Privacy Policy

We recognise the particular importance of protecting your personal data, so we collect and process only the data that is necessary for carrying out our activities. We process personal data lawfully, transparently and fairly, for predefined purposes and only to the extent necessary to achieve the processing purposes. When processing personal data, we aim to keep it accurate, secure, confidential, and properly stored and protected.

By applying organisational and technical measures, we ensure appropriate security of personal data, including protection against unauthorised processing, unlawful processing, and accidental loss, destruction or damage.

When processing your personal data, we comply with the General Data Protection Regulation (EU) 2016/679 of 27 April 2016 (hereinafter — the GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, as well as the personal data processing requirements established in other legislation and/or by supervisory authorities.

1. WHAT IS THIS DOCUMENT?

1.1. By reading this privacy policy (hereinafter — the Privacy Policy) you will learn how and for what purposes we process your personal data, where we obtain it, to whom we provide it and how we store it, and what rights you have as a data subject.

1.2. This Privacy Policy sets out the privacy rules for using our website, accessible at https://fuudo.eu/ (hereinafter — the Website), and our social media accounts on Facebook https://www.facebook.com/, Instagram https://www.instagram.com/and https://www.linkedin.com/ (hereinafter — social media accounts). Please read this Privacy Policy carefully, as it applies every time you visit our Website. If you do not agree with our Privacy Policy, you should not continue to use our Website.

1.3. In this Privacy Policy, the term "personal data" means any information by which you can be identified — directly or indirectly. Personal data is, for example, surname, name, email address, telephone number, location data, online identifier, characteristics specific to you, and other personal data as defined in the GDPR.

2. WHO ARE WE?

2.1. We are MB Fuudo, legal entity code 306932847, registered office address — Gedimino pr. 20, LT-01102, Vilnius, engaged in trade in tea and tea accessories, hereinafter referred to as the Company or we, email info@fuudo.eu, contact telephone number +370 66587487, and the controller of your personal data provided on the Website.

3. WHAT PRINCIPLES DO WE FOLLOW?

3.1. When processing your personal data, we will:

a) comply with the requirements of applicable legislation, including the GDPR; b) process your personal data lawfully, fairly and transparently; c) collect your personal data for specified, clearly defined and legitimate purposes and will not further process it in a manner incompatible with those purposes, except as permitted by law; d) take all reasonable steps to ensure that personal data which is inaccurate or incomplete, having regard to the purposes of its processing, is promptly corrected, supplemented, its processing suspended, or destroyed; e) keep it in a form that permits your identification for no longer than is necessary for the purposes for which the personal data is processed; f) not provide personal data to third parties or make it public, except in the cases set out in the Privacy Policy or applicable legislation; g) ensure that your personal data is processed in a manner that, by applying appropriate technical or organisational measures, guarantees appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage.

4. HOW DO WE COLLECT YOUR PERSONAL DATA?

4.1. We process your personal data obtained in the following ways:

a) When you provide it to us. You provide us with your personal data and other information by using the Website or communicating with our team, submitting enquiries and/or complaints, contacting us by telephone, in writing or by email. b) When you use our Website. When you use the website we manage, certain information (e.g. internet address (IP), etc.) is collected automatically. c) When we obtain your personal data from other persons in accordance with legislation and/or this Privacy Policy.

4.2. In cases where we obtain data not from the data subjects themselves, we require that the data subjects be informed about the processing of the relevant personal data (the purpose and other conditions and circumstances detailed in this Privacy Policy).

4.3. We may combine personal data received from you with data we have collected ourselves from other public and/or available sources (e.g. we may combine the personal data you provide with data obtained using Website cookies or with data lawfully obtained from third parties, etc.).

4.4. You may always request the correction of inaccurate personal data and exercise your other rights as a data subject set out in this Privacy Policy and applicable legislation.

