1.1. By reading this privacy policy (hereinafter – Privacy Policy), you will learn how and for what purposes we process your personal data, where we obtain it from, to whom we provide it, how we protect it, and what your rights are as a data subject.

1.2. The Privacy Policy also sets out the privacy conditions for using our website www.cafflike.lt (hereinafter – the Website) and our social media accounts. Please read this Privacy Policy carefully, as each time you visit our Website and/or social media accounts, you agree to the terms of the Privacy Policy. If you do not agree with these terms, please do not visit our Website and/or social media accounts.

1.3. The Privacy Policy applies to individuals who visit the Website and/or our social media accounts, regardless of whether you are our customer or not, as well as to actions you may perform on the Website and/or our social media accounts.

1.4. In this Privacy Policy, the term "personal data" refers to any information that can identify you – directly or indirectly – as an individual. Personal data includes your surname, first name, email address, phone number, location data, internet identifier, characteristics specific to you, etc.

2.1. The Website is managed and administered by MB LUNARTA, legal entity code 305624775, registered office address Žygio g. 97, R2 LT-08236, Vilnius, contact address Metalo g. 21, Vilnius, email info@cafflike.lt, contact phone number +370 64813865.

2.2. According to the provisions of the law, we are the controller of your personal data.

3.1. When processing your personal data, we will:

• Comply with applicable and relevant laws, including the GDPR requirements;
• Process your personal data in a lawful, fair, and transparent manner;
• Collect your personal data for specified, clearly defined, and legitimate purposes and will not process it in a manner incompatible with those purposes, except as permitted by law;
• Take all reasonable measures to ensure that personal data which is inaccurate or incomplete, considering the purposes for which it is processed, is promptly corrected, supplemented, processing is suspended, or it is destroyed;
• Keep your data in a form that permits identification for no longer than necessary for the purposes for which the personal data is processed;
• Not disclose personal data to third parties and not make it public, except in cases specified in the Privacy Policy or applicable laws;
• Ensure that your personal data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.

4.1. We will process your personal data for the following purposes:

• To improve the Website, offering you better and more personalized services;
• With your consent – to provide you with offers and information about our services;
• For other purposes, when we are required to process your personal data by law or when there is a legitimate interest.

5.1. We process your personal data obtained through the following methods:

• When you provide them to us (e.g., when you submit your contacts);
• When you use the Website and/or our accounts (e.g., IP address, type of internet browser used, number of visits, pages viewed on the Website, time spent on the Website, demographic data, information about subscribers directed through social networks, unique IDs, etc.);
• When we receive your personal data from other persons in accordance with legal provisions.

5.2. You provide us with your personal data and other information by using the Website and/or our accounts, registering, writing to us, or communicating with our customer service team, including submitting complaints about our services or other matters. When you contact us in writing or by email, we retain the correspondence details.

5.3. The information you provide to us may include your name, surname, email address, phone number, and the content of messages (e.g., recording the circumstances of a complaint).

5.4. When you use the Website and/or our accounts, certain non-personal information (e.g., IP address, type of internet browser used, number of visits, pages viewed on the Website, time spent on the Website, demographic data, information about subscribers directed through social networks, unique IDs, etc.) is collected automatically. This information is used to improve the content, functionality, and attractiveness of the Website.

5.5. We may combine the personal data we receive from you with data collected from other public or accessible sources. For example, we may combine your provided personal data with data collected using Website cookies, data collected while providing services to you, or with lawfully obtained data from third parties. You always have the right to request correction of inaccurate personal data when exercising your rights.

No.

7.1. We guarantee that your personal data will not be sold, provided, or otherwise transferred to third parties without lawful basis, nor used for purposes other than those for which they were collected. We will not transfer your personal data in any way other than in accordance with this Privacy Policy and applicable laws. However, we reserve the right to provide information about you if required to do so by law or if requested by law enforcement or regulatory authorities.

