Privacy policy

1. General Provisions

1.1. This Privacy Policy (hereinafter referred to as the Policy) explains how MB “Fungimed”, company code 305842286, registered office at Ežero g. 7A, Lentvaris, 25107, Lithuania (hereinafter referred to as we, the Seller, or the Data Controller), collects, uses, stores and otherwise processes your personal data.

1.2. This Policy applies when you visit or shop at our online store www.grybupasaulis.lt (hereinafter referred to as the Website), subscribe to our newsletters, contact us, participate in activities organized by us, or otherwise use our services.

1.3. When processing personal data, we comply with the General Data Protection Regulation (EU) 2016/679 (GDPR), applicable laws of the Republic of Lithuania, and the following core data protection principles:

  • personal data is processed lawfully, fairly and transparently;

  • personal data is collected for specified, explicit and legitimate purposes;

  • only the data necessary for the relevant purpose is collected;

  • personal data must be accurate and, where necessary, kept up to date;

  • personal data is retained no longer than necessary or required by law;

  • appropriate organizational and technical measures are used to ensure the security of personal data.

2. What Personal Data We Collect and Why

2.1. Order Processing

When you purchase products or services through our Website, we may process:

  • your first and last name;

  • company name and other company details, if you are purchasing on behalf of a company;

  • email address;

  • telephone number;

  • billing and delivery address;

  • order information;

  • selected delivery method;

  • information necessary to administer payment and fulfil your order;

  • other information you provide when placing an order.

We process this information in order to accept and fulfil your order, deliver products, administer payments and refunds, and provide customer service related to your order.

Legal basis: entering into and performing a contract with you and, where applicable, compliance with legal obligations.

2.2. Payment Processing

We use third-party payment service providers to process payments made through the Website.

Depending on the payment method you choose, payment service providers may process information necessary to complete and confirm the payment, prevent fraud, and administer the transaction.

We generally do not receive or store your full payment card details. Payment information is processed by the relevant payment service provider according to the payment method you select.

Legal basis: performance of a contract, compliance with legal obligations and, where applicable, our legitimate interest in ensuring payment and e-commerce security.

2.3. Customer Service and Communication

When you contact us by email, through the Website, social media or other channels, we may process:

  • your name;

  • contact details;

  • the content of your communication;

  • order information, where your enquiry relates to an order.

We use this information to respond to your enquiries, resolve issues, administer complaints and provide customer support.

Legal basis: performance of a contract, taking steps prior to entering into a contract, or our legitimate interest in responding to enquiries from customers and Website visitors.

2.4. Newsletters and Direct Marketing

If you subscribe to our newsletter or otherwise provide the relevant consent, we may process:

  • your name;

  • email address;

  • information about your consent;

  • information about your interaction with our newsletters, where such data is collected.

We use this information to send newsletters and information about our products, educational activities, news and offers.

Legal basis: your consent or another legal basis for direct marketing permitted under applicable law.

You can withdraw your consent at any time by using the unsubscribe link included in our newsletters or by contacting us at labas@fungimed.lt.

Withdrawing your consent does not affect the lawfulness of processing carried out before the withdrawal.

2.5. Website Use and Analytics

When you visit our Website, certain technical information may be collected automatically, including:

  • IP address;

  • browser and device information;

  • cookie or similar technology identifiers;

  • pages visited;

  • date, time and duration of visits;

  • information about your interactions with the Website.

This information may be used to ensure the proper operation and security of the Website, identify technical issues, analyse Website use and, where the required consent has been obtained, support marketing and advertising measurement.

3. Shopify Platform

3.1. Our Website and online store operate using the Shopify e-commerce platform.

As a result, when you visit or make a purchase through our Website, some of your personal data may be processed by Shopify and its service providers to the extent necessary to operate the online store, process orders, provide security, enable payments and support other Shopify functionality.

3.2. For customers located in the European Economic Area, personal data processing may involve Shopify International Limited, established in Ireland.

3.3. Shopify and its service providers may process personal data in other countries. Where personal data is transferred outside the European Economic Area, appropriate safeguards required under the GDPR are applied.

More information about how Shopify processes personal data is available in Shopify’s privacy documentation.

4. Who We May Share Your Personal Data With

In order to operate the Website and fulfil your orders, we may share personal data with, or provide access to:

  • Shopify and its service providers;

  • payment service providers;

  • courier and delivery service providers;

  • email and newsletter service providers;

  • IT, hosting, Website maintenance and security service providers;

  • analytics and marketing service providers, where an appropriate legal basis exists;

  • accounting and other professional service providers;

  • public authorities where disclosure is required by law.

We only share the personal data that is necessary for the relevant service or purpose.

5. Transfers Outside the European Economic Area

Some of our service providers, or service providers used by Shopify, may operate outside the European Economic Area.

Where personal data is transferred to a country that has not been recognised by the European Commission as providing an adequate level of data protection, safeguards required by applicable law are used, such as European Commission-approved Standard Contractual Clauses or another lawful transfer mechanism.

6. How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purpose for which it was collected or for as long as required by applicable law.

Retention periods depend on the nature of the data and the purpose for which it is processed.

Information relating to orders, payments, accounting and other legal obligations is retained for the period required under applicable accounting, tax and other laws.

Newsletter and direct marketing data is processed for as long as your consent remains valid or another lawful basis for processing exists, taking into account applicable legal requirements.

Once the applicable retention period expires, personal data is deleted, anonymised or otherwise securely disposed of, unless further retention is required by law.

7. Your Rights

Depending on the circumstances and the conditions set out in the GDPR, you have the right to:

  • access the personal data we process about you;

  • request correction of inaccurate or incomplete personal data;

  • request deletion of your personal data;

  • request restriction of processing;

  • object to certain types of personal data processing;

  • receive personal data you have provided to us in a structured, commonly used and machine-readable format and, where applicable, transmit that data to another controller;

  • withdraw your consent at any time where processing is based on consent;

  • lodge a complaint with the competent data protection supervisory authority.

To exercise any of these rights, please contact us at labas@fungimed.lt.

If we have reasonable doubts about the identity of the person submitting a request, we may ask for additional information necessary to verify their identity.

8. Cookies and Similar Technologies

8.1. We use cookies and similar technologies on our Website.

Some cookies are necessary for the Website to function properly, including cookies used for the shopping cart, checkout, security and user preferences.

Other cookies may be used for:

  • statistics and analytics;

  • analysis of Website use;

  • improving Website functionality;

  • marketing and advertising;

  • measuring advertising effectiveness.

8.2. Where consent is required under applicable law, non-essential cookies are used only after you have provided your consent.

You can manage your cookie preferences through the cookie settings available on the Website and, where applicable, through your browser settings.

You may withdraw or change your consent to non-essential cookies at any time.

9. Social Media

When you interact with us through our social media accounts, the operator of the relevant social media platform may also process your personal data according to its own privacy policy.

We may have access to information that you provide to us or make available through your privacy settings on the relevant social media platform, such as your profile name, comments, messages or other information you choose to share with us.

10. Data Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, destruction, alteration or disclosure.

However, no method of transmitting or storing information online can guarantee absolute security.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time, for example when our technologies, service providers, data processing practices or applicable laws change.

The current version of this Privacy Policy will be published on the Website.

12. Contact Details

Data Controller:

MB “Fungimed”
Company code: 305842286
Registered office: Ežero g. 7A, Lentvaris, 25107, Lithuania
Email: labas@fungimed.lt

If you have any questions about this Privacy Policy or would like to exercise your rights as a data subject, please contact us using the email address above.