Privacy Policy

Applicable to online stores: https://www.lula.lt and https://www.lulata.eu
Last updated: 2026-05-18

GENERAL INFORMATION

This privacy policy explains how UAB "Lulata" collects, uses, stores, and processes your personal data when you visit our online stores, purchase goods, contact us, create an account, subscribe to newsletters, or otherwise use our services.

Data Controller:

UAB "Lulata" Company code: 305340255 VAT number: LT100012775116 Registration address: Želmenų g. 2, Vilnius, LT-14269, Lithuania Email: info@lula.lt Phone: +370 676 11495

This privacy policy has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other applicable legal acts.

WHAT PERSONAL DATA WE PROCESS

Depending on how you use our store, we may process the following data:

Order and delivery data:

  • first name, last name;
  • email address;
  • phone number;
  • delivery and/or billing address;
  • chosen delivery method, parcel machine or delivery location;
  • ordered goods, their quantities, price, discounts, order total;
  • payment status and payment method;
  • invoice details, if required.

Account data:

  • first name, last name;
  • email;
  • phone number;
  • login details;
  • order history;
  • wishlist, if you use this feature.

Communication data:

  • your inquiries, comments, claims, return requests;
  • content of correspondence;
  • information you provide via email, phone, or contact forms.

Newsletter and marketing data:

  • email address;
  • consent to subscribe to the newsletter fact and date;
  • newsletter unsubscribe fact;
  • campaign statistics, if we use such tools.

Technical and cookie data:

  • IP address;
  • browser and device information;
  • visit time, pages, cart session;
  • cookie preferences;
  • technical data necessary for the website's operation, security, and analytics.

FOR WHAT PURPOSES AND LEGAL GROUNDS WE PROCESS DATA

Order execution and delivery of goods. We process your data to accept, confirm, process, package, and deliver the order, inform about its status, accept payment, and provide customer service. Legal basis: performance of a contract or actions prior to entering into a contract.

Payment administration. Payments may be processed through MakeCommerce / Maksekeskus AS or other payment service providers. Only the data necessary to initiate, confirm, and link the payment to the order is transferred to the payment service provider. Legal basis: performance of a contract and legal obligation to process accounting data.

Invoices, accounting, and legal obligations. We process data for accounting, tax calculation, invoicing, legal obligations compliance, and document storage. Legal basis: legal obligation.

Customer service, returns, and claims. We process data in response to inquiries, addressing delivery, quality, return, warranty, or other order-related issues. Legal basis: performance of a contract, legal obligation, and legitimate interest to defend our rights.

Account administration. If you create an account, we process your data so you can view order history, make purchases faster, and use other account features. Legal basis: performance of a contract.

Direct marketing. We send newsletters only when you have given consent or when applicable laws allow informing existing customers about similar products, providing a clear opportunity to unsubscribe at any time. Legal basis: consent or legitimate interest when permitted by law.

Website security and operation assurance. We process technical data to ensure the website operates securely, is protected from abuse, technical errors, and illegal actions. Legal basis: legitimate interest.

Analytics and non-essential cookies. Statistics, analytics, marketing, or similar non-essential cookies are used only with your consent, if such consent is required by law. Legal basis: consent.

WHOM WE SHARE YOUR DATA WITH

We may share your data only to the extent necessary for the specified purposes:

  • payment service providers, e.g., MakeCommerce / Maksekeskus AS;
  • delivery service providers, e.g., Omniva, LP Express / Unisend, couriers or postal service providers;
  • IT, hosting, website maintenance, and security service providers;
  • accounting service providers;
  • email and customer service tool providers;
  • state authorities when required by law;
  • legal consultants, auditors, or debt collection entities if necessary to defend our rights.

We do not sell your personal data to third parties.

DATA RETENTION PERIODS

We retain data no longer than necessary for the purposes for which it was collected, or as required by law:

  • order and contract execution data: up to 10 years, related to accounting and tax documents;
  • invoices and accounting documents: for the periods established by law;
  • account data: as long as the account is active or until you request its deletion, if there is no legal basis to retain the data longer;
  • customer inquiries and claims: generally up to 3 years from the completion of the inquiry or longer if necessary to resolve the dispute;
  • newsletter consents: as long as the consent is valid and as long as necessary to substantiate the consent fact;
  • cookie data: according to the terms specified in the cookie settings.

YOUR RIGHTS

You have the right to:

  • access your personal data;
  • request correction of inaccurate or incomplete data;
  • request deletion of data when there is a basis for it;
  • request restriction of data processing;
  • object to data processing when processed on the basis of legitimate interest;
  • withdraw consent when data is processed on the basis of consent;
  • receive your data in a structured, commonly used, and machine-readable format, where applicable;
  • file a complaint with the State Data Protection Inspectorate.

To exercise your rights, please write to info@lula.lt. We will respond within the timeframes established by law. In certain cases, we may ask you to verify your identity.

COOKIES

Our website uses cookies and similar technologies.

Essential cookies are used to ensure the website functions properly: for the cart, login, language selection, security, and order processing. No separate consent is required for these cookies.

Non-essential cookies, such as analytical, marketing, or additional functionality cookies, are used only with your consent, if such consent is required by law.

You can change your cookie preferences in the cookie management window provided on the website or in your browser settings. Refusing certain cookies may limit some website functionalities.

DATA SECURITY

We implement organizational and technical security measures to protect your data from unauthorized access, loss, alteration, or disclosure. However, no information transmitted over the internet can be completely protected from all possible risks, so please safeguard your login details and do not disclose them to third parties.

THIRD-PARTY LINKS

The website may contain links to third-party websites or services. We are not responsible for their privacy practices. We recommend reviewing the privacy policies of those websites.

CHANGES TO THE PRIVACY POLICY

We may update the privacy policy when laws change, our activities, website features, or data processing processes change. The latest version of the privacy policy is always published on the website.

CONTACTS

If you have questions regarding privacy or personal data processing, please contact:

UAB "Lulata" Želmenų g. 2, Vilnius, LT-14269, Lithuania Email: info@lula.lt Phone: +370 676 11495

Payment service provider (Stripe)

For card payments in our store we use the payment service provider Stripe. When you choose to pay by card, Stripe may process payment-related data (such as amount, currency, payment status, your contact details and other information needed to complete the payment). We do not store full payment card details. For more information about how Stripe processes data, see Stripe's privacy policy: https://stripe.com/privacy.