PRIVACY POLICY

By means of this privacy policy we inform you of the main principles of the processing of personal data and of the exercise of your rights when using the website www.curlycurly.lt of MB Garbanėlė (hereinafter – the Website).

This privacy policy explains what information we collect, for whom and why, when you visit our Website or use the Services we provide. You will also find detailed information on where the information you provide is used. Data protection is important to us, and we are therefore committed to respecting and safeguarding the privacy of every data subject.

FUNDAMENTALS

1. Definitions

The definitions set out below will make it easier and simpler for you to understand this privacy policy. When we say “we”, “our”, “curlycurly.lt”, “the website”, we mean MB Garbanėlė, having its registered address at Svirplionių g. 11, Neprėkštos k., LT-56382 Kaišiadorių r. sav., Lithuania, legal entity code 306593090, VAT identification number LT100016814819.

When we say “you”, “your”, “Customer”, “user”, “visitor”, we mean a registered user of our website or a visitor to our website who is not necessarily registered.

Personal data – any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and surname, a personal identification number, location data and an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Customer – any person who orders, purchases or uses our services.

Anonymised data – information which no longer relates to a natural person, because all elements permitting the identification of the person have been removed from the set of personal data.

The Services – any products and/or services offered by us, whether by electronic or non-electronic means.

Data subject – means a natural person from whom curlycurly.lt receives and processes personal data.

Disclosure of personal data – the disclosure of personal data by transmitting them or otherwise making them available (with the exception of publication in the mass media).

Processing of personal data – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, sorting, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, as well as alignment or combination, restriction, erasure or destruction.

Automated processing of personal data – data processing operations carried out wholly or partly by automated means.

Special categories of personal data – data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data, health data or data concerning a natural person’s sex life and sexual orientation, by which the identity of a natural person can be established.

Consent – a voluntary indication of the data subject’s wishes to have his or her personal data processed for a purpose known to him or her. Consent to the processing of special categories of personal data must be expressed clearly – in writing, in a form equivalent to writing, or in another form unequivocally proving the data subject’s wishes.

Direct marketing – an activity intended to offer goods or services to persons by post, by telephone or by any other direct means and/or to enquire as to their opinion of the goods or services offered.

Data processor – a legal or natural person (who is not an employee of the data controller) authorised by the data controller to process personal data. The data processor and/or the procedure for its appointment may be laid down in laws or other legal acts.

Data controller – MB Garbanėlė, having its registered address at Svirplionių g. 11, Neprėkštos k., LT-56382 Kaišiadorių r. sav., Lithuania, legal entity code 306593090, VAT identification number LT100016814819.

The Regulation – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, GDPR).

Third party – a legal or natural person other than the data subject, the data controller, the data processor and the persons who are directly authorised by the data controller or the data processor to process data.

This privacy policy applies to curlycurly.lt. When providing the Services, and as described in more detail in the information set out below, we may collect personal information about visitors to our Website.

2. Terms and amendments

Electronic or other copies of this privacy policy shall be deemed to be true, valid, complete, authentic and enforceable copies of this Privacy Policy as in force on the date on which you visited our Website.

We may amend this privacy policy; the date on which the information provided was updated is indicated at the bottom of this page. All amendments take effect immediately from the day of their publication and we will inform you of them on this Website or by any other means; we also encourage you to check for amendments to the Privacy Policy from time to time, and we will regard your continued use of our Website as your consent to our Privacy Policy.

3. Questions and other matters

If you have any questions relating to the terms of this Privacy Policy, we kindly ask you to contact us using the contact details set out below:

MB Garbanėlė

Legal entity code: 306593090
VAT identification number: LT100016814819

Registered address: Svirplionių g. 11, Neprėkštos k., LT-56382 Kaišiadorių r. sav., Lithuania
E-mail: labas@curlycurly.lt
Telephone: +370 677 45363

YOUR INFORMATION

4. What data do we collect?

4.1. Information you provide voluntarily: when you register on our website directly or by using services provided by third parties (Facebook, Google and the like), send us an e-mail, contact us through third-party applications (Facebook, Instagram, etc.), consult our staff in writing, orally or by other means regarding the products sold and/or the services provided, subscribe to the newsletter service, use the comment function on the website, contact us in any other way and voluntarily provide information about yourself. This may be your name, surname, username, physical address, e-mail address, telephone number or bank transfer details. It may also include details such as gender, age, occupation, place of residence, purchase history and other demographic information.