5. FOR WHAT PURPOSES AND HOW DO WE PROCESS YOUR PERSONAL DATA?

5.1. We will process your personal data for the following purposes:

a) To improve the Website and offer you better, tailored services. We use your personal data, including data we obtain when you use our Website, to improve and develop the Website and to offer better and more tailored services. For this purpose we obtain data from you (via cookies when you use the Website) and/or from third parties. For more detailed information about the categories of personal data processed for this purpose and the specifics of processing, and how we use cookies and similar technologies, see section 6 of this Privacy Policy.

b) For the purpose of quality control of our activities (retaining complaints and/or your enquiries and communications). When you contact us (or when we contact you after receiving your enquiry), we store information about the correspondence conducted by email or in writing. We collect such information to ensure appropriate service quality and to control the provision of services. For this purpose we process such personal data as: name, surname, email address, content of the enquiry, the date and time of contacting us, communication information. For this purpose we obtain your personal data: from you; we may create the data ourselves while handling an enquiry or analysing a complaint (e.g. after receiving a complaint, we contact the Company's employees about the factual circumstances of the complaint and record them, etc.); from third parties. For this purpose we provide or transfer your data to: persons providing Website administration services, IT services, compliance and legal services. For this purpose we store your data for 90 calendar days from the date of recording, except where there is reason to believe that a crime or other unlawful act is being recorded, or an internal investigation has begun, until the end of the relevant investigation and/or proceedings.

c) For direct marketing purposes. With your consent, and in order to send you newsletters, including offers and information about the services, events or other information of us, persons related to us and partners, and to improve our services, we process your personal data. For this purpose we process such personal data as: name, surname, email address, telephone number, social media profile nickname, photographs with your image. For this purpose we obtain your personal data from you. For this purpose we provide or transfer your data to: persons providing newsletter services, companies providing Website administration services; we may also, with your consent, publish photographs placed on the Website on our social media accounts. For this purpose we store your personal data for no longer than 2 years from the date you give your consent. For more details on the processing of personal data for direct marketing purposes, see section 7 of this Privacy Policy.

d) For the purpose of concluding and performing agreements. It is our duty to execute the orders you place with us and to carry out other transactions. Therefore, in order for you to establish and maintain legal relations with us, and so that we can process, administer, fulfil, invoice, receive accounting documents and perform your orders, we must process your personal data. The data you provide is processed for the purpose of accepting and performing the order; contact data is used so that we can reach you if any questions arise, to resolve problems related to the provision of our services, or for other purposes related to concluding and performing agreements. For this purpose we process such personal data as: name, surname, telephone number, email address, residential address. For this purpose we obtain your personal data from: you; legal entities of which you are a representative or contact person. For this purpose we provide or transfer your personal data to: companies providing audit, legal and/or other consulting and/or accounting services, and logistics companies through which we organise delivery of goods to you. For this purpose we store your personal data during the term of the agreement and for 1 year after its end. This term may be extended if a (judicial) dispute begins — in which case the personal data is stored until a mutual settlement is reached and/or the final decision takes effect. If no agreement is concluded, we store your personal data for no longer than 90 calendar days from the moment such a decision is made.

e) For the purpose of analysing QR code scans on our packaging. The QR code on our product packaging links to a page on our website with a meditation. When you scan this code, our QR code provider collects, on our behalf, limited technical data about the scan so that we can understand how our packaging is engaged with. For this purpose the following personal data is processed: IP address, device and browser type, approximate location (city/region, derived from your IP address), and the date and time of the scan. We do not collect your name or precise location, and the scan is not linked to your identity. For this purpose we obtain your personal data: from you, when you scan the QR code. For this purpose we provide or transfer your data to: our QR code provider Uniqode (Uniqode Phygital, Inc., USA), which acts as our data processor. For this purpose we process the data on the basis of our legitimate interest in understanding how our packaging is engaged with. This data is stored on our behalf by the provider Uniqode (USA) for no longer than is necessary for this purpose, in accordance with the storage periods it sets. The data is stored in the United States and transferred under the EU Standard Contractual Clauses (SCC). We, as the data controller, remain responsible for the processing of this data.

f) For other purposes, where we are obliged to process your personal data by law or where a legitimate interest exists.

5.2. For the personal data processing purposes detailed in this Privacy Policy, we never ask you to provide or disclose, nor do we process, your special categories of personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, nor health data, genetic data, biometric data (for the purpose of uniquely identifying you), or information about your sex life.

