Here we describe in plain terms what data of yours we process, why, who we share it with and how long we keep it. We write about cookies in more detail in the Cookie policy.
1. Who processes your data
Data controller:
- Jonas Jakštas, sole proprietor under individual activity certificate no. 479100
- Žemaičių Kalvarijos g. 7, Barstyčiai, LT-98227, Lithuania
- Telephone: +370 661 06399
Contact us by e-mail at hello@ryytas.lt. Rýytas is a brand. This policy applies to the websites ryytas.lt, ryytas.lv, ryytas.lv/en and ryytas.lt/ee. We do not have a data protection officer.
2. What data, why and for how long
| What we use it for | What data | Legal basis | How long we keep it |
|---|---|---|---|
| Fulfilling and delivering the order | first name, surname, e-mail, telephone, chosen parcel locker, goods ordered, amount | performance of a contract | together with the accounting documents, 10 years |
| Payment | payment method, payment confirmation. We do not receive card or bank login details | performance of a contract | together with the accounting documents |
| Subscription | the same order data, subscription interval, next charge date | performance of a contract | while the subscription is active, afterwards together with the accounting documents |
| Accounting and taxes | orders, invoices, refunds | legal obligation | 10 years |
| Customer service | your e-mails and our replies, related orders. An artificial intelligence tool may help prepare a draft reply; a human approves every reply | performance of a contract and legitimate interest in answering your enquiry | 10 years from the last correspondence |
| Account (if you created one) | e-mail, password (encrypted), order history | performance of a contract | until you delete the account |
| Service e-mails about your order | e-mail, first name, order, shop language | performance of a contract | together with the order |
| Newsletter | e-mail, language, whether you open e-mails | consent | until you withdraw your consent |
| E-mails to buyers about similar products of ours | e-mail, first name, goods bought, language | our legitimate interest; the law allows this for our own buyers if they have not objected (Article 81(2) of the Law on Electronic Communications) | until you object |
| Website statistics | Google Analytics visitor and session IDs, pages viewed | consent (statistics cookies) | Google Analytics data 14 months; IDs stored with the order 90 days |
| Measuring advertising results | ad click identifiers (gclid, fbclid), campaign UTM tags, encrypted contact details (see section 4) | consent (marketing cookies) | click identifiers 90 days, UTM tags 13 months |
| Counting sales and measuring advertising results (Google Analytics purchase signal from the server) | order number, amount, currency, goods, discount code, payment method, pseudonymous customer ID; no name or e-mail (see section 4) | legitimate interest in counting sales and measuring advertising results; you may object (see section 8) | 14 months |
| Website operation and security (visit log) | 30-minute visit ID, pages viewed, technical events | legitimate interest in ensuring the website and cart work | 14 days |
| Cookie choice | your choice and when you made it | legal obligation to prove consent | cookie 6 months; the choice stored with an order, together with the order |
| Preventing abuse of the taste guarantee | order data we already hold: name, e-mail, phone, delivery address, orders and returns | our legitimate interest in preventing abuse of the guarantee and fraud (GDPR Art. 6(1)(f)); you may object (see section 8) | together with the order and the accounting records |
We do not collect date of birth, sex or age. For an order we need only the data required to deliver and pay for the goods. Without it we cannot fulfil the order.
We do not take automated decisions that have legal consequences for you.
3. Newsletter and e-mails
- You receive the newsletter only if you subscribed yourself, for example by ticking "I want to receive news and offers by e-mail" on the checkout page, and confirmed the subscription in an e-mail.
- Every newsletter contains an unsubscribe link. You can also write to hello@ryytas.lt.
- Persons aged 14 and over may subscribe to the newsletter.
- For every order, the buyer's e-mail, first name, order contents and shop language are passed to Klaviyo so that we can send e-mails about the order in your language.
- If you bought from us, even without subscribing to the newsletter, after the purchase we may write to you about similar products of ours. The Law on Electronic Communications, Article 81(2), allows this because we obtained your e-mail when we sold you the goods. We tell you this on the checkout page. You can object at any time: by clicking the unsubscribe link in any e-mail or by writing to hello@ryytas.lt.
4. What we pass to advertising and statistics platforms
We say this openly because these data flows are not visible by themselves.
If you did not accept statistics or marketing cookies. The Google tag still sends Google cookieless signals without identifiers (time, page, browser type, your choice) so that Google can model statistics.
Every paid order, even if you did not accept cookies. For every paid order and subscription renewal, our server sends a Google Analytics purchase signal. It is received by Google Ireland Limited, and the data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework.
- What is sent: order number, amount, shipping cost, currency, goods, discount code, payment method and a pseudonymous customer ID. If you accepted statistics cookies, this is your Google Analytics ID. If you did not, an ID generated from the order is used, which is not linked to your browser.
- What we do not send: name, e-mail, telephone and address.
- Why: so that we know how much we sell and can evaluate advertising results. The signal for a first purchase (not a renewal) is also used to count Google Ads conversions.
