Privacy Policy

Data controller

The data controller is UAB „Ekohub Projektai“, registration no. 304300763, VAT LT100018042713, Vilniaus g. 146-1, Šiauliai, 76297, Lithuania. For data protection inquiries, use our contact form or email ….

GDPR and EU compliance

We comply with the General Data Protection Regulation (GDPR) and other applicable EU data protection laws. We process personal data lawfully, fairly, and transparently. We collect only what is necessary for the purposes described in this policy, and we respect your rights to access, rectify, erase, restrict processing, object, and data portability where applicable.

Our data processing activities are designed to meet the requirements of Regulation (EU) 2016/679 (GDPR). If you are in the European Economic Area (EEA) or the UK, you have the rights set out under Your rights below. Our supervisory authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija).

Data we collect (analytics)

We use Google Analytics 4 and our internal analytics endpoint to understand how the site is used. Analytics is enabled by default and can be disabled at any time by selecting "Only essential" or updating Cookie Preferences.

• Pages visited (path, page title)
• Referrer and referrer domain
• UTM parameters when present in the URL
• Approximate location (country/city derived from IP)
• Device type, browser, and operating system (aggregated)
• Anonymous client/session identifiers (e.g. _ga, bam_sid)
• Approximate session duration
• Optional: viewport size, search query (query text only)

We may also record conversion-related events (e.g. add to cart, checkout started, order completed) without personal data, only anonymous session and non-identifying details (e.g. order total, item count).

Data we collect for orders and invoicing

When you register or place an order, we collect data necessary to fulfil the order and issue invoices for official accounting (name, email, phone, addresses, and related order details). This data is not used for marketing unless you have given separate consent.

• Account: name, email address, password (stored hashed), and your preferred display currency (if you choose one) so we can show prices and totals in that currency where the platform supports it.
• Billing and shipping: company name, VAT ID (if applicable), billing and delivery address, contact name, phone (if provided).
• Orders: order items, quantities, prices, totals, payment status, delivery status, and where applicable the currency in which totals were shown at checkout, the exchange rate applied at the time of the order, and related amounts (so we can honour what you confirmed and meet accounting requirements).
• Favorites and cart: when you add items to favorites or cart, we store product IDs linked to your account. This data is used solely to provide these features.

Reference exchange rates used to convert from our euro (EUR) base prices to other display currencies are based on European Central Bank (ECB) data. We retrieve these rates on our servers (for example via the Frankfurter API); we do not send your identity or personal details to that service. For how currencies and rates work on Baltic Amber Mala, see our Currencies and Rates page and our Terms and Conditions.

We use this data only to process orders, deliver products, issue invoices, and comply with accounting and tax law. We retain order and invoice data for the period required by law (e.g. for accounting and tax purposes, typically several years). We do not sell this data to third parties.

Security and anti-abuse

To protect the platform from bots, abuse, and fraud, we use third-party security services that may process limited technical data:

• Cloudflare Turnstile (CAPTCHA): Used on login, registration, forgot-password, and contact forms. Cloudflare may process browser and device information to verify that submissions are from real users. See Cloudflare's Privacy Policy.
• Upstash (rate limiting): We limit the number of requests per IP address for sensitive actions (e.g. login attempts, contact form submissions, checkout). IP addresses may be stored temporarily in a Redis database to enforce these limits. Data is not used for marketing or profiling.
• Cloudflare (WAF, CDN): Our site is behind Cloudflare for security (Web Application Firewall), performance, and DDoS protection. Cloudflare may process your IP address and request data. See Cloudflare's Privacy Policy.

This processing is based on our legitimate interest in protecting the platform and preventing abuse. Data is retained only as long as necessary for security purposes.

Contact form

When you submit our contact form, we collect your name, email address, subject (optional), and message. We use this data solely to respond to your inquiry. Messages are retained as long as needed to handle your request and for our records.

Email communications

We use your email address to send transactional messages: order confirmations, shipping updates, password reset links, and account-related notifications. These are necessary for the service. We do not send marketing emails unless you have given separate consent.

