Privacy Policy
UAB Elart — GDPR compliant — Last updated: 2025
1. Data Controller
The data controller in respect of personal data processed in connection with this website and any orders placed through it is:
Address: Vilnius, Lithuania
Email: info@elart.eu
Phone: +370 610 18 011
Website: elartcom.eu
For data protection enquiries, contact us at info@elart.eu. We endeavour to acknowledge all enquiries promptly.
2. Personal Data We May Collect
2.1 Data you provide to us directly:
- Account registration: full name, email address, and password (hashed only)
- Order placement: billing/shipping address, telephone; business customers may also provide company name and VAT number
- Payment: full card numbers are not stored. Payment is handled by PayPal and EveryPay. We may retain the last four digits and payment type for records.
- Customer support: content of enquiries, related correspondence, and attachments
- Product reviews: display name/username, review text, and rating
2.2 Data collected automatically:
- Technical data: IP address, browser type/version, OS, device type, referring URL
- Usage data: pages visited, time on page, clicks, search queries, basket items — to improve user experience
- Cookies: see Section 8 and our Cookie Policy
3. Purposes and Legal Bases for Processing
Personal data is processed only where a lawful basis under GDPR Article 6 applies.
| Purpose | Legal basis |
|---|---|
| Processing and fulfilling orders | Art. 6(1)(b) – Contract performance |
| Creating and managing customer accounts | Art. 6(1)(b) – Contract performance |
| Order confirmations and shipping notifications | Art. 6(1)(b) – Contract performance |
| Customer support, returns, complaints | Art. 6(1)(b) – Contract performance |
| Tax and accounting obligations | Art. 6(1)(c) – Legal obligation |
| Fraud prevention and website security | Art. 6(1)(f) – Legitimate interests |
| Website analytics and service improvement | Art. 6(1)(f) – Legitimate interests |
| Marketing emails and newsletters | Art. 6(1)(a) – Consent |
| Personalised advertising and retargeting | Art. 6(1)(a) – Consent |
4. Data Retention
| Data type | Retention period |
|---|---|
| Order records (invoices, transactions) | Up to 10 years (Lithuanian tax law) |
| Account data | Duration of account relationship + reasonable period after |
| Customer support correspondence | Typically up to 3 years from resolution |
| Marketing email list | Until consent withdrawn or unsubscribe received |
| Analytics data | Generally up to 26 months |
5. Disclosure of Personal Data
5.1 Service providers acting as processors:
PayPal (Europe) S.àr.l.; EveryPay AS
DHL Express and other courier partners
Google LLC (Google Analytics)
5.2 Legal and regulatory disclosure:
Personal data may be disclosed to public authorities where required by applicable law or a binding legal order.
6. International Data Transfers
UAB Elart is established in Lithuania (EEA). Where service providers involve transfers outside the EEA, we ensure appropriate safeguards per GDPR Chapter V (Standard Contractual Clauses).
- Google LLC (USA): transfers subject to SCCs and Google's Data Processing Addendum
- PayPal: PayPal (Europe) S.àr.l. is established in Luxembourg (EU); US transfers subject to SCCs
7. Your Rights Under GDPR
To exercise any of these rights, contact info@elart.eu. We aim to respond within one month.
Request a copy of your personal data
Request correction of inaccurate data
Request deletion, subject to legal obligations
Request restricted processing in defined circumstances
Receive data in a structured, machine-readable format
Object to processing based on legitimate interests
8. Cookies
We use cookies and similar tracking technologies on our website. For full details — including an overview of cookies set and guidance on managing preferences — please refer to our Cookie Policy.
9. Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure — including encrypted data transmission (HTTPS/TLS), access controls, and periodic security assessments. No internet transmission or electronic storage is entirely secure; if you believe your data may have been compromised, please contact us promptly.
10. Children
Our website is not directed at persons under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, please contact us and we will take appropriate steps.
11. Changes to This Policy
This Privacy Policy may be updated from time to time to reflect changes in our practices or applicable law. Any revised version will be published on this page with an updated effective date. Where changes are considered material, we endeavour to provide reasonable advance notice by email. Continued use of the website following publication constitutes acknowledgement of the updated version.
12. Google Analytics & Tag Manager
We use Google Analytics and Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to analyse website usage and manage tracking tools.
Google Tag Manager itself does not set cookies or collect personal data — it is used to deploy and manage other tracking scripts. Google Analytics collects anonymised usage data (pages visited, session duration, device type) to help us improve the website.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding how our website is used. Where required by applicable law, we obtain your consent before activating analytics cookies.
You may opt out of Google Analytics tracking at any time using the Google Analytics Opt-Out Browser Add-on. For more information, see Google's Privacy Policy.
13. Social Media
We maintain pages on social media platforms to communicate with customers and share information about our products and services. When you interact with our social media pages, the respective platform may process your personal data under its own responsibility.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in communicating with customers and promoting our services.
| Platform | Company | Privacy Policy | Opt-Out |
|---|---|---|---|
| Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | Facebook Privacy Policy | Facebook Opt-Out | |
| Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland | Instagram Privacy Policy | N/A |
We do not have access to personal data collected by the social networks beyond aggregated page statistics. For privacy concerns regarding social media data, we recommend contacting the respective platform directly.
14. Cookie Details
The following table lists the main cookies that may be set when you visit our website:
| Cookie name | Purpose | Category | Lifespan |
|---|---|---|---|
| PHPSESSID | Maintains user session state | Functional | Session |
| _ga | Distinguishes users in Google Analytics | Analytics | 1 year |
| _ga_* | Persists session state for Google Analytics 4 | Analytics | 1 year |
| _fbp | Used by Facebook for advertising | Marketing | 3 months |
| cf_clearance | Cloudflare security verification | Functional | 1 year |
| cookie_consent | Stores your cookie consent preferences | Functional | 1 year |
You may manage or disable cookies through your browser settings at any time. Disabling certain cookies may affect website functionality. For more details, please refer to your browser's help documentation.