4.2. Information we collect automatically: when you use the Services we provide and browse our website, we collect information about the pages of the website visited and other browsing and activity history and statistics. This may be your IP address, the operating system of your device, your browser ID, your browsing activity and other information relating to your activity on the website or to other Services we provide. Part of this information is collected from log files, as well as with the help of cookies and other tracking technologies.

4.3. Information we receive when you use our Services: when placing an order on the website, you provide your name, surname, telephone number, registration address and delivery address, bank transfer details, details such as gender and age, and other information disclosed by you yourself. In addition, when registering on our website, you provide your e-mail address, name and surname and state your date of birth, which we need in order to make sure that you are not younger than 18 years of age or, being between fifteen and eighteen years of age, have the consent of your parents, adoptive parents or carers, and are entitled under the laws of the Republic of Lithuania to be a registered member of our community.

4.4. Cookies: we and our partners use various technologies to collect information about website usage statistics and browsing activity; these may be technologies such as cookies or technologies of a similar nature, such as pixels or web beacons, used for the analysis of website trends, for website administration and for anonymised demographic statistics about the visitors to the website, and therefore the information obtained does not allow us to identify a specific person. Every visitor can manage in their internet browser how the browser accepts cookies and can refuse to accept any cookies at all. On our website we use our own cookies together with third-party cookies in order to ensure the full functionality of the website and for marketing purposes, in order to show you tailored offers on other platforms (Google, Facebook, Instagram).

5. Where do we use your data?

5.1. For the performance of the sales contract with you: after an order has been placed or the Services provided have been used.

5.2. For sending system e-mails: e-mails relating to your order, changes to the privacy policy, information relating to the operation of the Website, system e-mails relating to the user account, updates and other non-advertising information.

5.3. For communicating with you about your account and your orders and for providing the customer service.

5.4. To protect your rights and privacy and those of ourselves and of third parties.

5.5. For the purpose of establishing, exercising or defending legal claims: to the courts, bailiffs or other authorities to which we are obliged to transfer data in accordance with the applicable laws of the Republic of Lithuania.

5.6. To provide you with automated, tailored offers based on your interests, the products you have viewed and your browsing history.

5.7. For direct marketing purposes: if you voluntarily provide your e-mail address by subscribing to the newsletter, we include you in our database and, several times a month, send you special offers, promotions, news and other information which we consider useful to the e-mail address indicated. In addition, where we hold your e-mail address in our database, if you are a registered user or entered it while placing an order but did not complete the order, we will send you a one-off reminder about the basket you left behind. By using cookies we may also collect information in order to deliver advertising or content intended for a particular browser, creating different target groups.

5.8. For the provision of third-party services: in order to deliver the goods you have ordered, we use third-party services according to the delivery method you select, and therefore the delivery data you provide, such as your name, surname, delivery address and telephone number, are provided to the relevant company, which uses your data in accordance with its privacy policy. When you subscribe to the newsletter, your e-mail address is transferred to the newsletter service provider. Your banking information, money transfers and other payment information are also transferred using a third-party service, except in those cases where you make the transfer yourself after logging in to your bank. You can acquaint yourself with the personal data privacy policy of each company to which we transfer certain personal data of yours on that company’s website.

6. How long do we store your data?

We process the Personal data collected for direct marketing purposes for 2 (two) years, except in cases where longer storage of the data held is mandatory under the legal acts in force in the Republic of Lithuania. Where Personal data are no longer necessary for the purposes of their processing, they are destroyed, with the exception of those which, in the cases laid down by law, must be transferred to the State archives.

7. Your rights:

7.1. to know what data have been collected about you: where a request is received from a person to be provided with the data we have collected about him or her, we provide it within 30 calendar days from the day on which the request was submitted. Every person has the right to find out what information we have collected, to request that it be corrected or that it be erased. If, upon receipt of a request, we have doubts as to the identity or the age of the person making the request, we have the right to ask the person making the request for an identity document or a copy of it.

