Privacy Policy

BRILLA online store Privacy Policy

Effective from 2026-10-28

1. Data controller

The data controller is MB „Brilla“, company code 308111895, registered office Aleksandro Strauso g. 7, LT-25124 Vilnius, Lithuania, e-mail info@brilla.lt. Personal data are processed in accordance with the General Data Protection Regulation (GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

2. What data we collect and why

Purpose	Data	Legal basis	Retention period
Order fulfilment and delivery	Name, surname, e-mail, phone, delivery address or parcel locker, order contents	Performance of a contract	3 years from the order
Payment processing	Name, surname, e-mail, payment amount, payment method, IP address	Performance of a contract	According to the payment provider’s rules
Accounting	Invoice data (name and surname or company details, amount)	Legal obligation	10 years
Returns and claims	Contact details, order data, correspondence, photos	Performance of a contract, legal obligation	3 years after the claim is resolved
Newsletters (if you subscribe)	E-mail, name	Consent	Until you withdraw consent
Website operation and statistics	Cookies, IP address, browser data	Essential cookies – legitimate interest; others – consent	See Section 7

We do not see or store card details or online banking login details — they are handled by the payment service provider.

3. Where we get the data

You provide the data yourself when placing an order, contacting us or subscribing to newsletters. Some data (IP address, browser data) are collected automatically when you use the website.

We share data only as far as necessary to provide the service:

The e-commerce platform provider Shopify International Limited (Ireland), on whose servers the store runs.
The payment service provider Maksekeskus AS (see Section 5).
Couriers: [Omniva / LP Express / DPD] – name, surname, phone, e-mail, address or parcel locker.
Our accounting service provider.
Marketing and analytics partners (e.g. Google, Meta) – only with your cookie consent.
Public authorities – only where required by law.

Some service providers (e.g. Shopify) may process data outside the European Economic Area; in that case the safeguards provided by the GDPR apply (European Commission standard contractual clauses or an adequacy decision).

5. Payment processing

When paying in the online store, you make the payment through the MakeCommerce payment platform.
During payment, your name, surname, e-mail, payment amount and IP address are transferred to execute and confirm the payment.
Payments in the online store are processed via the makecommerce.lt platform, operated by Maksekeskus AS (Liivalaia 45, Tallinn 10145, Estonia, reg. no.: 12268475); therefore, your personal information necessary for executing and confirming the payment will be transferred to Maksekeskus AS.

6. Your rights

You have the right to:

Know what data about you are processed and receive a copy;
Request correction of inaccurate data;
Request erasure of data no longer needed or without a legal basis (except data we must keep by law);
Restrict or object to processing;
Receive your data in a structured format and transfer them to another controller;
Withdraw consent at any time (e.g. unsubscribe via the link at the bottom of a newsletter);
Lodge a complaint with the State Data Protection Inspectorate (L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt).

Send requests to info@brilla.lt. We will reply within 30 days.

7. Cookies

The website uses cookies – small files stored on your device.
Essential cookies make the cart, checkout and security work; they are used without consent.
Analytics and marketing cookies are used only with your consent given in the cookie banner. You can change your consent at any time in the cookie settings or your browser.

8. Data security

We apply organisational and technical measures to protect data: data are transmitted over an encrypted connection (SSL), and access to orders is limited to people who need it.