Privacy Policy

1. General provisions

1.1. This Privacy Policy governs how UAB “Weha Baltic” (hereinafter – the Data Controller) processes, collects, uses, discloses, and protects your personal data when you visit the website www.weha.lt (hereinafter – the Website) and use the e-commerce services provided on it.

1.2. The Data Controller is responsible for the collection, use, and disclosure of your personal data and ensures the protection of such data in accordance with the General Data Protection Regulation (2016/679) (hereinafter – “GDPR”) and other European Union and national data protection legislation, as the Website and the services provided on it are accessible to residents of Lithuania, Latvia, and Estonia.

1.3. Data Controller’s details:

“Weha Baltic”, UAB Company code: 305161996 VAT payer code: LT100012382012 Registered address: Gluosnių g. 2, Ringaudų k., Kaunas district, Lithuania Email: info@weha.lt Phone: +370 646 11276

2. Definitions used in this Privacy Policy

2.1. Personal data – any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

2.2. Processing – any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2.3. Data controller – the natural or legal person which, alone or jointly with others, determines the purposes and means of the processing of personal data.

2.4. Data processor – a natural or legal person which processes personal data on behalf of the Data Controller.

2.5. Consent of the data subject – any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.

2.6. Cookie – a small piece of text information that is automatically created while browsing the Website and stored on your computer or other end device.

2.7. Direct marketing – activity aimed at offering goods or services to individuals by post, telephone, or other direct means, and/or seeking their opinion on the goods or services offered.

3. What personal data we collect and for what purpose

3.1. Contact form data. When you contact us via the Website’s contact form, we collect: your name / company name, email address, phone number, and the content of your message. This data is used so that we can respond to your inquiry.

3.2. Order data. When you purchase products on the Website, we collect: your first and last name (or company name and registration code), delivery and/or billing address, email address, phone number, and order details (products ordered, quantities, price). This data is necessary to fulfil your order, deliver the products, and issue accounting documents (invoices).

3.3. Payment data. Payments for products are processed through the Paysera system. The Data Controller does not store your bank card details – these are processed directly by Paysera in accordance with its own privacy policy.

3.4. Account data. If you create a user account on the Website, we collect your login details and order history so that you can more conveniently manage your orders.

3.5. Cookies. Information about the user’s browsing experience on the Website is collected using cookies, including the Google Analytics statistics tool. Cookie consent is managed using the “GDPR Cookie Compliance” system (by Moove Agency) – when you visit the Website, you will be notified about the cookies used and will be able to choose which categories you consent to. Cookies necessary for the proper functioning of the Website (e.g., the shopping cart function) are used regardless of your consent. For more information, see the Website’s Cookie Policy.

3.6. Direct marketing. If you consent, we use the collected information to send newsletters and notifications about promotions or offers.

4. Recipients of data and transfers to third parties

4.1. Your personal data may be disclosed to:

• The courier / delivery service provider “Siųsk Pigiau” – for product delivery;
• The payment service provider Paysera – for payment processing;
• Accounting service providers – for invoicing and accounting purposes;
• Law enforcement authorities, in accordance with applicable legislation;
• Other third parties, with your consent.

4.2. The Data Controller uses Google Analytics to collect website traffic statistics, so data may be transferred to Google LLC, registered in the United States of America. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as ensuring an adequate level of personal data protection.

5. Data retention periods

5.1. Data collected for contact form and direct marketing purposes is stored for 5 years from the last contact with the Data Controller.

5.2. Order and accounting documents are stored for the period specified by applicable legislation.

6. Rights of the data subject

6.1. The data subject has the right to obtain confirmation from the Data Controller as to whether personal data concerning them is being processed, and, where such personal data is being processed, the right to access it.

6.2. The data subject has the right to request that the Data Controller, without undue delay, rectify inaccurate personal data concerning them and complete any incomplete personal data.

6.3. The data subject has the right to request that the Data Controller, without undue delay, erase personal data concerning them, where this can be justified on certain grounds provided by law.

6.4. The data subject has the right to request that the Data Controller restrict the processing of data in certain specified cases.

6.5. The data subject has the right to receive personal data concerning them in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller.

6.6. Where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data concerning them for such marketing purposes.

6.7. The data subject has the right to lodge a complaint with a supervisory authority.

7. Data security

7.1. The Data Controller has implemented various technical and organisational measures to protect personal data from loss, unauthorised use, or any alteration. However, it is not possible to guarantee that personal data will be completely secure, as browsing the internet is never entirely safe.

7.2. The Data Controller undertakes not to disclose personal data to third parties, except in the cases specified in Section 4.

8. Final provisions

8.1. If you have any questions, requests, or comments regarding the processing of personal data, please contact the Data Controller by email at info@weha.lt or by phone at +370 646 11276.

8.2. The Data Controller will respond to your inquiry within 30 calendar days of receipt.

8.3. If you believe that your personal data has been processed or protected improperly, you have the right to lodge a complaint with the State Data Protection Inspectorate (in Lithuania) or the relevant authority in Latvia or Estonia, depending on your place of residence.