Privacy policy

01General information

This privacy policy explains how the vitaminata.lt online store collects, uses and protects your personal data, on what basis we do so and what rights you have. We process data in accordance with the General Data Protection Regulation (GDPR, (EU) 2016/679) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

Data controller MB „Comfort and beauty“, company code 306371200
Taikos pr. 32, LT-50246 Kaunas, Lithuania
info@vitaminata.lt · +370 607 03012

For any questions about personal data, email info@vitaminata.lt.

02What data we collect

Order data: first name, last name, email address, phone number, chosen delivery method, parcel locker or address, order contents, amount, discount code used, your comment and how you arrived at the website (e.g. from our newsletter or an ad link).
Correspondence data: information you provide when writing or calling us, e.g. about a return or complaint.
Technical data: IP address, browser type and time of visit, automatically recorded by the website server.
Browsing statistics: which pages you visit – only if you consent to statistics cookies.
LIVE stream registration: name, salon name, city, email address and phone number – if you register for our live stream for salons.
Request for a “Coming soon” filter: name, email address, phone number, the filter you want, quantity and comment – if you ask for a filter that cannot be ordered yet.
“Which filter suits you?” quiz: email address, your answers (scent, number of people, whether it is a gift), the suggested filters and whether you agreed to receive news – if you ask us to email you the result.

You do not need to register on the website, and we do not receive or store payment card numbers.

Subscription data: if you order a subscription, we also store the chosen plan (quantity and scents), the date of the next delivery and the card token received from EveryPay with the card type, last 4 digits and expiry month – so that we can charge the monthly payment and remind you when your card is about to expire.

03Purposes and legal bases

What we use it for	Legal basis
To accept and fulfil orders and contact you about payment and delivery	Conclusion and performance of a contract (Art. 6(1)(b) GDPR)
To run subscriptions: create monthly orders, charge payments with the saved card and send reminders	Conclusion and performance of a contract (Art. 6(1)(b) GDPR)
For accounting and invoices	Legal obligation (Art. 6(1)(c) GDPR)
To handle returns, complaints and consumer rights claims	Legal obligation and legitimate interest (Art. 6(1)(c) and (f) GDPR)
To ensure website security and operation (server logs)	Legitimate interest (Art. 6(1)(f) GDPR)
To measure the effectiveness of our newsletters and ads – we record with the order which link you came from	Legitimate interest (Art. 6(1)(f) GDPR)
For browsing statistics and improving the website	Your consent (Art. 6(1)(a) GDPR)
To measure advertising effectiveness and show ads to people who visited our website (Google Ads, Meta)	Your consent (Art. 6(1)(a) GDPR)
To register you for the LIVE stream and send emails about it (confirmation, reminder, start)	Your consent (Art. 6(1)(a) GDPR)
To accept your request for a “Coming soon” filter and let you know when it can be ordered	Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR)
To email you your quiz result at your request	Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR)
To send news and offers by email	Your consent (Art. 6(1)(a) GDPR)

We do not send marketing emails without your consent. You can withdraw your consent at any time – by clicking the link at the bottom of the email or by writing to us. Withdrawing consent does not affect processing carried out before the withdrawal.

04How long we keep data

Data	Retention period
Order data required for accounting (invoices, payments)	10 years, as required by accounting and record-keeping legislation
Other order data (contacts, delivery, comments)	3 years from the order
Correspondence about complaints and returns	3 years after the matter is resolved
LIVE stream registration	12 months after the stream or until you withdraw your consent
Request for a “Coming soon” filter	12 months from the request
Quiz result (without consent to receive news)	12 months from completing the quiz
Card token (subscription)	While the subscription is active; deleted when the subscription is cancelled
Consent to receive news	Until you withdraw your consent
Statistics and marketing cookies	Cookies on your device – up to 2 years (`_ga`) and 90 days (`_gcl_au`, `_fbp`). Google Analytics report data – 2 months
Server logs	For a short time, as set by the hosting provider

When the period ends, we delete or anonymise the data.

05Who we share data with

We do not sell your data. We share it only with service providers without whom we could not fulfil your order or keep the website running. They process the data on our instructions and may not use it for their own purposes.

