1. General provisions

1.1. This privacy policy sets out how MB Dental SPA (hereinafter – the Company or the Data Controller) collects, uses and stores your personal data when you use the online store dental-spa.lt (hereinafter – the Store).

1.2. Data Controller:
MB Dental SPA, legal entity code 306318240
Registered office address: Vėjo g. 11A-13, LT-41163 Biržai, Lithuania
Email: info@dental-spa.lt, tel. +370 680 55275

1.3. The Company processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, hereinafter – GDPR), the Law on the Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania and other legal acts.

2. What data we collect, why and on what basis

2.1. Order fulfilment and delivery of goods
Data: name, surname, phone number, email address, delivery address, order information (goods, price, date).
Legal basis: conclusion and performance of a contract (GDPR Art. 6(1)(b)).
Retention period: 10 years from the date of the order, because order data forms part of the accounting documents.

2.2. Payments
Data: order amount, payment method, payment date and status. The Company does not receive or store payment card data. It is processed by the payment service provider (see Section 4).
Legal basis: performance of a contract and legal obligation (GDPR Art. 6(1)(b) and (c)).
Retention period: 10 years (Law on Accounting of the Republic of Lithuania).

2.3. Customer service, returns and complaints
Data: name, surname, contact details, content of the enquiry, photographs, order information.
Legal basis: performance of a contract and legitimate interest in handling enquiries (GDPR Art. 6(1)(b) and (f)).
Retention period: 3 years from the resolution of the enquiry.

2.4. Newsletters and marketing messages
Data: email address, name, (if provided) phone number, information about email opens and clicks.
Legal basis: your consent (GDPR Art. 6(1)(a)). You give consent by ticking a separate box when placing an order or by subscribing to the newsletter.
The Company may also send offers for similar goods to its existing customers if they have not objected (Article 69(2) of the Law on Electronic Communications).
Retention period: until consent is withdrawn or 3 years from your last activity (opening an email, making a purchase).
You can withdraw your consent at any time by clicking the unsubscribe link at the bottom of each email or by writing to info@dental-spa.lt.

2.5. Website analytics and advertising
Data: IP address, browser and device information, time of visit, pages viewed, actions on the website (e.g. adding a product to the cart, purchase), cookie identifiers.
Legal basis: your consent given through the cookie notice (GDPR Art. 6(1)(a)).
Retention period: as specified in Section 7.

2.6. Website Protection (reCAPTCHA)

Data: Technical browser and device data, IP address, and website interaction behavior required to protect the website from automated bots and cyber attacks.

Legal Basis: Legitimate interest in ensuring website security (Article 6(1)(f) of the GDPR). This protection is subject to Google’s Privacy Policy and Terms of Service.

2.7. The Company does not collect special categories of personal data and does not knowingly process the data of persons under 14 years of age.

3. Profiling

3.1. If you consent to marketing cookies, the advertising systems of Meta (Facebook, Instagram) and Google may show you tailored advertisements based on your actions in the Store. Omnisend may send emails based on your actions, for example a reminder about items left in your cart (only if you have agreed to receive marketing messages).

3.2. Such profiling does not produce legal effects concerning you or similarly significantly affect you. You can opt out of it by withdrawing your consent.

4. Data recipients

4.1. Your personal data is transferred only to the extent necessary for the stated purposes:

  • Parcel services: UAB “Siuntų fabrikas” and the parcel companies it administers (to deliver orders);
  • Payment service provider: AS “Citadele banka” (Klix by Citadele) to make and refund payments;
  • Omnisend (UAB “Omnisend”, Lithuania) to send emails and marketing messages;
  • Google Ireland Limited (Google Analytics, Google Ads) for website traffic analysis and advertising;
  • Meta Platforms Ireland Limited (Facebook Pixel) to measure advertising effectiveness and display advertising;
  • IT service providers: providers of website hosting, maintenance and accounting services;
  • State authorities, where required by law.

4.2. All data processors process data on the Company’s instructions and are required to ensure its security.

5. Transfer of data outside the European Economic Area

5.1. Google and Meta may transfer data to the United States of America. Such transfers are carried out on the basis of the EU–US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

6. Your rights

6.1. You have the right to:

  • receive information about the processing of your data;
  • access your data;
  • require the correction of inaccurate data;
  • require the erasure of data (“right to be forgotten”) when it no longer needs to be stored or when the law does not require it;
  • restrict the processing of data;
  • object to the processing of data when it is based on a legitimate interest or carried out for direct marketing purposes;
  • transfer your data to another controller;
  • withdraw the consent you have given at any time. Withdrawal does not affect the lawfulness of processing carried out before that.

6.2. Please submit requests by email info@dental-spa.lt. We will reply no later than within 1 month of receiving the request. If necessary, we may ask you to confirm your identity.

6.3. If you believe that your data is being processed unlawfully, you have the right to lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, 10312 Vilnius, www.vdai.lrv.lt). We recommend contacting us first so that we can resolve the issue more quickly.

7. Cookies

7.1. Cookies are small text files stored on your device when you visit a website.

7.2. We use the following types of cookies:

Strictly necessary cookies. They are required for the website to work: for the cart, placing an order, logging in and saving your cookie choices. They do not require consent.
Examples: woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*. Validity – until the end of the session or up to 2 days.

Analytics cookies (only with consent). They help us understand how visitors use the website.
Google Analytics: _ga, ga*. Validity – up to 2 years.

Marketing cookies (only with consent). They are used to measure advertising effectiveness and show tailored advertisements.

  • Facebook Pixel: _fbp, _fbc. Validity – up to 3 months.
  • Omnisend: soundest*, omnisend*. Validity – up to 1 year.

7.3. When you visit the website for the first time, a cookie notice is displayed where you can accept all cookies, reject them or choose categories. Analytics and marketing cookies are not stored until you consent.

7.4. You can change your choice at any time by clicking the “Cookie settings” link at the bottom of the website. You can also delete cookies in your browser settings.

8. Data security

8.1. The Company implements appropriate technical and organisational measures to protect your data from unauthorised access, loss, alteration or disclosure: encrypted communication (SSL), restricted access to data and secure passwords.

8.2. After the retention period expires, data is securely deleted or anonymised.

9. Changes to the privacy policy

9.1. The Company may update this privacy policy. The updated version is published in the Store, stating the date of the update. We will inform you of material changes by email or on the website.

10. Contacts

MB Dental SPA
Company code: 306318240
Address: Vėjo g. 11A-13, LT-41163 Biržai, Lithuania
Email: info@dental-spa.lt
Tel. +370 680 55275
Website: dental-spa.lt