Privacy policy

Last updated: 7 November 2026

1. Who is responsible for your data

This policy explains personal data used for amberalexstore.com, including shopping, customer accounts, enquiries, reviews and marketing connected with this store.

The data controller is Alekso gintaras, UAB, trading as Amber Alex Jewelry, company number 303150296, VAT number LT100008084512, at Bendrovių g. 7, LT-00147 Palanga, Lithuania. For privacy requests, email social@amberalex.lt. For orders, returns or delivery, email sales@amberalex.lt.

2. The information we use

Depending on how you interact with us, we use:

• Contact and account details: your name, email, telephone number, delivery and billing addresses, company details where supplied, and account or sign-in identifiers.
• Order details: the items and options you select, order history, payment status, transaction references, delivery and tracking information, returns and refunds. Payment providers handle payment credentials; do not send full card details to us by email or chat.
• Messages and content: enquiries, quotes, chat or WhatsApp conversations you choose to send, reviews, photos and other information you provide.
• Technical and usage data: IP address, browser and device information, cookie or similar identifiers, pages and products viewed, shopping events and consent choices. Advertising integrations can also use purchase events and, where enabled, encoded contact identifiers. Encoding does not make personal data anonymous.

3. Why we use it and our legal grounds

To take and fulfil orders, provide accounts, deliver goods and handle returns: processing is necessary to enter into or perform our contract with you (GDPR Article 6(1)(b)). If you contact us about a possible purchase, this also covers steps you ask us to take before a contract.

To meet accounting, tax, consumer-law and other legal duties: we use the records needed to comply with those duties (Article 6(1)(c)).

To secure the store, prevent fraud, deal with ordinary enquiries, administer reviews and establish or defend legal claims: we rely on legitimate interests in operating a safe business and resolving issues fairly (Article 6(1)(f)), where those interests are not overridden by your rights.

For marketing subscriptions and non-essential analytics or advertising where consent is required: we rely on your consent (Article 6(1)(a)). Subscribing is optional. You can withdraw consent without affecting the lawfulness of earlier processing. Order and service messages are separate from promotional messages.

Some information is needed to accept payment, deliver goods or meet legal duties. If you do not provide it, we may be unable to complete the order or request. We do not require optional marketing consent to make a purchase.

We receive information from you, from your use of the store, and from service providers, such as payment and delivery status from payment or shipping providers. For public reviews, your chosen display name and the content you submit can be visible.

4. Cookies and advertising choices

Necessary cookies and similar storage support functions such as the cart, checkout, security, language and consent records. Non-essential technologies can measure visits, improve marketing and show or measure advertising. Where the law requires consent, these uses require your agreement.

Use the cookie banner’s choices where it is displayed. You can also manage or remove cookies through your browser; removing them may reset preferences or require you to sign in again. Blocking necessary storage can stop parts of the store from working. Contact social@amberalex.lt to withdraw a consent or ask about your choices. An advertising opt-out does not stop ordinary order communications.

The store has Google & YouTube and Facebook & Instagram integrations for measurement and advertising. Depending on your consent and the enabled features, Google and Meta can receive online identifiers, browsing and order events, and encoded contact details for matching or campaign measurement. Their services may link information to accounts you hold with them. This data is not necessarily anonymous. See Google’s privacy policy and Meta’s privacy policy.

5. Service providers and other recipients

We share information needed for the particular service, rather than sending every recipient your whole customer record. Recipient categories include:

• Shopify and its service providers: storefront hosting, checkout, accounts, security, analytics, store administration, messaging and chat. Shopify can also act as an independent controller for certain services it provides to you. See Shopify’s Consumer Privacy Policy, its privacy policy and privacy portal.
• Payment providers and banks: payment authorisation, settlement, fraud prevention and refunds for the method you select.
• Delivery providers and shipping integrations: name, address, contact and parcel details needed to arrange and complete delivery, including customs where relevant.
• Communication and review tools: Shopify Messaging, MailerLite, Shopify chat and Judge.me, as relevant to your subscription, enquiry or review. If you choose WhatsApp, Meta also processes that conversation under its own terms and privacy information. See MailerLite’s privacy policy and Judge.me’s privacy policy.
• Google and Meta for the analytics and advertising described above, subject to the applicable choices and legal grounds.
• Professional advisers, accountants, authorities or courts where needed for legal duties, fraud investigation or a legal claim. A business successor may receive relevant records in a lawful transfer of the business, subject to applicable safeguards.

6. International processing

Our providers can process information in countries outside Lithuania or the European Economic Area. Where GDPR transfer rules apply, a transfer must have an appropriate basis, such as a European Commission adequacy decision or approved standard contractual clauses with any required additional safeguards. Provider privacy information explains their arrangements. Contact social@amberalex.lt to ask about the safeguards relevant to your data.

7. How long information is kept

The period depends on the purpose and the applicable legal requirements. We keep order, invoice and accounting records for the periods required by tax and accounting law; records relevant to an unresolved dispute may need to be kept until it is resolved and any legal retention period ends.

Account and service records are kept while needed to provide the account or service and deal with related requests. Enquiry, quote, chat and review records are kept for their relevant customer-service or publication purpose, taking account of any related purchase or claim.

Marketing details are used while the subscription remains active. After an opt-out, a limited suppression record may be retained so we can respect your choice and show that we complied. Consent and security records are kept for as long as needed to demonstrate or protect lawful processing. Provider and cookie retention periods can differ; contact us for information about a specific record. We do not keep data merely because you once visited the site.

8. Your rights and how to use them

Depending on the legal conditions, you can ask to access your data, correct it, delete it, restrict its use or receive a portable copy. You can object to processing based on legitimate interests, and you can object to direct marketing at any time. Consent can be withdrawn at any time. These rights have legal limits: for example, deleting an account does not require us to erase invoices we must keep by law.

Email social@amberalex.lt, preferably from the address associated with your order or account, and explain your request. Do not send identity documents unless we ask for information reasonably needed to confirm your identity. Requests are normally free. We respond without undue delay and normally within one month; if a lawful extension is needed for a complex request, we explain this within that first month.

Use the unsubscribe link in a marketing email to stop those emails, or contact us. You can complain to the Lithuanian State Data Protection Inspectorate (VDAI) at vdai.lrv.lt, or to the competent authority where you live, work or believe an infringement occurred. You do not have to contact us first to complain to an authority.

9. Security, children and changes

We use the platform and service-provider safeguards appropriate to operating the store, but no online service can promise absolute security. Keep your sign-in details safe and tell us about suspected misuse.

The store is intended for purchases by adults or people legally able to enter the purchase. We do not ask children to subscribe or create customer accounts. If you believe a child has provided information without appropriate authorisation, contact us so we can review it.

We update this policy when our practices or legal requirements change. The date above identifies this version. Material changes will be communicated where the law requires it.