1. General Provisions
1.1. The private limited liability company “Ainhuk”, company registration number 306832003, with its registered office at Audėjų g. 5C, Alytus (hereinafter referred to as the Data Controller), sets out in this privacy policy (hereinafter referred to as the Privacy Policy) the conditions for processing personal data when using the Data Controller’s website www.arvedas.lt (hereinafter referred to as the Website), contacting the Company by any means, visiting the Company’s retail locations, and when the Company pursues other purposes involving data processing. The conditions set out in the Privacy Policy apply each time a person visits the Website, regardless of the device used (computer, mobile phone, tablet, television or other device).
1.2. The Privacy Policy applies to the protection of the personal data of individuals who are prospective employees or customers, including potential, former and current customers (hereinafter referred to as Customers). The Privacy Policy applies to data processing regardless of the format and/or environment in which the Customer provides personal data (on the Data Controller’s website, on paper or by telephone), and regardless of the company systems or paper filing systems in which the data is processed.
1.3. Customers are asked to read this Privacy Policy carefully to ensure that they properly understand the Company’s approach and practices regarding Customers’ personal data and how that data will be processed and protected.
1.4. For the purposes of this Privacy Policy, a data subject is a person making an enquiry, a Customer, a Candidate, a telephone caller or any other individual whose personal data is processed by the Data Controller and who is at least 16 years old. Persons under the age of 16 may not provide any personal data through the Data Controller’s Website. When data is provided by other means, the consent of a parent or other legal guardian must be obtained.
1.5. Enquirer – a natural person interested in the goods or services offered by the Data Controller or wishing to contact the Data Controller about other matters.
1.6. Customer – a person who has purchased goods or services from the Data Controller or entered into a contract with the Data Controller for the supply of goods or services.
1.7. Candidate – a person participating or intending to participate in a recruitment process conducted by the Data Controller.
1.8. Caller – a person calling the contact telephone number provided on the Website regarding the provision of the Data Controller’s services or goods and/or other matters.
1.9. When collecting and processing personal data, the Data Controller takes all reasonable technical and administrative measures to protect the data collected about Data Subjects against loss, unauthorised use and alteration.
1.10. This Privacy Policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the General Data Protection Regulation), the Law of the Republic of Lithuania on the Legal Protection of Personal Data, and other legislation of the European Union and the Republic of Lithuania. The terms used in this Privacy Policy have the meanings defined in the General Data Protection Regulation and the Law of the Republic of Lithuania on the Legal Protection of Personal Data.
2. Purposes of processing personal data
The main purposes for which the Company processes personal data:
2.1.1 By providing the data required for implementation and administration: first name and surname, email address, address and telephone number, the Customer agrees to the processing of this personal data by the Company.
2.1.2. If the Customer does not agree to the Privacy Policy, does not provide the data or requests that data processing cease, the Customer will not be able to participate in the Company’s programme, and the Company will not be able to provide all or some of the requested services or ensure access to all the advantages and benefits of the programme.
2.1.3. The Client's contact details (email address, telephone number, address) will be used to communicate with the Client, including responding to the Client's enquiries and comments, and to send direct marketing offers if the Client consents to receiving such offers.
2.1.4. The information the Company collects and organises about the services and goods the Client purchases using the loyalty card enables the Company to provide personalised offers tailored to the Client's needs.
2.2.Direct marketing purposes
2.2.1. The Company uses and processes the Client's data for direct marketing purposes only if the Client has given consent. Consent to receive direct marketing offers that may benefit the Client can be given when registering on the Website.
2.2.2. After sending a newsletter, the Data Controller may collect statistical data on the Data Subject's behaviour in relation to the use and content of the newsletter (for example, whether the newsletter was read and which links the Data Subject opened).
2.2.3. The personal data of Clients and other Data Subjects is processed on the basis of consent given by providing their data and agreeing to the processing of their personal data for direct marketing purposes (Article 6(1)(a) of the General Data Protection Regulation).
2.2.4. The Data Subject has the right to object to or withdraw their consent to the processing of their personal data for direct marketing purposes at any time, including profiling insofar as it relates to such direct marketing, without giving reasons for their objection.