5.3. Do not provide excessive personal data that is not necessary to achieve the stated purposes.

5.4. We organise our work procedures so as to ensure secure data processing.

5.5. Access to the personal data of data subjects is granted only to those Company employees who need it to perform their job functions.

6. WHEN DO WE USE COOKIES?

6.1. We collect information about you using cookies and similar technologies. Cookies are small files that are temporarily stored on your device's hard drive and allow you to be recognised on subsequent visits to the Website, to save a person's browsing history and preferences, tailor content, speed up searches, and create a convenient and user-friendly environment, delivering it more efficiently and reliably. Cookies are a common web browsing practice that makes using a website easier.

6.2. Through cookies on the Website, we may collect the information specified in clause 5.1(a) of this Privacy Policy.

6.3. We use the information obtained through cookies:

a) to ensure the functionality of the Website; b) to be able to improve and develop the Website so that it better meets your needs; c) for service development and analysis of Website usage; d) for targeted marketing.

6.4. We may, without breaching legislation, combine information obtained using cookies with information obtained about a person by other means (e.g. information about the use of the Website with other personal data you have provided or obtained from other sources).

6.5. We inform you that the Website may use cookies such as, for example:

a) necessary (technical) cookies — cookies that are essential for the functioning of websites. These cookies cannot be disabled; b) functional cookies — cookies that, although not essential for the functioning of websites, significantly improve their operation, quality and visitor experience. These cookies record information about your choices and allow the use of the Website to be tailored to your needs; c) analytical (statistical) cookies — cookies used to prepare statistical analysis of website visitors' navigation methods; the data collected by these cookies is used anonymously; d) targeting or advertising cookies — cookies used to show offers or other information that might interest you.

6.6. Information about the cookies used on the Website, their purpose, validity and the data used:

NAME	PURPOSE	STORAGE PERIOD	Third-party
facebook.com, fr	Facebook cookies, used for your identification as a user, displaying advertising and personalising the site's interaction with the Facebook social network.	1 year	Yes
_ga, _gat, _gid	Cookie for collecting statistics on user behaviour (www.policies.google.com/privacy)	2 years	Yes
google.com, 1P_JAR, ANID, NID	Cookie for collecting statistics on user behaviour (www.policies.google.com/privacy)	1 year	Yes
google.com, google.lt, CONSENT	Cookie for collecting statistics on user behaviour (www.policies.google.com/privacy)	1 year	Yes
google.lt, NID	Cookie for collecting statistics on user behaviour (www.policies.google.com/privacy)	1 year	Yes
PHPSESSID	Unique session ID number	until end of session	No
currency	Sets the currency	two days from start of session	No
language	Sets the language	two days from start of session	No
_fbp	Facebook cookies, used for your identification as a user, displaying advertising and personalising the site's interaction with the Facebook social network.	1 year	Yes

6.7. On our website you can choose which cookies you consent to; however, please note that the necessary (technical) cookies used on the Website are recorded automatically and do not require your consent.

6.8. Third-party cookies are used on our Website. We use Google Analytics and Google Search Console tools, which use analytical-type cookies and gather information about the Website. The information collected is used to prepare reports on the pages visited by users, the time spent on them, and other information related to visitor behaviour on the Website.

6.9. You may withdraw the permission you have given us to use cookies at any time. You can do this by changing your web browser settings so that it does not accept cookies. How to do this depends on the operating system and web browser you use. Detailed information about cookies, their use and opt-out options can be found at http://AllAboutCookies.org or http://google.com/privacy_ads.html.

6.10. In some cases, in particular disabling technical or functional cookies, not consenting to cookies or deleting them may slow down browsing speed, limit the operation of certain Website functions, or block access to the Website.

7. DO WE USE YOUR PERSONAL DATA FOR DIRECT MARKETING, AND WHAT ARE OUR NEWSLETTER SUBSCRIPTION RULES?

7.1. With your additional consent, we may use your personal data for direct marketing purposes to provide you with offers and information about the services of us, persons related to us and partners that, in our opinion, might interest you.

