Privacy policy

Privacy Policy

In this privacy policy (hereinafter – Privacy Policy) we provide you with information on how MB Itališko skonio dėžutė, legal entity code 307210659, registered office address Perkūnkiemio g. 15-65, 12119 Vilnius (hereinafter – the Data Controller or we) processes your personal data in the online shop at http://www.italiskoskoniodezute.lt/ (hereinafter – the E-shop).

The Data Controller notes that it values and protects the privacy of website visitors, and therefore in this Privacy Policy we set out clearly and transparently the principles of information collection and use applied on our website. This Privacy Policy contains all the important information about how we use the personal data of our customers, i.e. your personal data.

By using our website, you agree to the provisions of the Privacy Policy.

You may contact the Data Controller using the following contact details:

Phone: +(370) 69025035
Email: info@pastabox.lt
Address: Perkūnkiemio g. 15-65, 12119 Vilnius

What personal data of yours do we process?

In the E-shop, we process personal data for the following purposes:

Purpose: Order fulfilment and delivery

Personal data processed: Name, surname, address, telephone number, email address, IP address.
Legal basis: Contract (where the buyer is a natural person) or the Data Controller's legitimate interest in carrying out its activities (where the buyer is a legal person).
Retention period: 10 years after the order is fulfilled.
We may transfer the data required for the delivery of the order (name, surname, address, telephone number, email address) to the delivery service provider (courier).

Purpose: Refund of payments

Personal data processed: Name, surname, bank account number, other details, IP address.
Legal basis: Contract, legal obligation.
Retention period: 10 years after the payment transfer.
We may transfer personal data to payment service providers.

Purpose: Sale and administration of gift vouchers

Personal data processed: Name, surname, email address, telephone number, gift voucher value, date of sale, gift voucher number, expiry date.
Legal basis: Contract.
Retention period: until the expiry of the gift voucher or until the gift voucher is used.

Purpose: Creation and administration of an account in the E-shop

Personal data processed: Name, surname, account name and password, telephone number, email address, address, order history, photograph, IP address.
Legal basis: Contract.
Retention period: for as long as the account is active, and for 24 (twenty-four) months after the date of the last login to the account.

Purpose: Communication with E-shop visitors and other persons

Personal data processed: Name, surname, email address, telephone number, IP address.
Legal basis: Taking steps at the request of the data subject prior to entering into a contract, or the Data Controller's legitimate interest in carrying out its activities and/or ensuring quality.
Retention period: 1 year after the date on which the enquiry is resolved.

Purpose: Direct marketing (newsletters, invitations to events, offering similar goods or services)

Personal data processed: Name, surname, email address, telephone number.
Legal basis: Consent or the Data Controller's legitimate interest in offering similar goods or services to customers.
Retention period: 2 years after consent is obtained or after the person has purchased goods or services.
We may transfer personal data to the newsletter distribution solution.

Purpose: Conclusion and performance of other contracts with suppliers, service providers, partners and customers

Personal data processed: Name, surname, address, email address, telephone number, other data contained in the contract.
Legal basis: Contract (where a contract is concluded with a natural person) or the Data Controller's legitimate interest in carrying out its activities (where the personal data of a counterparty's – legal person's – representative are processed).
Retention period: 10 years after the expiry of the contract.

Purpose: Administration of social network accounts

Personal data processed: User name, unique ID, profile picture, information contained in comments or correspondence, IP address, device information.
Legal basis: Consent or the Data Controller's legitimate interest in communicating with customers.
Retention period: For as long as the person is a follower of our account on the social network.
The information you provide to us via social media when visiting our accounts (including messages, use of the “Like” button and other communication) is controlled by us jointly with the operators of the social networks, as joint controllers of personal data.
We currently have the following social network accounts:

“Facebook” – Itališko skonio dėžutė, whose privacy notice is available at https://www.facebook.com/privacy/explanation
“Instagram” – Itališko skonio dėžutė, whose privacy notice is available at https://help.instagram.com/519522125107875

We recommend that you read the privacy notices of third parties and contact the service providers directly if you have any questions about how they use your personal data.

