Privacy policy

Enquiries and steps before a purchase

We use your name, email, message, selected product and its link to answer your enquiry or prepare a requested offer. The legal basis is taking steps at your request before entering a contract (GDPR Article 6(1)(b)); for other general correspondence, our legitimate interest in responding to messages (Article 6(1)(f)). Your email and message are needed for a reply.

Enquiries that do not lead to a purchase are normally kept for up to 12 months after the last substantive communication. If the message becomes part of an order or dispute, the corresponding retention rule applies. The enquiry form sends messages through Resend to our customer-service Gmail mailbox.

Orders, payments and delivery

To process a purchase we use the buyer or recipient’s name, email, telephone, delivery address, ordered goods, selected delivery service, price, payment status and related correspondence. The legal basis is the purchase contract or requested pre-contractual steps (Article 6(1)(b)). Required fields are marked; without the details necessary to deliver and communicate, we cannot fulfil an order. Notes are optional.

Paysera processes payment information through its own interface and may act as an independent controller under its privacy notice. We receive identifiers, amounts and statuses; we do not receive your full payment-card number or security code. Delivery details needed to quote and carry a shipment may be provided to Alsendo and the selected courier.

Unpaid requests without a dispute are reviewed for deletion after 90 days from expiry or cancellation. Fulfilled-order customer-service records are kept for the contract and applicable guarantee period, normally up to three years after fulfilment, unless accounting or a legal claim requires longer retention.

Invoices and legal obligations

Buyer and transaction details needed for invoices, bookkeeping, tax and statutory consumer obligations are processed under Article 6(1)(c). Where an invoice is issued using Sąskaitos.lt, the necessary buyer, item, amount and tax details are sent to that accounting service. Accountants and competent authorities may receive records when necessary.

Accounting transaction documents are normally retained for 10 years in accordance with Lithuanian record-retention requirements. This period does not mean that every enquiry, abandoned cart or analytics identifier is kept for 10 years. Records subject to a legal preservation requirement are not erased merely because marketing consent is withdrawn.

Withdrawal, complaints and legal claims

We process the details you submit, the statement itself, its reference and receipt timestamp to handle withdrawal, refunds and complaints under Article 6(1)(b) and the applicable legal obligations under Article 6(1)(c). Necessary evidence for establishing or defending legal claims may be retained under our legitimate interest (Article 6(1)(f)).

Withdrawal and complaint correspondence is normally kept for up to three years after closure, subject to a longer accounting duty or an ongoing claim. Acknowledgements are sent through Resend. Our withdrawal form stores the statement and email-delivery status; receipt alone does not automatically change stock, cancel a payment or issue a refund.

Recipients and international transfers

Only data needed for the service is disclosed. Relevant recipients or categories are Paysera for payments; Alsendo and selected couriers for delivery; Sąskaitos.lt and accountants for invoicing; Resend and Google/Gmail for email; the ChatGPT Sites platform and Cloudflare infrastructure for hosting and security; and Google Ireland Limited for optional Analytics. Etsy separately processes marketplace orders under its own policy; we receive the order data needed to fulfil and support those purchases.

Some hosting, email and analytics providers may process data outside the EEA. Applicable transfers must rely on an adequacy decision, including the EU–US Data Privacy Framework where the recipient and transfer qualify, or appropriate safeguards such as the European Commission’s standard contractual clauses. Ask supkkurk@gmail.com for information about the safeguards applicable to your data and how to obtain a copy.

Cookies, browser storage and security

The cart is stored on your device until you remove it or clear browser storage. A recent order receipt may be kept in session storage. Necessary authentication and security storage supports requested functions; it is separate from optional analytics.

Our withdrawal form uses a hashed technical identifier for short-term abuse prevention. Routine operational logs are restricted to security and troubleshooting needs; providers may maintain their own necessary logs under their service policies. Access to customer records is restricted to authorised staff. We do not use a claim of absolute security.

Marketing and automated decisions

A purchase, enquiry or privacy acknowledgement does not opt you into advertising. Any marketing requires a separate valid basis, and you can object to direct marketing at any time. We do not sell customer data or disclose it for another business’s independent marketing.

The shop does not use solely automated decisions producing legal or similarly significant effects about you. Cart availability and delivery calculations support your requested purchase and can be discussed with customer service.

Your rights and how to contact us

Subject to the GDPR conditions, you may request access, correction, erasure, restriction, portability, or object to legitimate-interest processing. You may withdraw consent at any time; this does not affect processing that was lawful before withdrawal. Erasure can be limited by accounting obligations or the need to defend a legal claim.

Send requests to supkkurk@gmail.com. We normally respond within one month; if a lawful extension is needed, we explain it within that first month. We ask only for proportionate identity verification. You may complain to Lithuania’s State Data Protection Inspectorate, L. Sapiegos g. 17, LT-10312 Vilnius, https://vdai.lrv.lt, or a competent authority in your EU country.

Policy changes and practical retention

This policy covers the actual purposes described above, including information received from Etsy or from a buyer arranging delivery to another recipient. We provide the information required for indirect collection where applicable. Our store is directed to adults and does not intentionally request children’s personal data.

Retention limits are applied through periodic review, subject to legal preservation duties and providers’ retention arrangements. Updating this page does not change the purchase terms already agreed for an earlier order. The document version and date identify this publication.

Seller and data controller

MB „Supk Kurk“ · Company code: 306493115

Sodybos g. 26, Šepečių k., Paberžės sen., Vilniaus r., LT-14272, Lietuva

supkkurk@gmail.com

VVTAT · VDAI