Legal information

Privacy Policy

How UAB „Herimejas" collects, uses and protects your personal data, and what rights you have.

Last updated: 2026-10-29

Data controller

The controller of your personal data is UAB „Herimejas", company code 134659243, Neries krant. 5A, Kaunas, Lithuania. The online store is kontakt.lt.

For any data protection matter, write to info@kontakt.lt or call +370 37 267565.

What data we process

We only process data needed for a specific purpose. The scope depends on how you use the site.

When ordering (with or without an account)

Name, surname, email, phone number, delivery address or chosen parcel locker, order contents and total. When buying on behalf of a company – also company name, code and VAT number.

With an account

The above, plus account type (individual, electrician, designer or business), your password (stored only as an irreversible cryptographic hash – we cannot read it), order history, saved items and accumulated „Kontakt euros".

Automatically

A cart cookie so your items are not lost while browsing.
Records of failed login attempts including IP address – without these we could not protect accounts against password guessing. These records expire automatically.
Anonymous analytics. IP addresses are masked with SHA-256, so no individual is identifiable.
Only with your consent (by clicking „Accept all" in the cookie banner or ticking a category): preferences – recently viewed products; statistics – where you came from and Google Analytics; marketing – Google Ads and Meta (Facebook, Instagram) Pixel. The Google and Meta tools record which pages you viewed, what you added to the cart and whether a purchase or enquiry took place, so that we can measure our advertising and show you relevant ads (remarketing). For purchases, if you allowed marketing, we send Google and Meta an encrypted hash (SHA-256) of your email address and phone number – they cannot recover the data from it, only match it with their own account data to attribute the purchase to an ad.

What we do not collect We never see or store payment card details – they go directly to the payment provider. We do not carry out automated decision-making with legal effects. Without your consent no Google or Meta tracking scripts are loaded on the site: Google Analytics only if you allow statistics, Google Ads and Meta only if you allow marketing.

Purposes and legal basis

Purpose	Legal basis
Fulfilling your order	Performance of a contract (Art. 6(1)(b))
Account administration	Performance of a contract (Art. 6(1)(b))
Accounting	Legal obligation (Art. 6(1)(c))
Newsletter	Your consent (Art. 6(1)(a)) — withdrawable at any time
Website security	Legitimate interest (Art. 6(1)(f))
Website improvement	Legitimate interest (Art. 6(1)(f))
Preferences (recently viewed products)	Your consent (Art. 6(1)(a)) — withdrawable at any time via the „Cookie settings" link at the bottom of the page
Statistics (where you came from, Google Analytics)	Your consent (Art. 6(1)(a)) — withdrawable at any time via the „Cookie settings" link at the bottom of the page
Marketing (Google Ads, Meta Pixel)	Your consent (Art. 6(1)(a)) — withdrawable at any time via the „Cookie settings" link at the bottom of the page

Who we share data with

We do not sell your data. We share it only with service providers, and only as much as needed:

Payment providers – Stripe (card payments) and Paysera (bank payments). They receive the order amount and reference; card data is handled by them under PCI-DSS.
Couriers and parcel locker networks – recipient name, phone and delivery address.
Hosting provider – the servers where the site data physically resides.
Cloudflare – bot protection on the registration and login forms.
Google Ireland Limited (Google Analytics, Google Ads) and Meta Platforms Ireland Limited (Facebook, Instagram) – only if you allowed the related cookies: Google Analytics – statistics, Google Ads and Meta – marketing. These companies may transfer data to the USA under the EU–US Data Privacy Framework and standard contractual clauses.
Public authorities – only where required by law.

How long we keep data

Data	Retention
Orders and accounting documents	10 years (legal requirement)
Account data	While your account exists; on deletion – removed, except what we must keep for accounting
Newsletter subscription	Until you unsubscribe
Login attempt records	Short term, for security
Anonymous analytics	Indefinitely — aggregated, no identity
Preference, statistics and marketing cookies	Up to 13 months (see the Cookies section); removed when you withdraw consent or clear them in your browser

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, object, data portability, and to withdraw consent at any time (withdrawal does not affect processing carried out before it).

Write to info@kontakt.lt. We reply within 30 calendar days.

Complaint If you believe we handle your data improperly, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt). We would appreciate it if you contacted us first — most issues are resolved quickly.

Cookies

Necessary cookies are always used — the store cannot work without them. Preference, statistics and marketing cookies are set only when you allow them in the cookie banner: all („Accept all") or the ticked ones („Save selection"). You can change your choice at any time via „Cookie settings" at the bottom of the page; when you withdraw consent, the cookies of that category are deleted.

Cookie	Purpose	Expires
Necessary — always
cart_session	Keeps your cart while you browse	30 days
KONTAKTSESS	Session: login state and form-forgery protection	When the browser closes
kontakt_remember	Only if you tick „Remember me" — keeps you signed in next time	30 days
kontakt_slapukai	Remembers your cookie choice	1 year
Cloudflare	Tells humans from bots on registration and login forms	Short term
Preferences — only with consent
kv_perziureta	Recently viewed products	30 days
Statistics — only with consent
kontakt_src	Where you came from (search, an ad or another site) — for our own statistics	30 days
_ga, _ga_*	Google Analytics: visit and purchase statistics	Up to 13 months
Marketing — only with consent
_gcl_au	Google Ads: which ad led to a purchase or enquiry	90 days
_fbp	Meta (Facebook, Instagram): ad measurement and remarketing	90 days

Security

The site runs over encrypted HTTPS. Passwords are stored only as irreversible cryptographic hashes. Access to order data is limited to staff who need it for their work.

Changes to this policy

We may update this policy, for example when new services appear or laws change. The current version is always published on this page, with the date shown at the top.