the data were collected and processed;
2.3.6. All information about Personal Data is confidential;
3. PERSONAL DATA PROCESSING, COLLECTION, AND STORAGE
3.1. The Customer's Personal Data is processed, collected, and stored for the following purposes:
3.1.1. For the purpose of e-commerce. The following Personal Data are processed: name, surname, email address, telephone number, delivery address for the Goods, payment details for the Goods.
3.1.2. For the purpose of Direct Marketing. The following Personal Data are processed: name, surname, telephone number, email address.
3.1.3. For other purposes for which the Personal Data Controller has the right to process the Customer's Personal Data, when the Customer has expressed their consent, when the data needs to be processed due to the legitimate interest of the Personal Data Controller, or when the Personal Data Controller is obliged to process the data by relevant legal acts.
3.2. Personal Data collected by the Personal Data Controller is stored in the Personal Data Controller's information systems in electronic format. Personal Data is processed for no longer than is necessary to achieve the purposes of the Personal Data Processing or for no longer than is required by the Customer and/or provided for by legal acts.
3.3. The Customer may provide consent to the processing of their Personal Data (name, surname, telephone number, e-mail address) for the purpose of Direct Marketing. If, having provided consent to the processing of their Personal Data for the purpose of Direct Marketing and to receive Direct Marketing communications, the Customer subsequently no longer wishes to do so, they must inform the Personal Data Controller thereof.
3.4. The Customer has the right to withdraw their consent to the Personal Data Controller to process the Customer's Personal Data for Direct Marketing purposes, as set out in clause 3.3, at any time by submitting an appropriate notification to the Personal Data Controller by e-mail to [email protected] and indicating that they withdraw their consent to the use of their Personal Data for Direct Marketing purposes and do not wish to receive any Direct Marketing communications.
3.5. The Customer also has the right to withdraw his/her consent to the Personal Data Controller processing the Customer's Personal Data for Direct Marketing purposes, as set out in clause
3.3, by clicking on the relevant link in each electronic Direct Marketing message sent to the Customer by the Personal Data Controller.
3.6. The Customer agrees that in cases where it is necessary according to the instructions of the competent authorities and/or the Customer's Personal Data has potentially been used in the course of illegal activities, or there are reasonable suspicions of identity theft, due to which the competent law enforcement authorities are conducting a pre-trial investigation, or there are other legitimate grounds or purposes, his/her Personal Data would be stored on the servers of the Personal Data Controller for a longer period than set out in this Privacy Policy.
4. CUSTOMER RIGHTS
4.1. The Customer, as a Data Subject, has the following rights related to the processing of the Customer's Personal Data:
4.1.1. to receive information from the Personal Data Controller about the processing of their Personal Data, familiarize themselves with their Personal Data and how they are processed;
4.1.2. to receive information from the Personal Data Controller about the sources and types of Personal Data collected, the purpose for which they are processed, and the recipients to whom the data is provided and has been provided for at least the last 1 (one) year;
4.1.3. to demand correction of incorrect, incomplete or inaccurate personal data;
4.1.4. to request the destruction of your Personal Data when the Personal Data is processed unlawfully;
4.1.5. to request the suspension, except storage, of the processing of their Personal Data when the Personal Data is processed unlawfully;
4.1.6. to request your Personal Data transfer;
4.1.7. to withdraw at any time the consents given to the Personal Data Controller regarding the processing of Personal Data, including (but not limited to) Direct Marketing.
4.2. When exercising his/her rights, the Customer must present his/her passport or personal identity card. The Personal Data Controller shall provide the Customer with information about the processed Personal Data of the Customer free of charge once every 1 (one) year. The Customer may exercise his/her rights provided for in clause 4.1 by contacting the e-mail address [email protected]. The Personal Data Controller has the right to correct, change, delete Personal Data or suspend the processing of Personal Data only after identifying the identity of the Customer who has applied.
5. PERSONAL DATA TRANSFER
5.1. The Customer's Personal Data is not provided to third parties, except in the following cases:
5.1.1. when the Customer's consent has been obtained, as specified in this Privacy Policy;
5.1.2. Personal Data for e-commerce purposes is provided to Partners who provide services to the Personal Data Controller related to the activities carried out by the Personal Data Controller;
5.1.3. Personal Data is provided to competent authorities in cases provided for by the laws and legal acts of the Republic of Lithuania.
5.2. The Customer agrees that his/her Personal Data will be transferred to Partners when fulfilling the Customer's order placed in the Online Store.
5.3. In the Online Store, the Customer's payments are processed using the https://www.montonio.com payment intermediary system, managed by UAB Montonio Finance, company code 305205122, address Konstitucijos ave. 7, Vilnius, Lithuania, therefore the Customer's personal information required for payment execution and confirmation is transferred to UAB Montonio Finance.
6. COOKIES
6.1. To offer the Customer full-fledged services, the Personal Data Controller, with the Customer's consent, records information on the Customer's computer (device) - Cookies, which are used to identify the Customer as a previous user of the Online Store, collect statistics on the Online Store's traffic, and information about the shopping cart.
6.2. The Customer may at any time review what information (Cookies) the Personal Data Controller records and may delete some or all of the recorded Cookies.
6.3. The Customer has the right to object to the recording and use of information (Cookies) on the Customer's computer (device), however, in such a case, some functions of the Online Store may not be available to the Customer. By using the Online Store, the Customer agrees to the recording of information on the Customer's computer (device). The Customer may withdraw his/her consent at any time by changing the settings of his/her Internet browser or by contacting the Personal Data Controller by e-mail [email protected].
7. FINAL PROVISIONS
7.1. The Customer, wishing to submit an inquiry, complaint, etc. related to the processing of Personal data, may do so by contacting the Personal Data Controller at the e-mail address – [email protected] or by contact phone number – +370 668 48911 on business days from 8:00 a.m. to 5:00 p.m. A notification by e-mail is considered received when 24 hours have passed since its sending.
7.2. The Personal Data Controller, upon receiving a request from the Customer related to the processing of Personal Data, shall provide the Customer with a reasoned response, satisfying the request or refusing to do so, no later than within 30 (thirty) calendar days from the date of the Customer's request.
7.3. If the Customer does not agree with the reasoned response provided by the Personal Data Controller, the Customer may contact the State Data Protection Inspectorate (L. Sapiegos St. 17, 10312 Vilnius, e-mail [email protected], tel. no. (+370 5) 271 28 04, 279 1445, website https://vdai.lrv.lt/).