7.2. For this purpose we process the following personal data: name, surname, email address, telephone number, social media profile nickname, your photographs placed, with your consent, on the Website and/or our social media accounts.

7.3. You can choose whether you allow us to use your personal data for direct marketing purposes. You can do this on the Website by entering your email address and clicking the subscription confirmation.

7.4. We may combine the information we hold about you with information held by third parties.

7.5. If you consent to the use of your personal data for direct marketing purposes, we may use your personal data to analyse and improve the effectiveness of our websites, advertising and market research, and for other Company marketing and sales purposes. In such case we will use your anonymised data.

7.6. Even if you have given consent to process your personal data for direct marketing purposes, you can easily withdraw this consent at any time for all or part of the processing operations. To do so you can:

a) notify your refusal in the manner indicated in the electronic messages and/or offers received (e.g. by clicking the link "If you no longer wish to receive news, click here" or similar); b) send us a request by email to info@fuudo.eu. The request must clearly state your name and surname and other registration data (if any). If you wish to withdraw your consent in this way, we may ask you to provide identity documents.

7.7. If you withdraw your consent, we will try to stop processing your personal data for direct marketing purposes as soon as possible.

7.8. Withdrawal of consent does not automatically oblige us to destroy your personal data or to provide you with information about the personal data we process, so if you wish us to also carry out these actions, you must state such a request separately.

8. TO WHOM DO WE PROVIDE YOUR PERSONAL DATA?

8.1. We guarantee that your personal data will not be provided or otherwise transferred to third parties without a legal basis, nor used for purposes other than those for which it was collected. We will not transfer your personal data in any way other than in accordance with this Privacy Policy and the procedure established by legislation. However, we reserve the right to provide information about you if we are required to do so in accordance with the law, or if requested by lawfully acting authorities or criminal prosecution authorities.

8.2. We may transfer your personal data to partners and companies that help us carry out our activities. We require such entities to process your data only in accordance with our instructions and applicable legislation ensuring the protection of your data. We conclude agreements with these persons that oblige them to strictly comply with personal data protection requirements.

8.3. The ability of the above service providers to use your data is limited — they may not use this data for purposes other than providing services to us.

8.4. A non-exhaustive list of persons and their categories to whom we transfer your personal data is provided in clause 5.1 of this Privacy Policy, separately for each purpose of using personal data.

9. HOW LONG DO WE STORE YOUR PERSONAL DATA?

9.1. We store your personal data for no longer than is required by the data processing purposes or provided for by legislation, where a longer storage term is established therein.

9.2. We aim not to store outdated, irrelevant personal data, so once it is updated (e.g. clarified, information changed, etc.) only the relevant information is stored. Historical information is stored where required by legislation or to carry out our activities. When setting data storage terms, we rely on the Order of the Chief Archivist of Lithuania of 9 March 2011 No. V-100 on the approval of the index of general document storage terms.

9.3. The storage terms for your personal data are indicated in clause 5.1 of the Privacy Policy, separately for each purpose of using personal data.

10. EXTERNAL WEBSITES

10.1. The Website may contain links to external websites — the websites of our business partners or websites where we have accounts advertising our services. When following such links to any of the websites, please note that these websites and the services accessible through them have their own separate privacy policies, and we accept no responsibility or liability for these policies or for the personal data collected on these websites or in providing services, such as contact or location data. We recommend reviewing these policies before providing personal data on these websites or using any services.

11. HOW DO WE PROTECT YOUR PERSONAL DATA?

11.1. Personal data is protected against loss, unauthorised use and alteration. The internet connection is encrypted, and the website page runs over the https:// protocol.

11.2. Protection of computer equipment against malicious software is ensured (e.g. installation and updating of antivirus programs).

11.3. The data we collect from you will be within the EU territory, but may be transferred or stored outside the EU. When transferring your data outside the EU, we will take all necessary steps to ensure that your data is processed securely and in accordance with this Privacy Policy.