7.2. We may disclose the data collected about you to the following third parties:

• Third-party service providers (e.g., technical service providers fulfilling our contracts with these service providers).
• Third-party service providers typically used for data storage, telecommunications, and website hosting purposes.

7.3. The ability of the aforementioned service providers to use your data is limited; they may only use this data for the purposes of providing services to us.

8.1. The data collected for the purpose specified in Privacy Policy section 4.1. (a) will be retained for no longer than 2 years from the date you give your consent.

8.2. The data collected for the purpose specified in Privacy Policy section 4.1. (b) will be retained for no longer than 2 years from the date you give your consent.

8.3. In any case, we will retain your personal data no longer than necessary for the purposes of data processing or as required by applicable laws, if they specify a longer retention period.

8.4. We aim not to retain outdated or irrelevant personal data. Therefore, only current information is stored after updates (e.g., corrections, changes in information, etc.). Historical information is retained if required by law or for our operational needs.

9.1. The data we collect from you will be stored within the EU territory. It may also be processed by our personnel or personnel of our suppliers operating within the EU territory.

9.2. Unfortunately, transmitting information over the internet is not completely secure.
While we make every effort to protect your personal data, we cannot guarantee the security of data transmitted to the Website – you assume the risk associated with transmitting data to the Website. Upon receiving your data, we apply strict procedures and security measures to protect your data from unauthorized access.

9.3. In the unlikely event of a security breach resulting in a high risk to your rights or freedoms, we will promptly inform you as soon as we become aware of it and specify the nature of the breach and the information accessed, if possible.

10.1. When processing your personal data, we ensure your rights under the GDPR and the Republic of Lithuania's Law on Personal Data Protection. As a data subject, you have the following rights:

• To know (be informed) about the processing of your personal data;
• To access your personal data that we process;
• To request correction, supplementation, or clarification of inaccurate or incomplete personal data;
• To request deletion of personal data when they are no longer necessary for the purposes for which they were collected;
• To request deletion of personal data if they are processed unlawfully or if you withdraw your consent for data processing and there is no other legal basis for processing;
• To object to the processing of personal data or to withdraw consent previously given;
• To request the restriction (except for storage) of the processing of your personal data in case of disputes or to verify the lawfulness of data processing, data accuracy, or in cases where we no longer need your personal data but you do not want us to delete it;
• To request the transfer, if technically feasible, of your personal data collected with your consent or for the performance of a contract, in a readable format or to request its transmission to another data controller.

10.2. We will endeavor to ensure the exercise of your rights as a data subject and create all conditions for the effective implementation of these rights. However, we reserve the right not to comply with your requests when it is necessary to ensure:

• Compliance with legal obligations imposed on us;
• State security or defense;
• Public order, prevention, investigation, detection, or prosecution of criminal offenses;
• Important state economic or financial interests;
• Prevention, investigation, and detection of official or professional ethics violations, or
• Protection of your or others' rights and freedoms.

10.3. You can submit requests related to the exercise of your rights in person, by post, or electronically. Upon receiving your request, we may ask you to provide identity documents and any other necessary information related to your request.

10.4. We will respond to your request no later than 30 calendar days from the date of receipt of your request and the submission of all necessary documents for the response.

10.5. If deemed necessary, we will suspend the processing of your data, except for storage, until your request is resolved. Upon lawful withdrawal of consent, we will immediately, but no later than 30 calendar days, cease processing your personal data, except as provided in section 12.2 of this Privacy Policy and as required by applicable laws, legal obligations, court decisions, or mandatory instructions from authorities.

10.6. If we refuse to comply with your request, we will clearly state the reasons for such refusal.

10.7. If you disagree with our actions or response to your request, you have the right to lodge a complaint with the competent state authority.

11.1. Send all documents related to this Privacy Policy to the following contacts:

• by mail – MB "Lunarta", contact address Metalo str. 21, Vilnius;
• by email – info@cafflike.lt.