Who is responsible for your data

The controller of the personal data described here is [[ЗАПОЛНИТЬ: юридическое название продавца]], [[ЗАПОЛНИТЬ: юридический адрес]], Lithuania.

For anything about your data, write to hello@plastic-room.com.

What we collect, and why we are allowed to

We ask for the least an order can be completed with. The legal bases are those of the GDPR (Regulation (EU) 2016/679).

• —Order data: your name, delivery address, email address, a phone number if you give one, the items and options you chose, and the amount paid. Basis: performance of the contract, Article 6(1)(b). Without it we cannot print your order or get it to you.
• —Payment data: handled by our payment provider. We see that a payment succeeded and its reference; we never see or store your full card number. Basis: performance of the contract.
• —Invoices and accounting records: Basis: a legal obligation we are under, Article 6(1)(c).
• —Emails and messages you send us: kept so we can answer you and show what was agreed. Basis: our legitimate interest in handling customer contact, Article 6(1)(f).
• —Files you upload for a custom print: used to quote, prepare and print the part, and for nothing else. Basis: performance of the contract and steps taken at your request before it.
• —Website technical data and cookies: [[ЗАПОЛНИТЬ: используется ли аналитика и какие cookies, кроме строго необходимых]].

We do not sell your data, we do not use it for advertising profiles, and no decision about you is made by automated means alone.

Who else sees it

Only the companies that make the shop work, and only with what they need:

[[ЗАПОЛНИТЬ: список поставщиков услуг — хостинг, база данных, платежи, перевозчик, почтовый сервис — с названиями компаний]]

They process the data on our instructions under a data processing agreement, not for their own purposes.

We also disclose data where a law, a court or a public authority requires it.

Data leaving the EEA

[[ЗАПОЛНИТЬ: обрабатывает ли кто-то из поставщиков данные за пределами ЕЭЗ и на каком основании — решение об адекватности или стандартные договорные условия]]

Where such a transfer happens, it is covered by an adequacy decision of the European Commission or by standard contractual clauses, and you can ask us for a copy of the safeguard in place.

How long we keep it

• —Orders, invoices and accounting records: for the period Lithuanian accounting and tax law requires — [[ЗАПОЛНИТЬ: срок хранения бухгалтерских документов, подтверждённый бухгалтером]].
• —Files you uploaded for a custom print: [[ЗАПОЛНИТЬ: срок хранения загруженных моделей, например 90 дней после выполнения заказа]], or sooner if you ask.
• —Emails and messages: for as long as needed to deal with the matter and any claim that could follow it.

When a period ends the data is deleted or anonymised.

Your rights

You may ask us for a copy of your data, to correct it, to erase it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on your consent you may withdraw it at any time, which does not affect what was lawful before you did.

Write to hello@plastic-room.com. We answer within one month.

If you think we handled your data badly you may complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or to the supervisory authority in the EU country where you live.

How it is kept

The site is served over an encrypted connection. Access to order data is limited to the people who need it to fulfil orders, and to the service providers listed above.

No system is absolutely secure, and we do not claim otherwise. If a breach ever put your rights at serious risk we would tell you and the supervisory authority as the GDPR requires.