TADAS TRUCHILL INVEST, MB – PRIVACY POLICY

This Privacy Policy (hereinafter referred to as the “Policy”) explains how Tadas Truchill Invest, MB (hereinafter referred to as the “Company,” “we”) processes personal data when you use the website tadastru.com, browse the gallery and print offers, place an order in the online store, make a payment, contact us via the contact form or by email, as well as when you request information about the works. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the laws of the Republic of Lithuania, and the recommendations of the applicable supervisory authorities.

1. Data Controller and Contact Information

Data Controller: Tadas Truchill Invest, MB
Legal Entity Code: 307379577
Registered Address: Ulonų g. 1-171, LT-08240 Vilnius
Email for privacy inquiries: info@tadastru.com
Phone: +370 685 08931
Website: www.tadastru.com

2. Principles of Personal Data Processing

We process personal data:

• lawfully, fairly, and transparently;
• only for clearly defined and legitimate purposes;
• only to the extent necessary to achieve the stated objectives;
• to ensure that the data is accurate and, if necessary, updated;
• no longer than is necessary for the purposes of data processing;
• ensuring adequate data security, including protection against unauthorized or accidental disclosure, loss, destruction, or damage;
• in accordance with the principle of accountability under Article 5 of the GDPR.

3. What personal data do we process?

Depending on how you use the website and our services, we may process the following data:

3.1. Order and Customer Information

• name and surname;
• e-mail;
• phone number;
• shipping adress;
• Order information (item or print purchased, quantity, order number, order date, order status).
• This information is required to accept, process, and manage your order.

3.2. Payment information

• payment identifiers;
• payment amount;
• payment status;
• other information related to payment confirmation that we receive from the payment service provider.
• We do not store payment card data if it is processed through an external payment service provider.

3.3. Communication data

• The information you provided in the contact form;
• the content of the email correspondence;
• the content of inquiries regarding the work, delivery, return, or other matters;
• History of replies and correspondence.

3.4. Technical and browsing data

• IP adress;
• Device type;
• browser type and language settings;
• data from cookies and similar technologies;
• Information about the use of the website.
• This website uses a cookie consent management tool that distinguishes between functional, statistical, and marketing purposes.

4. Purposes and legal bases for the processing of personal data

We process personal data for the following purposes:

4.1. Order Management and Performance of the Sales Contract
When you place an order in our online store, we process your data so that we can accept the order, confirm payment, arrange delivery, manage returns, or resolve issues related to the order.
Legal basis: Article 6(1)(b) of the GDPR (performance of a contract).

4.2. Accounting and Compliance with Legal Obligations
We process certain data for the purposes of accounting, tax calculation, invoicing, and compliance with other legal obligations.
Legal basis: Article 6(1)(c) of the GDPR (legal obligation).

4.3. Customer Service and Communication
We process your data when responding to your inquiries, requests, questions about works, or other communications.
Legal basis: Article 6(1)(b) and/or (f) of the GDPR (performance of a contract or legitimate interest in properly managing communication).

4.4. Ensuring Website Functionality, Security, and Improvement
We process technical and cookie data to ensure the website’s functionality, security, and performance, and to analyze traffic.
Legal basis: Article 6(1)(f) of the GDPR (legitimate interest) or Article 6(1)(a) of the GDPR (consent) when cookies are not strictly necessary.

4.5. Direct Marketing
If we send you newsletters, offers, or other marketing information, we do so only after obtaining your explicit consent, where required by law.
Legal basis: Article 6(1)(a) of the GDPR (consent).
You may withdraw your consent at any time.

5. Payments

Payments may be processed through an external payment service provider, such as Paysera LT, UAB, if such a solution is used on the website. Such service providers act as separate data controllers or data processors in accordance with their privacy policies. We receive only the data necessary for order identification, payment confirmation, accounting, and customer service. We do not store card details.

6. Cookies and Analytics

The following types of cookies may be used on this website:

• Essential cookies – these are necessary for the website to function, to facilitate the purchasing process, to ensure security, and to provide basic features. They are used without separate consent to the extent permitted by law.
• Functional cookies – help remember user preferences and improve the user experience. Statistical/analytical cookies – allow us to analyze traffic and website usage in order to improve content and functionality.
• Marketing cookies – used only with your consent if the website uses advertising or remarketing solutions.
• You can change or withdraw your consent for non-essential cookies at any time in the cookie settings. The website’s cookie banner clearly distinguishes between functional, statistical, and marketing purposes.

7. Data retention periods

We retain personal data only for as long as necessary to achieve a specific purpose or as required by law. The following retention periods generally apply:

• Order and purchase-related data – up to 2 years after the order is fulfilled, unless longer retention is necessary for dispute resolution or other legitimate reasons;
• accounting documents and accounting data – 10 years or for any other period specified by law;
• communication data (emails, contact form inquiries) – up to 2 years from the last communication, unless longer retention is necessary for the assertion, exercise, or defense of legal claims;
• Cookie data – based on the expiration date of the specific cookie.

Once the retention periods have expired, the data is destroyed or anonymized.

8. Data recipients and data processors

We may disclose your personal data to these recipients only to the extent necessary:

• to payment service providers;
• to shipping, courier, or logistics service providers, if necessary for the delivery of the goods;
• providers of website hosting, maintenance, IT, and technical support services;
• providers of accounting, legal, or consulting services;
• to government agencies or regulatory authorities, where required by law.

We enter into contracts with data processors when required by law and ensure that appropriate data protection measures are in place.

9. Transfer of data outside the EEA

If certain service providers transfer personal data outside the European Economic Area, such transfers are carried out only in cases permitted by law and subject to appropriate safeguards, such as:

• the European Commission’s decision on eligibility;
• standard contract terms;
• other safeguards provided for in the GDPR.

10. Security Measures

To protect personal data, we implement technical and organizational security measures, such as:

• access control;
• SSL/TLS connection security;
• backups of systems and data;
• internal access control;
• confidentiality obligations;
• incident management procedures.

In the event of a personal data breach, we would take action in accordance with Articles 33 and 34 of the GDPR.

11. Your rights

You have the right to:

• žinoti, ar tvarkome Jūsų asmens duomenis;
• to know whether we are processing your personal data;
• request that inaccurate data be corrected or incomplete data be supplemented;
• request the erasure of data when there is a legal basis for doing so;
• request the restriction of data processing; object to data processing where it is based on a legitimate interest;
• to receive the data you have provided in a structured, commonly used, and machine-readable format, as well as to request that it be transferred to another data controller, where technically feasible;
• withdraw consent when data processing is based on consent;
• file a complaint with the State Data Protection Inspectorate.

12. Third-party links and social media

The website may contain links to third-party websites, social media profiles, or payment service providers’ systems. We are not responsible for the content, operation, or privacy practices of such third parties, so we recommend that you review their privacy policies separately.

13. Procedure for Exercising Rights

If you wish to exercise your rights or have questions about this Policy, please contact us by email at info@tadastru.com or by mail at Ulonų g. 1-171, LT-08240 Vilnius. Before responding to your request, we may reasonably ask for information necessary to verify your identity. We respond to requests within the timeframe established by law, typically no later than 1 month from the date of receipt of the request, except in cases where the deadline may be extended in accordance with legal procedures due to the complexity or volume of the request.

14. Automated decision-making

We do not use automated decisions that result in legal consequences for you or have a similarly significant impact. We also do not engage in profiling for direct marketing purposes without a legitimate basis or the necessary consent.

15. Policy Changes

This Policy may be updated or amended. The latest version is always available at www.tadastru.com. If the changes are material, we will provide clear and prominent notice of them on the website.