PRIVACY POLICY

Last updated: [2026.10.20]

1. Introduction

Grafkap is an online store operated by an individual carrying out individual activity (individuali veikla) in Lithuania. For the purposes of applicable data protection legislation, the individual operating Grafkap is the data controller responsible for the processing of personal data described in this Privacy Policy.

Trading name: Grafkap
Data controller: Ieva Dominauskaitė
Website: https://grafkap.com
Email: sydney.grafkap@gmail.com
Country: Lithuania

In this Privacy Policy, “we”, “us” and “our” refer to the individual operating Grafkap.

We respect your privacy and are committed to handling your personal data responsibly and in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Personal Data We Collect

We may collect and process the following types of personal data when you visit our website or place an order:

Order and contact information: Your name, surname, email address, telephone number, billing address and delivery address.

Purchase information: Details of products ordered, order numbers, purchase history, order status and information needed to handle returns, refunds or customer enquiries.

Payment information: Payment status and transaction details necessary to process your purchase. Payment card details may be handled directly by our payment service providers.

Technical information: Depending on the website's configuration, we may collect information such as your IP address, browser type, device information, time zone and website activity through server logs and technical tools.

Cookie information: Information collected through cookies and similar technologies used on our website, depending on your preferences and applicable law.

Communication information: Information you provide when contacting us by email or through any contact form available on our website.

We collect only the personal data reasonably necessary for the relevant purposes described in this policy.

3. How We Use Your Personal Data

We may use your personal data to:

• Process and fulfil orders placed through our website.

• Arrange payment, shipping and delivery.

• Communicate with you about your order.

• Handle returns, refunds, complaints and customer support requests.

• Maintain accounting and business records.

• Protect our website, prevent fraud and address security issues.

• Comply with legal obligations.

• Understand and improve website performance where permitted by law.

• Send marketing communications if we offer them and have the necessary legal basis and consent, where required.

We do not use personal data for purposes incompatible with those described in this policy without an appropriate legal basis.

4. Legal Basis for Processing

Depending on the circumstances, we process personal data under one or more of the following legal bases:

Performance of a contract: When processing your order, arranging delivery, handling payment and providing services you request.

Legal obligations: When we need to maintain accounting records, comply with tax requirements or meet other legal obligations.

Legitimate interests: When reasonably necessary to protect our business, maintain website security, prevent fraud or manage customer enquiries, provided these interests do not override your rights and freedoms.

Consent: When required for certain cookies, tracking technologies or marketing communications.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that took place lawfully before consent was withdrawn.

5. Payments

Payments are processed using the payment methods and providers available at checkout.

Depending on the payment method, the relevant provider may process your personal data under its own privacy policy and applicable legal requirements.

Please consult the relevant payment provider's privacy notice for more information about its processing activities.

6. Shipping and Delivery

To fulfil your order, we may share the necessary personal data with postal services, shipping companies, fulfilment providers and other delivery partners.

This information may include your name, delivery address, telephone number, email address and order reference, depending on the service used.

We share only the information necessary to arrange and complete delivery, subject to applicable law.

7. Cookies and Website Technologies

Our website may use cookies and similar technologies to support essential website functions, remember preferences, protect the website and, where applicable, measure website performance or provide advertising.

Where applicable law requires consent for non-essential cookies or tracking technologies, these technologies will be used only after the required consent has been obtained.

You may manage your cookie preferences through the cookie settings available on our website, if provided.

Website analytics and advertising tools: Google Analytics, Google Search Console

For further information about the cookies actually used on our website and their purposes, please refer to our cookie information or cookie settings, where available.

8. Sharing Personal Data

We may share personal data with third parties when necessary to operate our online store and fulfil orders.

These parties may include:

• Website hosting and technical service providers.

• Payment service providers.

• Postal services and delivery companies.

• Order fulfilment providers, if applicable.

• Accounting or professional advisers, where necessary.

• Public authorities where disclosure is required by law.

The relevant service providers may process personal data on our behalf or, depending on their role, as independent data controllers.

Where required, we use appropriate contractual and organisational safeguards to protect personal data.

9. International Data Transfers

Some service providers used by our website may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA and GDPR transfer rules apply, we will ensure that an appropriate legal transfer mechanism and necessary safeguards are in place.

For information about the international transfers relevant to your data, you may contact us using the details provided below.

10. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including order fulfilment, customer support, accounting, legal compliance and dispute resolution.

Some records, including accounting and transaction records, may need to be retained for periods prescribed by law.

Other information is retained for a period appropriate to its purpose and applicable legal requirements.

When personal data is no longer necessary, it will be deleted or anonymised where appropriate, unless further retention is legally required or permitted.

11. Your Rights

Subject to the conditions and exceptions provided by applicable law, you may have the right to:

• Access your personal data.

• Request correction of inaccurate or incomplete personal data.

• Request erasure of your personal data.

• Request restriction of processing.

• Object to certain processing activities.

• Request data portability where applicable.

• Withdraw consent where processing is based on consent.

• Object to direct marketing at any time.

To exercise your rights, contact us at sydney.grafkap@gmail.com.

We may need to verify your identity before responding to certain requests. We will respond within the time limits required by applicable law.

12. Complaints

If you have concerns about how we process your personal data, you may contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

In Lithuania, the relevant authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija).

Website: https://vdai.lrv.lt/

13. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure or destruction.

Our website may rely on third-party hosting and other technical service providers to store or process information. We take appropriate steps to protect personal data within our responsibility.

However, no method of electronic transmission or storage can be guaranteed to be completely secure.

14. Third-Party Websites

Our website may contain links to third-party websites or services.

We are not responsible for the privacy practices of websites we do not operate. We encourage you to read their privacy policies before providing them with personal information.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our business, website functionality, service providers or legal requirements.

The latest version will be published on our website together with its updated date.

16. Contact Information

For questions about this Privacy Policy or requests concerning your personal data, please contact:

Grafkap
Data controller: Ieva Dominauskaitė
Email: sydney.grafkap@gmail.com
Country: Lithuania

We will handle privacy-related enquiries in accordance with applicable data protection legislation.