Privacy Policy

Last updated: 28 August 2026.

This Privacy Policy explains how UAB “Šaltoji banga” processes personal data when you visit SaldymoSprendimai.lt, place an order, contact us, create an account, use warranty support or receive marketing communications.

1. Data controller

Data controller: UAB “Šaltoji banga”, company code 122370882, VAT code LT223708811, Antakalnio g. 38, LT-10305 Vilnius, Lithuania.

Telephone: +370 5 234 5655. Email for privacy matters: info@saldymosprendimai.lt.

You may use these contact details if you have questions about how we process your data or wish to exercise your data protection rights.

2. Personal data we may process

Depending on how you use our website and services, we may process the following categories of personal data:

• Contact data: name, surname, email address and telephone number.
• Company and billing data: company name, company registration number, VAT number and details required for invoicing.
• Delivery data: delivery address, recipient contact details and delivery instructions.
• Order data: products ordered, quantities, prices, order number, order status, delivery and payment information.
• Payment information: payment status, amount, payment method and transaction-related information. We do not receive or store your online banking passwords or other bank authentication credentials.
• Account data: customer account information, saved addresses, order history and selected preferences.
• Customer service data: correspondence, complaints, warranty cases, product model, serial number, photographs and other information required to resolve an issue.
• Technical data: IP address, device and browser information, login and security logs, cookies and similar technology data.
• Marketing data: consent to receive newsletters or marketing communications, opt-out records and related communication information.

3. Sources of personal data

Most data is provided directly by you when you place an order, register an account, complete a form or communicate with us by phone or email. We may also receive certain data from the company you represent, a delivery recipient, payment provider, carrier or another partner where this is necessary to perform an order or service. Technical data may be collected automatically when you use the website.

4. Purposes and legal bases

Processing orders

We process contact, order, delivery and payment data to accept and fulfil orders, enter into and perform sales contracts, deliver goods, administer payments and keep you informed about order progress. The legal basis is performance of a contract or steps taken before entering into a contract.

Accounting and legal obligations

Invoice, payment and accounting data is processed in order to comply with financial accounting, tax and other legal obligations. The legal basis is compliance with a legal obligation.

Customer service, warranty and claims

We process information you provide in order to answer enquiries, provide technical advice, administer warranty cases, complaints, returns and disputes. Depending on the situation, the legal basis may be performance of a contract, compliance with a legal obligation or our legitimate interest in providing proper customer service and establishing, exercising or defending legal claims.

Customer accounts

If you create an account, we process account data so that you can access order history, saved addresses and other account functions. The legal basis is performance of the service and our legitimate interest in providing convenient customer service.

Website security

We may process technical logs, IP addresses and security information to protect the website, prevent fraud, diagnose technical issues and maintain system security. The legal basis is our legitimate interest in operating a secure and reliable online store.

Direct marketing

For individual recipients, electronic marketing communications are sent where an appropriate legal basis exists, normally consent or the statutory existing-customer exception for similar products or services. Every marketing message provides a clear means to opt out of future communications.

Following the amendment to Article 81 of the Lithuanian Law on Electronic Communications effective from 22 April 2026, direct marketing to legal entities may in certain circumstances be carried out without prior consent, provided a clear, free and easy opt-out is available. Where a specific employee's contact details constitute personal data, GDPR requirements continue to apply.

5. Recipients of personal data

We disclose personal data only where necessary for a specific purpose. Recipients or processors may include:

• e-commerce platform, hosting, IT maintenance and security providers;
• banks, payment and financial service providers;
• couriers, transport, warehousing and logistics partners;
• manufacturers, suppliers or authorised service centres where required for direct delivery, warranty or technical support;
• accounting, audit, legal or debt administration service providers;
• email, marketing, analytics or advertising providers where their use is lawful and, where required, based on your consent;
• public authorities, courts or law-enforcement bodies where disclosure is required by law.

Service providers receive only the data necessary for their functions and, where they act as processors under the GDPR, are subject to appropriate data protection obligations.

6. Transfers outside the EEA

Some IT, analytics, advertising or other service providers may process data outside the European Economic Area. In such cases we transfer data only where a lawful transfer mechanism applies, for example an adequacy decision of the European Commission, Standard Contractual Clauses or another safeguard permitted under the GDPR.

7. Retention periods

We do not retain personal data indefinitely. Data is kept only for as long as necessary for the relevant purpose or as required by law.

• Order and accounting records are retained for the periods required by law; VAT invoices and related accounting documents are generally retained for 10 years.
• Customer account data is retained while the account remains active or until you request its deletion, except for data that must continue to be retained for orders, accounting, warranty or legal obligations.
• Enquiries and correspondence are retained for as long as necessary to resolve the matter and reasonably protect the parties' interests, normally no longer than 2 years after the enquiry is resolved unless a longer period is justified.
• Warranty, complaint and dispute records are retained throughout the case and thereafter for as long as reasonably necessary to establish, exercise or defend legal claims.
• Direct marketing data is processed until consent is withdrawn, you object to marketing, or another lawful marketing basis ends. Evidence of consent or opt-out may be retained for as long as necessary to demonstrate compliance.
• Technical and security logs are retained for a limited period appropriate to their purpose unless a longer period is required in connection with a security incident or legal claim.

8. Cookies and analytics

The website uses essential cookies required for the shopping cart, login, language selection, security and other core functions. Analytics, advertising and other non-essential cookies are used only in accordance with applicable law and, where required, with your consent.

More information about cookies, their purposes and controls is available in our Cookie Policy.

9. Your rights

Subject to the GDPR and the circumstances of the processing, you may have the right to:

• receive information about the processing of your data;
• access your personal data;
• have inaccurate data corrected or incomplete data completed;
• request erasure where the legal conditions are met;
• request restriction of processing;
• receive personal data you provided in a structured, commonly used and machine-readable format and, where applicable, transmit it to another controller;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal.

Requests may be submitted to info@saldymosprendimai.lt. To protect your data, we may reasonably request verification of your identity. We normally respond within one month. Where permitted by the GDPR, this period may be extended by up to two further months for complex or numerous requests, in which case we will inform you.

The right to erasure is not absolute. For example, we cannot erase accounting records or other information that we are legally required to retain or that is necessary for legal claims.

10. Right to lodge a complaint

If you believe your personal data has been processed improperly, we encourage you to contact us first so that we can address the issue. You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI): L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, tel. +370 5 271 2804, website vdai.lrv.lt.

11. Automated decision-making

SaldymoSprendimai.lt currently does not use solely automated decision-making that produces legal effects or similarly significantly affects you. If such processing is introduced in the future, we will provide specific information about the logic involved and your rights.

12. Data security

We apply organisational and technical measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. Access is limited to employees and service providers who need the information to perform their functions. The website uses encrypted HTTPS connections.

13. Changes to this policy

We may update this Privacy Policy when laws, services, technologies or processing practices change. The latest version is always published on this page together with its update date.

Terms relating to purchases are available in our Terms & Conditions.