Why is this privacy policy needed?

The store “GardenMood”, registered address Dariaus ir Girėno g. 17, Plungė 90121, (hereinafter referred to as the Company or We), cares about your privacy and the protection of personal data, therefore we process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter referred to as the Regulation), the Law on the Legal Protection of Personal Data and other legal acts regulating the protection of personal data. Therefore, in order to ensure fair and transparent information about the processing of your personal data, we publish this privacy policy (hereinafter referred to as the Policy).

This Policy describes what personal data we collect about you and for what purposes we process it when you browse and/or shop on the website/e-shop www.gardenmood.lt (hereinafter referred to as the Website or E-shop) or use our services in other ways. This Policy also provides important information about the protection of your personal data, your rights and how to exercise them. Therefore, be sure to take the time to review this Policy, and if you have any questions, do not hesitate to contact us using the contacts provided. Please note that we reserve the right to change this Policy in the future, so we encourage you to periodically review this Policy.

What is personal data and how is it processed?

Personal data is any information relating directly or indirectly to you, where your identity is known or which can be directly or indirectly identified using the relevant data (e.g. name, surname, email address, etc.).

Processing of personal data is any operation performed on personal data (including collection, recording, storage, editing, modification, provision of access, submission of requests, transfer, archiving, etc.).

When processing your personal data, the Company adheres to the following principles of personal data processing:

• Your personal data is processed only to the extent necessary to achieve the relevant, clearly defined and legitimate purposes, taking into account the protection of your privacy;
• Your personal data is processed accurately, fairly and lawfully and only for purposes that are consistent with the purposes stated before your personal data was collected;
• Your personal data is processed in strict accordance with the clear and transparent requirements for personal data processing set out in legal acts;
• Your personal data is processed only in a form that allows you to be identified for no longer than is necessary for the purposes for which the personal data are processed;
• When processing your personal data, appropriate technical and organizational measures are applied to ensure the security of personal data, including protection against unlawful data processing and against accidental loss, destruction and damage.

To whom may your personal data be provided?

We may transfer your order data (including personal data) to third parties for processing (e.g. UAB “Omniva LT”), providing E-mail, delivery of your ordered goods or services, provision in stores or other services related to the proper fulfillment of your order;

We may transfer your personal data for processing to third parties (data processors) who help us administer the Website and/or store the data contained therein, as well as to direct marketing service providers. Such persons may be database software providers, database administration service providers, cloud service providers, etc.

Your Data may also be transferred to competent government and/or law enforcement authorities (e.g. courts, police or other supervisory authorities); legal service providers; insurance companies and/or others. However, Your Data will only be provided if required by applicable law and only in accordance with the procedure established by law, in order to ensure Our rights, the safety of Our customers, employees and assets, and to assert, present and/or defend legal claims.

Please note that your personal data is provided only to third parties that contractually ensure appropriate conditions for the processing and protection of personal data. Your personal data is not transferred to third countries (i.e. outside the European Union or the European Economic Area) or international organizations.

What rights do you have and how can you exercise them?

Data subjects whose personal data we process have the right to:

• request access to your personal data and receive a copy of it;
• to request that inaccurate or incomplete personal data be corrected or restricted;
• to request that excessive or unlawfully processed personal data be erased or restricted;
• object to the processing of his/her personal data;
  request the transmission of your personal data provided in a structured, machine-readable format (right to data portability);
• the right to withdraw your consent at any time, where the processing is based on the data subject's consent (pursuant to Article 6(1)). The withdrawal of the data subject's consent does not affect the lawfulness of the processing prior to the withdrawal of consent;
• file a complaint with the State Data Protection Inspectorate (ada@ada.lt).

The Company does not apply decisions based solely on automated data processing, including profiling, which may produce legal consequences for you or which could significantly affect you in a similar way. However, depending on your choices and/or participation in loyalty programs, you may be assigned to the appropriate category, according to which we will be able to provide you with the most relevant information (e.g. offers, newsletters, discounts, etc.).

The data subject may exercise his or her rights by submitting a written request to the Company in person (to an employee of the Company), by mail, through a representative or by electronic means – by e-mail: meda@gardenmood.lt, in writing – to the address: Dariaus ir Girėno g. 17, Plungė 90121, Lithuania.

When submitting a request, the data subject must confirm their identity in one of the following ways:

• submitting a request to an employee of the Company, along with a valid personal identification document;
• by submitting an application by mail or courier, together with a valid personal identification document, certified in accordance with the procedure established by law;
• submission of the application electronically, confirmation by electronic means of communication that allows for proper identification of the person (e.g., mobile signature, qualified electronic signature, etc.).

Upon receipt of your request for the exercise of data subject rights, we will provide you with a response without delay, but no later than 1 month from the date of your request. If necessary, this period may be extended by another month, taking into account the complexity and number of requests. You will be additionally informed of such an extension within one month. The information you request will be provided free of charge. However, if we see that your requests are manifestly unfounded or disproportionate, in particular due to repetitive content, we have the right to charge a reasonable fee for this (i.e. to claim reimbursement of administrative costs) or to refuse to take action on such a data subject request.

The response will be provided in the manner selected in your request. If you do not specify the method in your request that you would like to receive the response, the response will be sent to you in the same way that the request was submitted.

What are your duties and responsibilities?

You are responsible for the accuracy, correctness and completeness of the personal data you provide. Therefore, you must provide complete, complete and correct information about yourself in the Order or account registration form. If you provide inaccurate, false or misleading data, we have the right to cancel your registration or order or restrict your access to the e-store. Also, if your personal data (which are necessary to achieve the above-mentioned purposes) changes, you are obliged to immediately inform the Company about the changed personal data.

By submitting your personal data, you assume full responsibility for the legality of the submission of your personal data and are liable for any losses incurred by Us and/or third parties that may arise from the unlawful processing of such personal data.

How do we ensure the security of your personal data?

When processing your personal data, we apply appropriate organizational and technical personal data security measures to protect your personal data against accidental or unlawful disclosure, destruction, alteration or other unlawful actions. The aforementioned measures are selected taking into account the risk to your rights and freedoms as a data subject.

In this case, we ensure strict control over access to the personal data we process, therefore we provide access to it only to those employees who need your personal data to perform their job functions and monitor how the granted access is used. Access to personal data is ensured by using appropriate level passwords and concluding confidentiality agreements with persons who access your personal data.

We note that all employees of the Company who have access to your personal data are familiar with the requirements for personal data protection and must ensure the confidentiality of the personal data being processed.

Where to go if you still have questions?

For all questions, you can contact us at the following e-mail address: meda@gardenmood.lt