Privacy policy

This policy explains how Valesa handles personal data when you use the store, create an account, place an order, contact us or choose to receive marketing.

Controller and contact

Valesa is the controller for the processing described here. Privacy requests and questions can be sent to info@valesa.lt. The store owner must keep the controller’s full legal identity, registration details and address current in the company settings and customer-facing order documents.

Data we process

Depending on how you use the store, we may process your name, contact details, delivery and billing address, account credentials, order and return history, product preferences, marketing choices, messages, payment status and limited transaction references received from payment providers. We also process technical information such as IP address, device and browser information, security logs, consent choices and website usage where permitted.

Payment card or bank credentials are handled by the selected payment provider. We do not need to store full card details in the store database.

Why we use data

We process data to create and fulfil contracts, take payment, deliver orders, manage accounts, returns and customer service, maintain security and prevent fraud, comply with tax, accounting and consumer-law duties, establish or defend legal claims, improve the store based on legitimate interests, and send electronic marketing where you have consented or another lawful basis applies.

Where processing is based on consent, including optional analytics, marketing technologies or newsletters, you may withdraw consent at any time without affecting earlier lawful processing.

Who receives data

We disclose only what is necessary to providers supporting hosting and infrastructure, payment processing, delivery and parcel services, email and customer communications, analytics or advertising enabled by your consent, professional advisers and public authorities where the law requires it. These providers act under their own legal duties or contractual data-protection obligations.

If a provider processes data outside the European Economic Area, we use an available lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or standard contractual clauses, where required.

How long we keep data

We keep order, payment, invoice and accounting records for the period required by applicable tax and commercial law. Account data is retained while the account is active and for a reasonable period afterwards. Customer-service, return, security and dispute records are kept only as long as needed for those purposes and legal claims. Marketing data is kept until consent is withdrawn, an objection is made or the information is no longer needed. Technical logs and consent records are retained for proportionate security and compliance periods.

Your rights

Subject to legal conditions, you may request access, correction, deletion, restriction, portability or a copy of your data, and object to processing based on legitimate interests or direct marketing. You may withdraw consent and complain to the Lithuanian State Data Protection Inspectorate at vdai.lrv.lt, or to the supervisory authority where you live or work.

We may need to verify your identity before acting on a request. Some information cannot be deleted immediately where retention is required by law or necessary to resolve disputes and protect legal rights.

Security, children and updates

We use organisational and technical measures intended to protect personal data, while recognising that no online system can guarantee absolute security. The store is not directed to children who cannot lawfully enter a purchase contract or provide relevant consent. We may update this policy when services, providers or legal requirements change; material changes will be communicated where required.