Supabase Inc. – the database where orders are stored. Data centre – Frankfurt, Germany (EU).
Vercel Inc. – website hosting (IP addresses and server logs).
Delivery service providers (Omniva, Lithuanian Post) – name, phone number and delivery location, so they can deliver the parcel.
EveryPay AS (Estonia) – payment processing. We share the order number, amount and email address; you enter your card or bank details directly on the EveryPay or bank page. For subscriptions, EveryPay stores your card details and passes only a token to us.
WhatsApp Ireland Limited (Meta) – if you write to us via WhatsApp, your phone number and messages are processed by WhatsApp under its own privacy policy. No WhatsApp scripts are loaded on the website – the button is just a link.
Google Ireland Limited (Google Analytics, Google Ads) – browsing statistics and advertising effectiveness. Only with your consent to the relevant cookies.
Meta Platforms Ireland Limited (Facebook, Instagram) – advertising effectiveness: which pages you viewed, what you added to the cart and whether the order was paid (amount, products). Only with your consent to marketing cookies.
Google Ireland Limited (YouTube) – on the LIVE page the stream is shown in a YouTube player (youtube-nocookie.com); the stream chat loads only when you click it.
Resend Inc. (USA) – sending emails about orders, subscriptions, requests, quiz results and the LIVE stream (name, email address, order contents).
Accounting service provider – invoice and payment data, to the extent needed for bookkeeping.

We may also provide data to public authorities where required by law.

Some service providers (e.g. Vercel, Google, Meta) are based in the USA or transfer data to the USA. In such cases data is transferred on the basis of the EU–US Data Privacy Framework or standard contractual clauses approved by the European Commission.

06Cookies

A cookie is a small text file that a website stores on your device. Browser storage (localStorage) works in a similar way.

What we use	Why
Essential – cart contents in browser storage	So that your cart is not lost when moving between pages. It is not sent to us until you place an order. No consent required.
Essential – your cookie choice in browser storage	So we don’t have to ask you every time. No consent required.
Order source – which link you came from (e.g. a newsletter), only in the open browser tab	So that we can see whether an order came from our newsletter or an ad. Deleted when you close the tab and sent to us only when you place an order. Not shared with Google or Meta.
Statistics – Google Analytics (`_ga`, `_ga_*`)	To see which pages visitors view and improve the website. Used only with your consent.
Marketing – Google Ads (`_gcl_au`), Meta pixel (`_fbp`, `_fbc`)	To measure advertising effectiveness and show ads to people who visited our website. Used only with your consent.

Until you make a choice, Google and Meta services are not loaded. Cookies cannot give us access to your device or information about you other than what you provide yourself.

You can change your choice at any time by clicking Cookie settings (the link is also at the bottom of every page) or delete cookies in your browser settings.

07Your rights

You have the right to:

access your data and receive a copy of it;
rectify inaccurate data or complete incomplete data;
request erasure of your data (“right to be forgotten”) when it is no longer needed or you have withdrawn consent, except where we are required by law to keep it;
restrict the processing of your data;
data portability – receive your data in a commonly used machine-readable format;
object to processing based on legitimate interest and opt out of direct marketing at any time;
withdraw consent at any time.

To exercise your rights, email info@vitaminata.lt. We will reply within one month at the latest. Before providing data, we may ask you to confirm your identity.

If you believe we are processing your data improperly, you can lodge a complaint with the supervisory authority:

State Data Protection Inspectorate of Lithuania (VDAI) L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
Email ada@ada.lt
vdai.lrv.lt

We do not carry out automated decision-making with legal effects for you or profiling.

08Data security

We apply technical and organisational measures to protect data against unauthorised access, loss or alteration: the website works only over an encrypted connection (HTTPS), only authorised administrators can access order data, and access rights in the database are restricted.

09Links to other websites

Our website may contain links to other websites. We are not responsible for their content, security or privacy policies.

Buyers enter their online banking or electronic payment system login details on the pages of banks or payment service providers, so this information is not available to us.

10Changes to this policy

We may update this policy, e.g. when laws or the services we use change. The updated version is published on this page with the date of the update. We will announce material changes on the website.