2.2.5. By clicking the “unsubscribe from the newsletter” link at the end of the newsletter or on the website (if this option is made technically available);
2.2.6. By emailing info@arvedas.lt or calling +370 67-614-614
2.2.7. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
2.3. Purpose of operating the online store and delivering goods (transaction between the parties)
2.3.1. Personal data submitted on the website www.arvedas.lt, administered by the Company, is processed on the basis of a purchase agreement concluded with the purchaser of goods or services. The Client (purchaser) provides, and the Company processes, data relating to the purchase of goods or services: first name, surname, email address, telephone number, address, postcode, payment details (bank, bank account), as well as delivery-related data: preferred delivery time, other information relevant to the courier, and personal data of the person authorised to collect the goods. This data is necessary for the Company to fulfil the Client’s (purchaser’s) order and deliver the goods or provide the services. If the Client (purchaser) does not provide the required data, the Company will not be able to fulfil the order.
2.3.2. The Data Controller may disclose the personal data of Clients and other Data Subjects to Data Processors not specified in this Privacy Policy who provide services to the Data Controller and process the personal data of Clients and Data Subjects on the Data Controller’s behalf. Data Processors may process personal data only in accordance with the Data Controller’s instructions and only to the extent necessary to properly fulfil their contractual obligations. When engaging Data Processors, the Data Controller takes all necessary measures to ensure that the Data Processors have implemented appropriate organisational and technical security measures and maintain the confidentiality of personal data.
2.3.3. The legal basis for processing personal data for the purpose of purchasing the Company’s goods or services is the Data Subject’s consent and/or the performance of a contract with the Data Subject (Article 6(1)(a) and (b) of the General Data Protection Regulation).
2.4.Purpose of recruitment (individuals applying for vacancies at the Company)
2.4.1. The Data Controller processes personal data voluntarily provided by the Candidate for recruitment purposes, to the extent that such personal data has been provided.
2.4.2. Data is obtained directly from candidates and/or from third parties operating job posting websites or from public authorities (for example, the Territorial Labour Exchange). This data is not disclosed to third parties.
2.4.3. Candidates’ data is processed on the basis of consent expressed by submitting their data and for the purpose of taking steps prior to entering into a contract, as implied by the Candidate’s conduct and/or at their request (Article 6(1)(a) and (b) of the General Data Protection Regulation).
2.4.4. Once the recruitment period for a specific position has ended, the Company deletes Candidates’ CVs and other data, unless the Candidate has consented to their personal data being processed for a longer period so that they may be offered a position at a later date.
2.5. Purpose of providing responses and information to Clients
2.5.1. If a Client or Enquirer submits an enquiry to the Company's contact email address or sends an enquiry to a specific Company employee, the Company collects and processes the following data in order to respond appropriately: first name, surname, email address, and the subject and/or comment provided. These data of the Client or Enquirer are processed on the basis of consent expressed by the Client or Enquirer through their conduct. If the Client or Enquirer does not provide the specified personal data, the Company will not be able to respond to the enquiry.
2.6. Purpose of safeguarding the Company's legitimate (justified) interests
2.6.1. To enable the Company, as the data controller, to pursue its legitimate (justified) interests relating to the conduct of its business activities and the protection of its property and employees, the Company intends to process the Client's personal data on the basis of Article 6(1)(f) of the General Data Protection Regulation.
2.6.2. Processing may be necessary to:
2.6.2.1. enable the data controller to conduct its business activities;
2.6.2.2. promote improvements in product or service quality;
2.6.2.3. design and develop new products or services;
2.6.2.4. provide customer service;
2.6.2.5. improve the quality of customer service;
2.6.2.6. review and handle complaints;
2.6.2.7. avoid undue financial risks in the course of its commercial activities (including assessing credit risk when selling services and performing the contract);
2.6.2.8. recover and collect debts;
2.6.2.9. analyse the use of the Data Controller’s websites and develop and implement improvements to them;
2.6.2.10. send other notices relating to the progress of contract performance;
2.6.2.11. prevent fraud;
2.6.2.12. protect its property and employees;
2.6.2.13. apply to public administration and law enforcement authorities and the courts to protect its legal interests.