11.4. Unfortunately, the transmission of information over the internet is not completely secure. Although we make every effort to protect your personal data, we cannot guarantee the security of data when you transmit it to the Website — you assume the risk associated with transmitting data to the Website. Once we receive your data, we will apply procedures and security measures that meet legal requirements to protect your data against unauthorised access, unlawful processing or disclosure, accidental loss, removal or destruction.

11.5. If circumstances arise and we become aware of a breach of the security of your personal data that may pose a high risk to your rights or freedoms, we will inform you without delay as soon as we become aware of it and establish what information was accessed.

12. WHAT RIGHTS DO YOU HAVE?

12.1. When processing personal data, we ensure your rights under the GDPR and the Law on Legal Protection of Personal Data of the Republic of Lithuania. As a data subject, you have the following rights:

a) to know (be informed) about the processing of your personal data; b) to access your personal data that we process; c) to request the correction or supplementation, clarification of incorrect, inaccurate or incomplete personal data; d) to request the destruction of personal data when it is no longer needed for the purposes for which it was collected; e) to request the destruction of personal data if it is processed unlawfully or when you withdraw your consent to the processing of personal data, or do not give such consent where it is required; f) to object to the processing of personal data or withdraw previously given consent; g) to request the suspension (except for storage) of the processing of your personal data, if there are disputes or it is necessary to verify the lawfulness of processing, the accuracy of the data, and also in cases where we no longer need your personal data but you do not want us to destroy it; h) to request, where technically feasible, that personal data collected on the basis of your consent or for the purpose of performing an agreement be provided in an easily readable format, or to request its transfer to another data controller.

12.2. We will endeavour to guarantee the exercise of your rights as a data subject and to create all conditions for the effective exercise of these rights; however, we reserve the right not to comply with your requests where it is necessary to ensure:

a) the performance of legal obligations imposed on us; b) state security or defence; c) public order, prevention, investigation, detection or prosecution of criminal offences; d) important economic or financial interests of the state; e) the prevention, investigation and detection of breaches of official or professional ethics; f) the protection of your rights and freedoms or those of other persons.

12.3. You may submit requests related to the exercise of your rights to us in person, by post or by electronic means. Upon receiving your request, we may ask you to provide identity documents, as well as other additional information related to the request that we need.

12.4. Upon receiving your request, we will respond no later than within 30 calendar days from the date of receipt of your request and of all the documents necessary to provide a response.

12.5. If we consider it necessary, we will suspend the processing of your data, except for storage, until your request is resolved. If you lawfully withdraw your consent, we will, without delay but no later than within 30 calendar days, stop the processing of your personal data, except in the cases set out in clause 12.2 of this Privacy Policy and in legislation, i.e. where applicable legislation, our legal obligations, court decisions or binding instructions of authorities require us to continue processing your data.

12.6. If we refuse to comply with your request, we will clearly state the basis for such refusal.

12.7. If you disagree with our actions or our response to your request, you may appeal against our actions and decisions to the competent state authority.

13. TO WHOM CAN YOU SUBMIT A COMPLAINT?

13.1. If you wish to submit a complaint about our processing of data, please submit it in writing, providing as much information as possible, using the contact details provided at the end of this policy. We will cooperate with you and try to resolve all issues without delay.

13.2. If you believe that, under the GDPR / other applicable personal data protection acts, your rights have been infringed, you may submit a complaint to our supervisory authority — the State Data Protection Inspectorate of the Republic of Lithuania; more information and contact details can be found on the inspectorate's website (https://vdai.lrv.lt/). Above all, however, we seek to resolve all disputes promptly and amicably together with you.

14. HOW WILL THIS PRIVACY POLICY BE CHANGED?

14.1. All changes to our Privacy Policy will be announced on the Website. In the event of material changes and/or where necessary, we will notify you about them. The terms of the new Privacy Policy may also be provided on the Website, and you may need to read and agree to them in order to continue using the Website and/or our services.

15. HOW TO CONTACT US?

15.1. Send all documents related to this Privacy Policy, or contact us, using the contacts below:

a) by post: Gedimino pr. 20, LT-01102, Vilnius;

b) by email: info@fuudo.eu;