PRIVACY POLICY
1. General Provisions
1.1. This Privacy Policy (hereinafter referred to as the "Policy") explains how personal data of visitors and customers is collected, used, stored, and otherwise processed through the online store https://amber-sisters.com.
1.2. Amber Sisters respects your privacy and is committed to processing personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other applicable legislation.
1.3. This Policy applies to individuals who visit our online store, place orders, contact us, or use other website features.
2. Data Controller
The controller of your personal data is:
Trading Name: Amber Sisters
Data Controller: Jurgita Vitkienė
Business Type: Individual Business Activity registered in Lithuania
Individual Activity Certificate No.: 1347140
Business Address: Kaltinėnų g. 23, Bartašiškė, Kaltinėnai Eldership, Šilalė District Municipality, LT-75493, Lithuania
Email: ambersisters1@gmail.com
Website: https://amber-sisters.com
For any questions regarding the processing of your personal data, you may contact us using the email address provided above.
3. What Personal Data Do We Collect?
Depending on how you use our website and which services you choose, we may process the following personal data:
3.1. Order and Delivery Data
First and last name.
Email address.
Telephone number.
Delivery and billing address.
Products ordered, quantities, and prices.
Order history and status.
Delivery information.
3.2. Payment Data
Selected payment method.
Payment amount, date, and status.
Payment transaction identifier, where provided.
Payments may be processed by external payment service providers. Depending on the payment method selected, payment card details may be submitted directly to these providers.
3.3. Communication Data
Inquiries submitted by email.
Correspondence content.
Information regarding returns, complaints, and warranty claims.
Other information you voluntarily provide when contacting us.
3.4. Technical Data
When you use our website, certain technical information may be processed automatically, including:
IP address.
Browser and device information.
Date and time of visits.
Website usage and technical error information.
Cookie identifiers, where applicable.
3.5. Marketing Data
If newsletters or other marketing features are used on our website, we may process your email address, consent information, and other data related to the selected service.
4. Purposes and Legal Bases for Processing Personal Data
We process personal data for the following purposes:
4.1. Order Fulfillment
Personal data is used to receive, process, prepare, and deliver orders, and to provide information about their status.
Legal basis: Performance of a contract or taking steps prior to entering into a contract (Article 6(1)(b) GDPR).
4.2. Payment Administration and Accounting
Personal data is used to administer payments, prepare accounting documents, and comply with statutory obligations.
Legal basis: Performance of a contract and compliance with a legal obligation (Articles 6(1)(b) and 6(1)(c) GDPR).
4.3. Customer Support
Personal data is used to respond to inquiries and resolve issues relating to deliveries, returns, product quality, and warranty claims.
Legal basis: Performance of a contract, compliance with a legal obligation, or legitimate interests in providing appropriate customer support, depending on the circumstances.
4.4. Website Security and Operation
Technical data may be processed to ensure the proper operation of the website, identify errors, and protect against unauthorized activities.
Legal basis: Legitimate interests in maintaining website security (Article 6(1)(f) GDPR), where applicable.
4.5. Website Analytics
If analytics tools are used, personal data may be processed to understand website traffic and improve website functionality.
Where non-essential cookies or similar technologies are used for analytics, they are activated only after obtaining the visitor's required consent.
4.6. Direct Marketing
If direct marketing activities are carried out, personal data is processed in accordance with applicable legislation.
Where consent is required, marketing communications are sent only after obtaining such consent.
Consent may be withdrawn at any time.
5. Who May Receive Your Personal Data?
Personal data may be shared, only to the extent necessary for the relevant purpose, with the following recipients:
Website hosting and e-commerce technology providers, including Hostinger, where their services are used.
Payment service providers, such as Paysera, if this payment system is used.
Shipping and logistics service providers.
Accounting and other administrative service providers, where necessary.
IT maintenance and technical support providers.
Analytics or marketing service providers, where their services are used and an appropriate legal basis exists.
Public authorities, where disclosure is required by law.
Service providers may act as data processors or independent data controllers, depending on the services they provide.
We do not sell your personal data.
6. Transfers of Personal Data Outside the European Economic Area
Some of our service providers may process personal data outside the European Economic Area (EEA).
In such cases, personal data is transferred only in compliance with GDPR requirements, including European Commission adequacy decisions or appropriate safeguards, such as Standard Contractual Clauses, where applicable.
Information about specific international data transfers and the safeguards applied is available upon request.
7. How Long Do We Retain Personal Data?
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable law.
Retention periods are determined according to the purpose of processing:
Order and accounting data: Retained in accordance with applicable accounting and tax legislation.
Customer inquiries: Retained for as long as necessary to respond to inquiries and resolve potential disputes.
Returns and warranty claims: Retained for as long as necessary to handle claims and exercise legal rights or obligations.
Marketing data: Retained for as long as the relevant legal basis applies, subject to established retention periods.
Technical data: Retained according to its purpose and applicable retention requirements.
After the applicable retention period expires, personal data is deleted or anonymized, unless further retention is required by law.
8. Your Rights
Under the GDPR, you have the following rights:
8.1. The right to receive information about the processing of your personal data.
8.2. The right to access your personal data.
8.3. The right to request correction of inaccurate or completion of incomplete personal data.
8.4. The right to request deletion of your personal data where the conditions established by the GDPR are met.
8.5. The right to request restriction of the processing of your personal data.
8.6. The right to object to processing based on legitimate interests, subject to the conditions established by law.
8.7. The right to data portability, where applicable.
8.8. The right to withdraw your consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, please contact us at:
We respond to requests within the time limits established by the GDPR, generally within one month of receiving the request, except where otherwise permitted by law.
9. Data Security
We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure.
Security measures are selected based on the nature of the personal data processed, potential risks, and the technologies used.
Although we strive to ensure appropriate data protection, no internet-based system can guarantee absolute security.
10. Cookies
Our website may use cookies and similar technologies necessary for website functionality, shopping cart operations, security, and other features.
Where non-essential analytics or marketing cookies are used, the applicable consent requirements are observed.
More detailed information is provided in our separate Cookie Policy.
11. Links to Third-Party Websites
Our website may contain links to third-party websites, including payment service providers and social media platforms.
These websites may process personal data under their own privacy policies.
We recommend reviewing their privacy policies before providing personal information.
12. Right to Lodge a Complaint
If you believe your personal data is being processed in violation of applicable law, you may contact us at:
You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI):
Website: https://vdai.lrv.lt
Email: ada@ada.lt
You may also contact a competent supervisory authority in another EU Member State where permitted under the GDPR.
13. Changes to This Privacy Policy
13.1. This Privacy Policy may be updated due to changes in legislation, technologies used, or personal data processing activities.
13.2. The updated version of the Policy will be published on our online store at https://amber-sisters.com.
13.3. Where significant changes are made, we will notify you through appropriate means where required by law.
13.4. The date of the most recent update is indicated at the beginning of this document.
14. Contact Information
Amber Sisters
Data Controller: Jurgita Vitkienė
Individual Activity Certificate No.: 1347140
Address: Kaltinėnų g. 23, Bartašiškė, Kaltinėnai Eldership, Šilalė District Municipality, LT-75493, Lithuania
Email: ambersisters1@gmail.com
Website: https://amber-sisters.com
Amber Sisters
Unique Baltic amber jewellery from a family studio in Lithuania.
© 2026 Amber Sisters