Privacy Policy

Last updated: 29 January 2026

We understand the importance of protecting personal data, so we process your personal data lawfully, transparently and fairly. This Privacy Policy explains how the kama.lt online store collects, uses and protects your personal data.

This policy has been prepared in accordance with the GDPR (EU Regulation 2016/679), the Lithuanian Law on Legal Protection of Personal Data and the Lithuanian Law on Electronic Communications.

1. Who controls your personal data?

  • Name: Martynas Čirvinskas
  • Individual activity registration: No. 1483185

2. What personal data do we collect?

2.1. Order and purchase data

  • First name and surname
  • Delivery address
  • Email address
  • Phone number
  • Order history

2.2. Payment data

  • Selected payment method

Important: Payment card details are processed by payment service providers. We do not see or store card details.

2.3. Technical (browsing) data

  • IP address
  • Browser type and version
  • Device type
  • Browsing data collected through cookies

3. Why do we process your data?

3.1. Entering into and performing a contract (GDPR Article 6(1)(b))

We process data to accept and fulfil your order, deliver goods and communicate about your order.

3.2. Legal obligation (GDPR Article 6(1)(c))

We process data where required by law: invoicing, accounting and tax administration.

3.3. Legitimate interest (GDPR Article 6(1)(f))

We process data where necessary for our operations: customer service (enquiries and complaints), website security and operation, and statistical analysis (anonymised where possible).

3.4. Consent (GDPR Article 6(1)(a))

We process data when you give explicit consent: sending newsletters and using non-essential cookies (functional, analytics and marketing).

4. Who may receive your data?

  • Courier services — to deliver goods
  • Payment operators — to process payments
  • Public authorities — only where required by law

Our partners undertake to protect your data in accordance with GDPR requirements.

5. Is your data transferred outside the EU/EEA?

When we use the Shopify platform, your data may in some cases be processed or stored outside the European Economic Area:

  • Canada: the European Commission's adequacy decision (2002/2/EC) applies.
  • USA: data may be transferred under Standard Contractual Clauses (SCCs) pursuant to European Commission Decision 2021/914.

6. Cookies

Our website uses cookies — small text files that help the website operate.

6.1. Types of cookies

  • Essential: needed for the website, shopping cart and session.
  • Functional: remember your choices and settings.
  • Analytics: help us understand visitor traffic (for example, Google Analytics).
  • Marketing: used for advertising and personalisation.

6.2. Consent

Essential cookies do not require consent. Other cookies are used only after you consent through the cookie notice. You may withdraw consent at any time in the cookie settings or your browser.

7. Direct marketing (newsletters)

We send newsletters only with your consent. You may consent when placing an order or subscribing to the newsletter on the website. Every email includes an “Unsubscribe” link. You can also unsubscribe by writing to info@kama.lt.

Note: Unsubscribing from newsletters does not affect order notifications, such as confirmations and delivery information.

8. Your rights (GDPR)

Under the GDPR, you have the right to:

  • Access your data (Article 15)
  • Correct inaccurate data (Article 16)
  • Have data erased — the “right to be forgotten” (Article 17)
  • Restrict processing (Article 18)
  • Data portability (Article 20)
  • Object to processing (Article 21)
  • Withdraw consent at any time (Article 7(3))

How can you exercise your rights?

Email info@kama.lt with your first name, surname and the right you wish to exercise. We normally respond within 30 days.

9. Right to lodge a complaint

If you believe your rights have been infringed, you may complain to the State Data Protection Inspectorate (VDAI):

10. How long do we retain your data?

  • Orders and invoices: 10 years (accounting requirements)
  • Warranty data: warranty period plus 3 years
  • Marketing consent: until consent is withdrawn
  • Account data: while the account is active, plus 3 years
  • Cookie data: according to the cookie's expiry period

At the end of the retention period, data is erased or anonymised.

11. How do we protect your data?

We apply technical and organisational measures to protect data:

  • SSL/TLS encryption (HTTPS)
  • Secure access to systems
  • Access rights control
  • Periodic security assessments

Payment card details are processed by PCI DSS-compliant payment operators. We do not store them.

12. Minors' data

The store is not intended for people under 14. We do not knowingly collect data about people under 14. If you are under 18, you may purchase only with the consent of a parent or guardian.

13. Changes to the Privacy Policy

We may update this Policy from time to time. The latest version is always published on the website, with the update date shown at the top.

14. Contact

If you have questions about this Privacy Policy or the processing of your personal data: