Privacy Policy

Why is this privacy policy necessary?

The store “GardenMood”, registered at Dariaus ir Girėno St. 17, Plungė 90121, (hereinafter referred to as the Company or We), cares about your privacy and personal data protection, therefore we process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 of the European Parliament and Council (hereinafter referred to as the Regulation), the Law on Legal Protection of Personal Data, and other legal acts regulating personal data protection. Therefore, to ensure fair and transparent information about the processing of your personal data, we publish this privacy policy (hereinafter referred to as the Policy).

This Policy describes what personal data we collect about you and for what purposes we process it when you browse and/or shop on the website/online store www.gardenmood.lt (hereinafter referred to as the Website or Online Store) or use our services in other ways. This Policy also provides important information about the protection of your personal data, your rights, and how to exercise them. Therefore, please take the time to review this Policy, and if you have any questions, do not hesitate to contact us using the provided contact details. Please note that we reserve the right to change this Policy in the future, so we encourage you to periodically review this Policy.

What are personal data and how are they processed?

Personal data is any information directly or indirectly related to you when your identity is known or can be directly or indirectly identified using relevant data (e.g., name, surname, email address, etc.).

Processing of personal data is any operation performed on personal data (including collection, recording, storage, editing, modification, granting access, submitting inquiries, transferring, archiving, etc.).

When processing your personal data, the Company adheres to the following principles of personal data processing:

• Your personal data is processed only to the extent necessary to achieve the relevant clearly defined and legitimate purposes, taking into account your privacy protection;
• Your personal data is processed accurately, fairly, and lawfully and is processed only for purposes that are consistent with the purposes specified before collecting your personal data;
• Your personal data is processed in strict compliance with the clear and transparent personal data processing requirements set out in legal acts;
• Your personal data is processed only in such a form that your identity can be determined no longer than necessary for the purposes for which the personal data is processed;
• Appropriate technical and organizational measures are applied when processing your personal data to ensure the security of personal data, including protection against unlawful data processing and accidental loss, destruction, and damage.

To whom can your personal data be provided?

We may transfer your order data (including personal data) to third parties (e.g., UAB “Omniva LT”) for processing, providing delivery of your ordered goods or services, provision in stores, or other services related to the proper fulfillment of your order;

We may transfer your personal data to third parties (data processors) who help us administer the Website and/or store data on it, as well as direct marketing service providers. Such persons may include database software providers, database administration service providers, cloud service providers, etc.

Your Data may also be transferred to competent government and/or law enforcement authorities (e.g., courts, police, or other supervisory authorities); legal service providers; insurance companies and/or others. However, your data will only be provided if required by applicable legal acts and only in the manner prescribed by legal acts, to ensure our rights, the safety of our clients, employees, and resources, to assert, provide, and/or defend legal claims.

Please note that your personal data is only provided to those third parties who ensure appropriate personal data processing and protection conditions by contract. Your personal data is not transferred to third parties (i.e., outside the European Union or European Economic Area) or international organizations.

What rights do you have and how can you exercise them?

Data subjects whose personal data we process have the right to:

• request access to their personal data and receive a copy;
• request that inaccurate or incomplete personal data be corrected or restricted;
• request that excessive or unlawfully processed personal data be deleted or restricted;
• object to the processing of their personal data;
  request the transfer of your personal data provided in a structured, computer-readable format (right to data portability);
• the right to withdraw their consent at any time when data processing is based on the data subject’s consent (according to Article 6, Paragraph 1, Point a). Withdrawal of the data subject’s consent does not affect the lawfulness of data processing before the withdrawal;
• submit a complaint to the State Data Protection Inspectorate (ada@ada.lt).

The Company does not apply decisions based solely on automated data processing, including profiling, which could have legal consequences for you or could significantly affect you in a similar way. However, depending on your choices and/or participation in loyalty programs, you may be assigned to a relevant category, based on which we can provide you with the most relevant information (e.g., offers, newsletters, discounts, etc.).

A data subject can exercise their rights by submitting a written request to the Company in person (to a Company employee), by mail, through a representative, or by electronic communication means – by email: meda@gardenmood.lt, in writing – at the address: Dariaus ir Girėno St. 17, Plungė 90121, Lithuania.

When submitting a request, the data subject must confirm their identity in one of the following ways:

• submitting the request to a Company employee, along with a valid identity document;
• submitting the request by mail or courier, along with a valid identity document certified in accordance with legal acts;
• submitting the request electronically, confirmed by electronic communication means that allow proper identification of the person (e.g., mobile signature, qualified electronic signature, etc.).

Upon receiving your request regarding the exercise of data subject rights, we will respond to you without delay, but no later than within 1 month from the date of the request. If necessary, this period may be extended by another month, taking into account the complexity and number of requests. You will be additionally informed about such an extension within one month. The information you request will be provided free of charge. However, if we see that your requests are clearly unfounded or disproportionate, especially due to repetitive content, we have the right to charge a reasonable fee for this (i.e., to require reimbursement of administrative costs) or refuse to take action on such a data subject request.

The response will be provided in the manner you choose in your request. If you do not specify the method by which you wish to receive the response, the response will be sent to you in the same way the request was submitted.

What are your duties and responsibilities?

You are responsible for the accuracy, correctness, and completeness of the personal data you provide. Therefore, you must provide complete, detailed, and accurate information about yourself in the Order or account registration form. If you provide inaccurate, false, or misleading data, we have the right to cancel your registration or order or restrict your ability to use the Online Store. Also, if your personal data changes (which is necessary to achieve the purposes mentioned above), you have the duty to immediately inform the Company about the changed personal data.

By providing your personal data, you assume full responsibility for the legality of providing your personal data and are liable for any losses to us and/or third parties that may arise from the unlawful processing of such personal data.

How do we ensure the security of your personal data?

When processing your personal data, we apply appropriate organizational and technical personal data security measures to protect your personal data from accidental or unlawful disclosure, destruction, alteration, or other unlawful actions. These measures are selected based on the risk to your rights and freedoms as a data subject.

In this case, we ensure strict control of access to processed personal data, so access is granted only to those employees who need your personal data to perform their job functions and monitor how the granted access is used. Access to personal data is ensured using appropriate level passwords and by concluding confidentiality agreements with persons who access your personal data.

We note that all Company employees who have access to your personal data are familiar with personal data protection requirements and must ensure the confidentiality of processed personal data.

Where to contact if you still have questions?

For all inquiries, you can contact us at the email address: meda@gardenmood.lt