- Basis: our legitimate interest. You have the right to object: write to hello@ryytas.lt. We will examine your objection and reply within 1 month at the latest, as Article 21 of the GDPR provides.
If you accept marketing cookies.
- The Meta (Facebook, Instagram) pixel and Conversions API pass to Meta which pages and goods you viewed, what you added to the cart and what you bought.
- Your e-mail, telephone, first name, surname, city, region, postcode, country and an external identifier are passed along with this, encrypted with irreversible SHA-256 hashing. This lets Meta recognise its own user but not read these data. The Meta browser identifiers from the cookies _fbp and _fbc are also passed. Events sent from the server also include the IP address and browser type.
- With the order we store ad click identifiers (gclid, fbclid) and campaign UTM tags. We delete click identifiers after 90 days and UTM tags after 13 months.
- Google Ads uses its own cookies to link an ad click with a purchase.
If you accept statistics cookies. We also store the Google Analytics visitor and session IDs with the order, and delete them after 90 days.
If you did not accept marketing cookies, neither Meta nor Google Ads cookies are used and encrypted contact details are not passed on.
5. Partner links
If you came to the website through a partner's link (e.g. ryytas.lt/vardas), the partner's discount code is stored in your browser for 30 days or until you place an order, so that it can be applied at checkout. This cookie contains only the code, no identifier of yours. We store which partner's link brought the buyer only if you accepted marketing cookies.
6. Visit log
So that we can find and fix errors in the cart or checkout, the website uses a visit ID for 30 minutes (the cookie ryytas_jid) and records pages viewed and technical events. We do not collect in the log the data you enter (address, telephone). Only a masked e-mail address (e.g. jo\\\*@gmail.com) is stored in the order event. The log is kept on our server for 14 days and is not passed to anyone.
7. Who we share data with
We share data only with those who help us sell and deliver goods, and only as far as they need it.
| Recipient | What for | Country | Role |
|---|---|---|---|
| Stripe | card payments, subscriptions | Ireland, USA | processor / independent controller for payments |
| Montonio | bank link payments | Estonia, Lithuania | processor / independent controller for payments |
| Swedbank | receiving payments into our account | Lithuania | independent controller |
| Shopify | orders and subscriptions of the old shop | Ireland, Canada, USA | processor |
| Seal Subscriptions | subscriptions of the old shop | Slovenia, Canada | processor |
| Klaviyo | e-mails about the order and the newsletter | USA | processor |
| Hostinger | e-mail, domains | EU | processor |
| Contabo GmbH | server for the website and the customer service system | Germany (EU) | processor |
| WePack (UAB) | warehouse, packing, parcel labels | Lithuania | processor |
| UAB Siuntų fabrikas (MultiParcels / Noparcels) | parcel label system | Lithuania | independent controller |
| Omniva, LP Express (AB Lietuvos paštas) | delivery to parcel lockers | Lithuania, Latvia, Estonia | independent controllers |
| ParkNord CRM | customer service records; runs on our server at Contabo GmbH | Germany (EU) | our system |
| Google (Analytics, Tag Manager, Ads) | statistics, advertising measurement | Ireland, USA | processor / independent controller for advertising |
| Meta Platforms Ireland | advertising measurement | Ireland, USA | joint controller for collecting data on the website |
| Anthropic (Claude) | helps prepare draft replies to customer e-mails from your e-mail; a human approves every reply before it is sent | USA | processor |
We also provide data to public authorities when the law requires it.
Transfers outside the EU.
- Stripe, Klaviyo, Google and Meta: the EU-US Data Privacy Framework (these companies are certified under it).
- Shopify and Anthropic: standard contractual clauses approved by the European Commission.
- Seal Subscriptions (data stored in Canada): the European Commission's adequacy decision for Canada, otherwise standard contractual clauses.
8. Your rights
You have the right to:
- find out what data of yours we process and obtain a copy of it;
- have inaccurate data corrected;
- request that data be erased;
- request that its processing be restricted;
- receive your data in a commonly used, machine-readable format and transmit it to another controller;
- object to our processing of data on the basis of legitimate interest, for example to our sending the Google Analytics purchase signal (see section 4);
- withdraw consent at any time. This does not affect what was done before the withdrawal.
Write to hello@ryytas.lt. We reply free of charge within 1 month at the latest. If the request is complex, we may extend the period by a further 2 months and will tell you so. To protect your data, we may ask you to confirm your identity.
We cannot erase data that we are required to keep under accounting laws.
You can withdraw or change your cookie consent at any time: Cookie settings.
If you believe we are infringing your rights, you can lodge a complaint with the State Data Protection Inspectorate (VDAI), vdai.lrv.lt. Residents of Latvia and Estonia can also contact the data protection authority of their own country. Please write to us first: we can usually resolve the matter faster.
9. How we protect data
The website works only over an encrypted HTTPS connection. You enter your card details in the Stripe form and your bank details on your bank's page, so we do not receive them. More: Security and privacy.
10. Changes
We update the policy when what we do with data changes. The date of the update is stated at the top of the page. We will announce material changes on the website.