Data sharing and third parties

We share data only as necessary to operate the service:

• Hosting and database: Supabase (EU). Your account and order data is stored in the EU.
• Payment processing: We use the payment methods shown at checkout. Bank transfers are processed between you and our bank. Other processors (for example Montonio, Mollie, or PayPal, when enabled) receive the billing and transaction data needed to take payment. Each provider has its own privacy policy. We do not use TrueLayer.
• Shipping: The courier handling your order receives the delivery address and contact details needed to deliver the parcel.
• Security and anti-abuse: Cloudflare (CDN, WAF, Turnstile) and Upstash (rate limiting) may process IP addresses and request data for security and abuse prevention.

We have data processing agreements (DPAs) in place with our sub-processors where required by GDPR. We do not sell or rent your personal data to third parties for marketing.

International transfers

Your data is stored and processed in the EU. Our hosting provider (Supabase) operates in the EU. Payment providers may process data in their jurisdictions; they use appropriate safeguards (e.g. Standard Contractual Clauses) where required. We do not transfer your data outside the EEA unless necessary for the service, and only with adequate protections in place.

If you consent to Google Analytics, related analytics data may be processed by Google and transferred outside the EEA. Google states it uses Standard Contractual Clauses and additional safeguards for such transfers.

Legal basis

Analytics: We process analytics data based on our legitimate interest to improve website performance and user experience. You may opt out at any time using the cookie banner (e.g. "Only essential") or "Cookie preferences"; analytics collection will then stop for future visits.

Orders and invoicing: We process order and invoice data to perform the contract with you and to comply with legal obligations (e.g. accounting, tax).

Contact form: Legitimate interest in responding to your inquiry.

Security and anti-abuse: Legitimate interest in protecting the platform from bots, fraud, and abuse.

Retention

• Analytics: Google Analytics data retention is set up to 14 months in GA4 settings; our internal analytics data is retained up to 24 months.
• Orders and invoices: For the period required by applicable accounting and tax law (e.g. 10 years where required).
• Contact form messages: As long as needed to handle your request and for our records.

Your rights

You have the right to access, correct, request deletion, restrict processing, and object to processing. The right to data portability applies to data processed by automated means on the basis of your consent or contract performance; this typically covers your account registration data and order history. You can:

• Analytics: Opt out via the cookie banner (e.g. "Only essential") or Cookie preferences. Withdrawal stops future analytics collection. To request deletion of data linked to you, contact us; where possible, include identifiers such as bam_sid or _ga value.
• Account and orders: Access and update your data in your account; contact us to request deletion or a copy of your data, subject to legal retention requirements. You may object to processing based on legitimate interest.
• Complaint: If you are in the EEA or UK, you have the right to lodge a complaint with your supervisory authority. See GDPR and EU compliance above for ours.

Automated decision-making

We do not use automated decision-making or profiling that would significantly affect you. No decisions about you are made solely by automated means.

Children and platform eligibility

Our shop is intended for customers aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe we have collected such data, please contact us and we will delete it.

Cookies we use

We use essential cookies (required for the site to function) and analytics cookies. Analytics is enabled by default; you can choose "Only essential" or customize settings in the cookie banner. Manage your choices at any time via our Cookie Preferences page.

Essential cookies

These cookies are necessary for the website to work. They cannot be disabled.

Cloudflare Turnstile (CAPTCHA) may set cookies on forms that use it (login, register, forgot-password, contact). These are used only for bot verification and are subject to Cloudflare's privacy policy.

Analytics cookies

Used only if you choose "Allow all" or enable Analytics in "Customize". Analytics is enabled by default and can be disabled by selecting "Only essential" or turning Analytics off in Customize.

You can withdraw consent at any time via Cookie Preferences.

Security

We use industry-standard measures to protect your data: HTTPS, hashed passwords, and secure database access. Data is stored in the EU. We do not retain full card numbers; payment details are handled by our payment providers.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and inform affected individuals without undue delay, as required by GDPR.

Policy updates

We may update this Privacy Policy from time to time. The "Last updated" date at the top indicates when changes were last made. Continued use of the platform after changes constitutes acceptance. We encourage you to review this policy periodically.

Contact

For privacy-related requests or questions, contact us via our contact form or by email at …. See also our Terms and Conditions and FAQ.