Privacy policy

01Who is responsible for your data?

The controller is Enrika Motuzaitė, individual activity certificate no. 703286, trading as Šilkinis balionėlis. Privacy contact: info@silkinisbalionelis.lt.

This policy covers the new WordPress / WooCommerce shop. Visiting the website or reading this policy does not constitute consent to marketing or unrestricted data use.

02What we process and why

Orders and delivery: name, email, phone, delivery and billing details, purchased goods, personalisation text and uploaded photos. Legal basis: contract performance or steps you request before a contract (GDPR Article 6(1)(b)).

Enquiries: name, email, message and optional celebration date or order number. For general questions, our legitimate interest in responding to customers applies (Article 6(1)(f)); for order-specific requests, Article 6(1)(b).

Account: email, login credentials and order history. Passwords are hashed rather than stored as readable text. Guest checkout is available.

Accounting: transaction and payment records are processed to meet legal obligations (Article 6(1)(c)). We do not process full payment card numbers or security codes on the site; bank transfers are handled by your bank.

Security: IP addresses, technical logs and short-lived request-limiting identifiers help prevent abuse (legitimate interest, Article 6(1)(f)). We do not use automated decisions with legal or similarly significant effects on you.

Private customers do not need to provide a home address for parcel lockers, bus parcels or collection. Company invoices also require a company name, registration number, invoice address and, if supplied, VAT number. The home-delivery address is collected separately from the company invoice address. We do not request a personal identification number at checkout.

03Personalisation photos and text

Upload only photos needed for the order that you have the right to use. Do not send identity documents, bank cards or unnecessary sensitive information.

Order photos are used to make your gift; they are not automatically published in product galleries or on social media. Your personal message is kept as entered and is not automatically translated. Advertising use of a gift displaying identifiable personal information needs a separate lawful basis, such as your consent.

04Reviews and social media

The review form collects first name, rating, text, original language and the publication-consent date. Reviews are checked before publication; this form does not request an email address. Publication is based on consent (Article 6(1)(a)), which you can withdraw by contacting us.

Facebook recommendations show a first name, small public profile photo, recommendation and source link. Contact us to request correction or removal. Public availability on Facebook does not remove your rights; the basis for republication must be assessed separately.

Instagram and Facebook links take you to another platform governed by its privacy policy. Messages sent there are also processed by that platform’s operator.

05Who may receive data?

Only as needed: hosting and technical support providers, email provider, the selected carrier, accounting personnel and authorities where legally required. The site is hosted by Hostinger; Google Gmail is used for communication; delivery uses bus parcel services or LP EXPRESS / another agreed locker carrier.

Google automatic translation is for shop content. Customer photos, contact enquiries and personal messages are not included in this automatic translation function.

Processing outside the European Economic Area requires a valid adequacy decision or appropriate safeguards, such as European Commission standard contractual clauses. Provider contracts, locations and transfer mechanisms must be confirmed before the final policy is published.

06How long is data kept?

Proposed periods for review: enquiries — 12 months after the last communication; order-personalisation photos — 90 days after fulfilment; unpublished reviews — 6 months. These periods must be approved and matched to actual deletion procedures before live publication.

Published site reviews — until consent is withdrawn or no longer needed, with annual relevance checks. Accounts — while in use; after deletion, only records required by law or a specific dispute remain. Exact order, accounting and server-log retention periods must be set according to record types and provider settings.

Data needed for a specific dispute may be retained until resolution or expiry of the relevant limitation period. Deleted data may remain in backups until rotation completes and is not used for normal operations. The backup rotation period must be confirmed.

07Cookies and browser storage

Session, basket, login, language and preference data support the site’s functions. WooCommerce may use woocommerce_items_in_cart, woocommerce_cart_hash and wp_woocommerce_session_*; WordPress login uses wordpress_logged_in_* and wordpress_sec_*. WooCommerce sessions default to 2 days unless changed; basket flags generally last for the browsing session.

WoodMart’s woodmart_cookies_* cookie remembers dismissal of its notice for 60 days. The “Accept” button alone does not provide valid consent management for optional analytics or advertising. Search history, if enabled, may remain in localStorage until cleared.

Storage strictly necessary for a function you request does not need consent. Optional analytics, advertising and embedded social services require a prior choice, refusal and withdrawal options. The final list and durations must be audited on the actual site before publication. You can clear cookies and browser storage in browser settings.

08Your rights and requests

You may request access and a copy, correction, erasure, restriction, portability where applicable, or object to processing based on legitimate interests. Consent can be withdrawn at any time without affecting prior lawful processing.

Email info@silkinisbalionelis.lt. We may request proportionate identity verification. We respond within one month; for complex requests, this may be extended by up to two further months, with reasons explained during the first month.

Some data cannot be deleted immediately if law or a legal claim requires retention. You may complain to Lithuania’s State Data Protection Inspectorate (vdai.lrv.lt).

09Policy updates

We update this policy and its date when site functions or processing change. If a new use requires consent, we request it separately; continuing to browse does not replace consent.