2.6.3. If the Client’s personal data is used for specific purposes to safeguard the Data Controller’s legitimate (justified) interests, the Client will be informed separately in accordance with the procedure prescribed by law.
2.6.4. Data processing for the Company’s legitimate purposes set out in this section of the Privacy Policy includes the use of video cameras at the Company’s retail locations. This measure is intended to protect the Company’s property, prevent and monitor equipment failures, promptly identify their causes and rectify any damage; ensure the safety of the Company’s employees; and ensure an objective investigation of the circumstances when customer complaints are received regarding damaged or defective goods or products. Special information signs in the monitored areas indicate that video cameras are in use.
2.6.5. The processing of personal data described in this section of the Privacy Policy is not strictly necessary to enter into or fulfil contractual obligations, but is important for the Data Controller’s commercial activities, enabling the Data Controller to ensure effective business management processes and protect its property and employees.
Transfer of data to third countries or international organisations
3.1. The Company may transfer data for processing to third parties that assist the Company in operating and administering the website. Such parties may include database software providers, database administration service providers, direct marketing service providers, couriers, and others. Data may also be disclosed to government or law enforcement authorities, such as the police or supervisory authorities, but only at their request and only where required by applicable law or to protect the Company's rights or the safety of its Customers, employees and resources.
3.2.The Data Controller does not intend to transfer personal data to a third country (a country that is not a member of the European Union or the European Economic Area) or an international organisation, except as provided for in this Privacy Policy.
3.3.If the Data Controller intends to transfer personal data to companies or organisations in third countries, the Data Controller will follow the procedures laid down by applicable legislation to ensure an appropriate level of personal data processing and protection.
Personal data retention period and measures
4.1.The Data Controller applies the following general principles to the retention of the Customer's personal data, under which data is retained for as long as:
4.1.1. the contract concluded with the Customer remains in force;
4.1.2. the Data Controller or the Customer may pursue their legitimate interests in accordance with the procedures laid down by applicable legislation;
4.1.3. there is a legal obligation to retain the data;
4.1.4. the Customer's consent to the relevant processing of personal data remains valid, where there is no other legal basis for processing the data.
4.2. The Data Controller retains the Customer's data for the following periods, according to the specific purposes of personal data processing:
Purpose of personal data processing Retention period
Direct marketing 5 years from the date consent is obtained, unless the Data Subject wishes to extend this period
Online store operations and delivery of goods (transactions between the parties) 10 years from the last contact
Recruitment (of individuals applying for vacancies at the Company) 1 month from the date the CV or other data is received. The Candidate's consent is required to retain their CV and other data for a longer period
Providing responses and information to Customers 1 year from the date of the consultation or fulfilment of the request, except where the Data Subject contacts the Data Controller regarding the provision of services. In such cases, the standard 10-year period applies
Safeguarding the Company's legitimate (justified) interests The retention period depends on the requirements of the applicable legislation but may not exceed 10 years
Processing of Data Subjects' personal data for video surveillance purposes 3 months
4.3. Once the above circumstances no longer apply, the Customer's personal data is deleted.
4.4. Data provided by Customers is stored securely on the Company's servers. When processing Customers' personal data on the Website, the Company uses secure organisational and technical measures that adequately protect Customers' data against accidental or unlawful destruction, alteration, disclosure, and any other possible unlawful activities.
4.5. Where Customers choose passwords that enable them to use certain features of the online store, Customers are responsible for keeping their passwords confidential. The Company asks Customers not to disclose or share their passwords with third parties.
4.6. The Customer must take proactive measures to help ensure the confidentiality of their personal data and must make every effort to prevent third parties from learning their Website login password. The Customer must not disclose it to third parties, directly or indirectly, and must ensure that no third party can use their data to access the Website and/or the services provided by the Company and/or for any other purpose. The Customer is responsible for any actions taken by third parties using the Customer's data, and all obligations and liability arising from or relating to such actions rest entirely with the Customer.
4.7. If the Company has doubts about the accuracy of the personal data provided by the Customer, the Company has the right to suspend the processing of that Customer's data and to verify and correct the data.