7.2. to object to your information being used for direct marketing purposes: we do not oblige our customers to receive newsletters or any other advertising information sent by us, and therefore you may freely opt out of this service by logging in to your profile or by clicking the interactive link at the bottom of each advertising e-mail received.

7.3. to be forgotten: unless the Regulation or the legal acts of the Republic of Lithuania provide otherwise, at your lawful request we will erase all the data collected about you from our servers and information system within 4 calendar days, unless this would be impossible or would require disproportionate effort on the part of the Data controllers. Data cannot be erased where their storage is required by the legal acts of the European Union or of the Republic of Lithuania.

7.4. to disagree: you may disagree with our privacy policy; however, since certain data of yours are necessary to us for the performance of the contract and for ensuring the smooth operation of the website, your data are essential to us, and therefore, if you do not agree with our rules, we are unfortunately unable to conclude a sales contract with you and to provide the services we offer.

To exercise your rights, please contact us in writing, in the State language, by e-mail at labas@curlycurly.lt, or submit a request in person or by registered post to Svirplionių g. 11, Neprėkštos k., LT-56382 Kaišiadorių r. sav., Lithuania.

8. Public information and third-party websites/applications

8.1. Blog and comments on the curlycurly.lt website. We have a publicly accessible blog and comment sections in which the information and personal data you provide can be read and collected by anyone. If your personal information has been provided on our website and you wish to have it removed, please contact us using the contact details indicated in this Privacy Policy or on this website. If we are unable to remove it, we will inform you why we cannot do so.

8.2. Social network platforms and related applications. Functions of the services provided by third parties (Facebook, Instagram, Google, etc.) are integrated into our website, and therefore, if you use a Facebook or other third-party login, they may collect information about you and place a cookie in your internet browser so that the services they provide function properly. In addition, we carry out activities on various social networks, and therefore, when communicating with us or sending information using any platform, you do so at your own risk and without any expectation of privacy. We cannot control the actions of other users of those platforms or the actions of the platforms themselves. When using third-party platforms, you are governed by the privacy policies of those companies.

8.3. Links to third-party platforms. Our Website may contain links to other websites whose privacy policy may differ from ours, and therefore, when providing any information or visiting another website, we recommend that you read the privacy policy of those companies carefully.

9. Competitions, games and surveys

From time to time we organise competitions, games, surveys or other promotions on our Website or using social networks (together – “competitions”). Participation in the competitions we organise is entirely voluntary. We may ask you for personal information such as your name, surname, address, date of birth, telephone number, e-mail address, username or other details. We use this information for the administration of the competition. We may also, except in cases where this is prohibited by the rules of the competition or by law, use the information provided to communicate with you or with the persons nominated by you about the services we provide. We may share this information with our affiliates or other service providers, subject to the rules of this Privacy Policy.

10. E-mail content

E-mail is sent between certain servers as it travels over the internet to the recipient. Along the way, the administrators of the servers may see and read your messages. E-mail is not a confidential channel of communication, and we therefore recommend that you do not send confidential information by e-mail.

11. Disclosure of data

We may disclose information about you to our employees, managers, intermediaries, suppliers or subcontractors, where this is reasonably necessary for the purposes set out in this Privacy Policy. In addition, we may disclose information about you:

• where we are obliged to do so by law;
• in order to defend our rights or interests (including the provision of your data to third parties in order to recover debts owed by you to us).

Except as provided in this Privacy Policy, we do not provide your personal data to any third parties.

12. The security of your personal data

Your personal data will be processed in accordance with the requirements laid down by the Regulation, the Law on the Legal Protection of Personal Data of the Republic of Lithuania and other legal acts. When processing your personal data, we implement organisational and technical measures which ensure the protection of personal data against accidental or unlawful destruction, alteration or disclosure, as well as against any other unlawful processing. We store your personal information for archiving purposes for no longer than 10 years or for as long as we are required to comply with legal obligations, resolve disputes and enforce our commitments. We also do so in order to prevent abuse and other unlawful activity.

