📌Controller and scope

1. 1.1. This Privacy Policy regulates the principles of collection, processing and storage of personal data. Personal data is processed and stored by JusuPrekes.lt / GEMEX Trading, SIA, who is the controller of the personal data (hereinafter – the Controller).
2. 1.2. For the purposes of this Privacy Policy, a data subject means the customer or another natural person whose personal data is processed by the Controller.
3. 1.3. For the purposes of this Privacy Policy, a customer means anyone who purchases goods or services on the Controller’s website.
4. 1.4. The Controller observes the principles relating to personal data processing provided by applicable legislation and processes personal data in a lawful, fair and secure manner. The Controller is able to demonstrate that personal data is processed in accordance with legal requirements.

💾How data is collected and stored

1. 2.1. Personal data is processed and stored by the Controller both electronically and on paper. Personal data is mainly collected electronically via the website and by e-mail.
2. 2.2. By sharing their personal data, the data subject grants the Controller the right to collect, organise, use and administer, for the purposes defined in this Privacy Policy, the personal data that the data subject provides directly or indirectly when purchasing goods or services on the website.
3. 2.3. The data subject is responsible for the accuracy, correctness and completeness of the data submitted. The submission of knowingly false data is regarded as a breach of this Privacy Policy. The data subject is required to immediately notify the Controller of any changes in the data submitted.
4. 2.4. The Controller is not liable for any damage or loss caused to the data subject or a third party as a result of the submission of false data by the data subject.

🧾Types of personal data processed

3.1. The Controller may process the following personal data of the data subject:

• 3.1.1. Contact information: name, email address, phone number;
• 3.1.2. Payment information: payment card details (processed in secure payment systems);
• 3.1.3. Delivery information: delivery and billing addresses;
• 3.1.4. Technical information: IP address, browser type, cookie data;
• 3.1.5. Other information: any additional data provided through inquiries, reviews or communication with customer service.

3.2. In addition to the foregoing, the Controller has the right to collect data about the customer from publicly available registers, where permitted by law.

⚖️Legal basis for processing

3.3. The legal basis for the processing of personal data is Article 6(1)(a), (b), (c) and (f) of the General Data Protection Regulation (GDPR):

• (a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
• (b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract;
• (c) processing is necessary for compliance with a legal obligation to which the Controller is subject;
• (f) processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

⏱️Purposes and storage periods

3.4. Personal data is processed for the following purposes and retained for the periods indicated:

• 3.4.1. Security and safety:
  Personal data may be processed to ensure the security of systems, transactions and users. Storage period – according to the terms specified by applicable law.
• 3.4.2. Order processing:
  Personal data is processed to accept, manage and fulfil orders. Maximum storage period – 5 years from the end of the financial year in which the transaction was completed, as required by the Accounting Law for tax and financial reporting.
• 3.4.3. Operation of the online store:
  Personal data is processed to maintain and provide e-shop services (user account, order history, settings). Data is stored for the duration of the user’s account activity. If the account is inactive, data will be deleted after 2 years of inactivity, unless retention is required for legal or compliance purposes.
• 3.4.4. Customer management:
  Personal data is processed to manage relationships with customers, handle inquiries and service quality. Data is stored as long as the customer relationship exists, and an additional 2 years thereafter to handle disputes, inquiries or follow-up issues, unless legal obligations require longer retention.
• 3.4.5. Financial activities and accounting:
  Personal data is processed for bookkeeping, tax and financial reporting. Storage period – according to the terms specified by applicable law.
• 3.4.6. Marketing:
  Personal data may be processed for direct marketing based on consent or legitimate interest. Data is stored until the user withdraws consent or objects to processing, but no longer than 2 years from the last interaction, unless a different period is required by law.

3.5. The Controller has the right to share customers’ personal data with third parties such as: data processors, accountants, transport and courier companies, payment and transfer service providers. The Controller transmits the personal data necessary for making payments to the payment service provider Maksekeskus AS.

3.6. The Controller processes and stores personal data implementing appropriate organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure, loss and any other unlawful processing.

3.7. Depending on the purpose of processing and legal requirements, personal data may be stored for up to 10 years, for example, for financial audits or legal dispute resolution.

👤Your privacy rights

1. 4.1. The data subject has the right to gain access to and examine their personal data.
2. 4.2. The data subject has the right to obtain information on the processing of their personal data.
3. 4.3. The data subject has the right to modify or rectify inaccurate or incomplete data.
4. 4.4. Where personal data is processed based on consent, the data subject has the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
5. 4.5. To exercise their rights, the data subject may contact the online store’s customer support at: info@jusuprekes.lt.
6. 4.6. If the data subject believes that their rights have been violated, they can file a complaint with the competent Data Protection Authority in their country of residence or where the alleged infringement took place.

📚Compliance with laws

5.1. These data protection terms and conditions have been prepared in compliance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR);
• applicable national data protection laws of the Republic of Lithuania and the Republic of Latvia;
• other relevant legislation of the European Union and national laws.

5.2. The Controller has the right to amend this Privacy Policy in part or in full. Updated versions will be published on https://jusuprekes.lt. Where required by law, data subjects will be informed of material changes.

🔄Updates to this Privacy Policy

This Privacy Policy may be updated from time to time to reflect changes in our data processing practices, legal requirements or technical solutions.

Any updated version will be published on our website. We recommend reviewing this section periodically to stay informed about how we protect your personal data.