4.8. Although the Company makes every reasonable effort to protect Customers' data, the Company notes that data transmitted by electronic means is sent over communications networks operated by electronic communications service providers. The Company therefore cannot guarantee, and is not responsible for, the security and protection of data transmitted in this way. Any data transmission is carried out entirely at the Customer's own risk. Once the data has been received, the Company applies strict procedures for protecting Customers' personal data, together with technical and organisational measures, to ensure protection against unauthorised access to Customers' data.
Data subject rights
5.1.A data subject whose data is processed in the course of the Data Controller's activities has the following rights:
5.1.1. To know (be informed) about the processing of their data (the right to be informed);
5.1.2. To access their data and information on how it is processed (the right of access);
5.1.3. To request that their personal data be corrected or, taking into account the purposes of processing, that incomplete personal data be completed (the right to rectification);
5.1.4. To have their data erased or its processing suspended (except for storage) (the right to erasure and the right to be forgotten);
5.1.5. Has the right to request that the Data Controller restrict the processing of personal data where one of the legal grounds applies (right to restriction);
5.1.6. Has the right to data portability (right to portability);
5.1.7. Object to the processing of personal data where such data is being processed or is intended to be processed for direct marketing purposes, including profiling to the extent that it relates to such direct marketing;
5.1.8. Lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania.
5.2. The Customer may submit a request to exercise their rights by sending a written request to the Data Controller's registered address or an email signed with a secure electronic signature to: info@arvedas.ltKlientas The request must specify the preferred method of communication. Upon receiving such a request or instruction, the Data Controller shall respond and carry out the actions specified in the request or refuse to do so no later than one month from the date of the request. Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests. In such a case, the Data Controller shall inform the Data Subject of the extension within one month of receiving the request, together with the reasons for the delay.
Third-party information on the Company's website
6.1. The Data Controller's website may contain third-party advertising banners and links to third-party websites and services over which the Data Controller has no control. The Data Controller is not responsible for the security and privacy of information collected by third parties. The Customer must read the privacy policies applicable to the third-party websites and services they use.
Use of cookies
7.1. The Company uses cookies in its online store to distinguish customers from other online store users. A registered Customer who is logged in can save products they like, and these will be stored until the user removes them from their wishlist. For Customers who are not logged in, wishlist items are saved by storing data in browser cookies. Wishlist items are stored until the Customer deletes the cookies or refreshes the browser data. In this way, the Company aims to provide a more enjoyable experience for Customers browsing the online store and to improve the online store itself. Cookies used on the www.arvedas.lt website:
Cookie name Cookie purpose (what is it used for?) Data collected Is the data shared with third parties? How long is the cookie stored? Cookie privacy policy
_gat A cookie used to collect statistics on user behaviour.
Browsing data Yes one minute https://policies.google.com/privacy?hl=lt
_ga Browsing data Yes 2 years
_gid This cookie collects and updates information about the website pages you have visited. Yes 24 hours after the session ends
_cfduid A CloudFlare cookie used to identify trusted web traffic. Unique identifier Yes 1 year https://www.cloudflare.com/privacypolicy/
7.2. A Customer who uses a browser to access the content provided on the Website may configure their browser to accept all cookies, reject all cookies or notify them when a cookie is sent. Each browser is different, so its menu must be checked to change the cookie settings. The device's operating system may have additional cookie controls. If the Customer does not want information to be collected through cookies, they must use the procedure available in most browsers to opt out of cookies. To learn more about managing cookies, we recommend visiting: http://www.allaboutcookies.org/manage-cookies/.
7.3. The Company notes that, in some cases, deleting cookies may slow down web browsing, limit certain Website functions or block access to the Website and/or the services provided.
8. Newsletter subscription
8.1. When registering on our website, users are automatically subscribed to an email newsletter containing news, promotions and special offers.
8.2. Users may unsubscribe from the newsletter at any time by using the relevant link in the email or changing their account settings.
9. Other terms
9.1.The Data Controller has the right to make additions to the Privacy Policy by publishing them on the Data Controller's website.
9.2.This Privacy Policy and any subsequent amendments apply from the date they are published on the Website.
9.3.Customers' questions, comments and requests regarding the Privacy Policy should be sent to the email address info@ainhuk.lt,
9.4.Company contact details:
Ainhuk, UAB
Company registration number 306832003
VAT number LT100016982910
Email address info@ainhuk.lt