To whom may we transfer your personal data?

We may transfer information about you to our employees, intermediaries, service providers such as companies carrying out debt administration or recovery, companies providing archiving services, persons providing legal, marketing or IT services, or subcontractors, where reasonably necessary for the purposes set out in this Privacy Policy.

We may also disclose information about you if we are required to do so by law or in order to defend our rights or interests (including providing your personal data to third parties for the purpose of recovering your debts to us), as well as where we intend to transfer the E-shop, part of the company's business or its assets, or to reorganise the company, or in the course of such processes, by disclosing your personal data to the (potential) acquirer of the business or part thereof and to other participants in the reorganisation.

How is your personal data processed?

Your personal data will be processed in compliance with the requirements of the General Data Protection Regulation (hereinafter – GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania and other legal acts. The Data Controller, both when determining the means of processing personal data and during the processing itself, implements the appropriate technical and organisational data protection measures laid down in legal acts, designed to protect the personal data processed against accidental or unlawful destruction, damage, alteration, loss or disclosure, as well as against any other unlawful processing. The relevant measures are determined taking into account the risks arising from the processing of personal data.

What are your rights?

Below we provide information on your rights in relation to the processing of your personal data by the Data Controller and the cases in which you may exercise these rights. If you would like more information about your rights or wish to exercise them, please contact us at the email address indicated in this Privacy Policy.

You may contact us at any time to enquire whether we process any of your personal data. If we store or use your personal data in any way, you have the right to access it. To do so, submit a written request to us at the email address indicated in this Privacy Policy. For the purpose of fulfilling your request, we may ask you to confirm your identity. When submitting such a request, please observe the principles of good faith and reasonableness.
If you have given us consent to the processing of your data, you may withdraw it at any time at the email address indicated in this Privacy Policy.
You have the right to request that we rectify any inaccuracies in the data we hold. In such a case, we may ask you to confirm the corrected information.
You have the right to request that we erase your personal data. This right is exercised in the cases provided for in Article 17 of the GDPR.
You have the right to request that we restrict the processing of your personal data or refrain from processing it.
You have the right to the portability of data which is processed by automated means and which we have obtained from you on the basis of your consent or for the purpose of concluding a contract. If you exercise this right, we will, at your request, transfer a copy of the data you have provided.
You have the right, in the cases and in accordance with the procedure laid down in Article 21 of the GDPR, to object to our use of your personal data where the personal data is processed on the basis of the Data Controller's legitimate interest.

How can you exercise your rights?

To exercise your rights, submit your requests, complaints or claims to us in writing using the contact details indicated in this Privacy Policy.

We will respond to the requests, complaints or claims received in writing, in accordance with the procedure and within the time limits laid down by legal acts. We endeavour to provide you with the information as quickly as possible, but no later than within 30 days of receipt of your request.

If, upon receipt of a request, complaint or claim, we have doubts about the identity of the person submitting it, we have the right to request an identity document from the person submitting it.

Complaints

If you believe that your rights as a data subject are and/or may be infringed, please contact us immediately at the email address indicated in this Privacy Policy. We guarantee that, upon receipt of your complaint, we will contact you within a reasonable period and inform you of the progress of the investigation of the complaint and, subsequently, of its outcome. If you are not satisfied with the results of the investigation, you will be able to lodge a complaint with the supervisory authority: in Lithuania – the State Data Protection Inspectorate (https://vdai.lrv.lt/), and the list of supervisory authorities of other EU Member States can be found on the website of the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/about-edpb/members_lt.

Liability

You are responsible for ensuring that the data you provide to us is accurate, correct and complete. If the data you have provided changes, you must inform us immediately by email. In no event will we be liable for any damage suffered by you as a result of you providing incorrect or incomplete personal data or failing to inform us of changes to it.

Cookie Policy