13. Liability

You are responsible for the confidentiality of your password and user data and for any actions (transfer of data, orders placed, etc.) carried out on our Website after logging in using your login details. You may not disclose your password to third parties. If the services provided on our Website are used by a third party who has logged in to the Website using your login details, we shall consider that it was you who logged in. If you lose your login details, you must inform us of this immediately by post, telephone, fax or e-mail.

You are responsible for ensuring that the data you provide to us are accurate, correct and complete. If the data you have provided change, you must inform us of this immediately by amending the relevant data in the registration form or, where the data are not indicated in the registration form, by informing us by e-mail. We shall under no circumstances be liable for any damage incurred by you as a result of your having indicated incorrect or incomplete personal data or having failed to inform us when they changed.

RULES AND ABUSE

14. Basic rules

In order to use the Services provided by curlycurly.lt, you must:

• be a natural person having legal capacity, not younger than 18 years of age;
• where you are a minor between fifteen and eighteen years of age, have the consent of your parents, adoptive parents or carers, except in those cases where you independently dispose of your earnings or scholarship;
• be a legal person;
• be an authorised representative of any of the persons indicated above.

• complete the registration form, create an account using third-party services, or use the Services by means of the “guest” function;
• agree to the privacy policy and to the website terms of use;
• provide accurate, complete and up-to-date contact information.

By registering on our website or otherwise using the Services we provide, you confirm that you have acquainted yourself with this Privacy Policy and that you agree to it, and at the same time you grant us the right to collect, accumulate, systematise, use and process all the personal data indicated herein for the purposes provided for in this Privacy Policy.

We do not allow accounts whose main purpose is to encourage and to cause harm to others, to incite discrimination or hatred or to distribute offensive content, and we therefore reserve the right to suspend your membership of our website, to delete your account or otherwise to prohibit you from accessing our website.

15. Product reviews

The Website provides the possibility to leave a review of a product. In order to avoid certain problems, spam (junk) and other potentially harmful activity, reviews must be examined and approved by an administrator.

Customers may leave a review only in respect of the product they have purchased. A review may be left only if the customer is a registered user of the curlycurly.lt website.

In order for a review to be approved, it must be constructive, stating what was liked or what was not liked about the product. We reserve the full right not to publish product reviews which are not informative for users or where the review does not correspond to reality and to the applicable legal acts of the Republic of Lithuania. Discounts are awarded for an approved product review to registered users only. The review you leave may be used for advertising purposes.

Since any review of a product provided by you is treated as advertising, when approving reviews we take into account compliance with the Law on Advertising of the Republic of Lithuania, which provides:

Pursuant to Article 1(8) of the Law on Advertising of the Republic of Lithuania: “Advertising means information disseminated in any form and by any means in connection with a person’s commercial, economic, financial or professional activity, encouraging the acquisition of goods or the use of services, including the acquisition of immovable property and the assumption of property rights and obligations.” Consumer reviews are therefore treated as advertising and must comply with the requirements laid down for advertising. Article 17 of the Law on Advertising of the Republic of Lithuania establishes that advertising which does not comply with the provisions of Regulation (EC) No 1223/2009 of the European Parliament and of the Council of 30 November 2009 on cosmetic products is prohibited. It should be noted that the acceptability of a claim used in the advertising of a cosmetic product is assessed by reference to the average end user of the cosmetic product, who is reasonably well informed and reasonably observant and circumspect, taking into account the social, cultural and linguistic factors of the market concerned. It should be emphasised that claims used in the advertising of cosmetic products must be based on truthful information relating to the product: an ingredient referred to in a claim must actually be present in the product, the properties of a specific ingredient must not be attributed to the product, and claims must not suggest that opinions are verified claims where those opinions are not supported by verifiable evidence. Attention should be drawn to the fact that the presentation of a product’s efficacy is based solely on the supporting evidence available. It is prohibited to use in advertising any claims, images or other signs which, figuratively or otherwise, would suggest that cosmetic products have properties or functions which they do not in fact have. Claims used in the advertising of cosmetic products must be based on truthful information relating to the product: an ingredient referred to in a claim must be present in the product, and the properties of a specific ingredient must not be attributed to the product. If it is stated that a product has therapeutic or prophylactic properties, such a product must be registered as a medicinal product or a medical device.