Privacy Policy
1. About us and this Policy
1.1Mėlyna Aqua, UAB (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy (the “Policy”) explains how we collect, use, store and otherwise process your personal data when you visit our websites melyna-aqua.com and shop.melyna-aqua.com (together, the “Website”), purchase, lease or rent our products, subscribe to or otherwise use our services, contact us or receive our communications. It also describes your rights in relation to your personal data and how you can exercise them.
1.2We are the controller of your personal data within the meaning of Regulation (EU) 2016/679 (the “GDPR”). This means that we determine the purposes and means of the processing of your personal data and are responsible for processing it lawfully, fairly and transparently.
1.3We process your personal data in accordance with the GDPR, the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania and other applicable legislation.
1.4This Policy does not apply to third-party websites, applications or services that you may access through links on our Website or that are operated by third parties (for example, payment, advertising or social media platforms). Such third parties process your personal data under their own privacy policies, which we recommend that you read.
2. Our contact details
2.1If you have any questions regarding this Policy or the processing of your personal data, or wish to exercise your rights, please contact us at:
Mėlyna Aqua, UAB
Registration code: 307023467
Address: Žalgirio g. 90-100, LT-09300 Vilnius, Lithuania
Phone: +370 5 250 8319
Email: info@melyna-aqua.com
3. To whom this Policy applies
3.1This Policy applies to the processing of personal data of:
3.1.1customers who purchase, lease or rent our products or subscribe to our services, and persons acting on behalf of business customers (“Customers”);
3.1.2persons who create an account on the Website (“Users”);
3.1.3persons who contact us through the Website, by email, by phone or otherwise, or who subscribe to our newsletter;
3.1.4visitors of the Website.
3.2If you provide us with personal data of another person (for example, the person who will receive our products or services at a particular address), you must ensure that you are entitled to do so and that the person concerned has been informed of this Policy.
4. Categories of personal data we process and their sources
4.1Depending on how you interact with us, we may process the following categories of personal data:
| Category of data | Personal data processed | Source of data |
|---|---|---|
| Identification and contact data | First name, surname, email address, phone number, delivery and installation address, invoicing address. If you act on behalf of a business customer: company name, registration code, VAT number, your position and the company’s contact details. | Provided by you when you place an order, request a quotation or a call, create an account, contact us or subscribe to our newsletter. |
| Account data | Email address (login name), password (stored in encrypted form), account identifier, account status, date and time of registration and logins, order history linked to the account. | Provided by you when you create an account and generated by our systems when you use it. |
| Order and contract data | Products or services ordered, type of arrangement (purchase, lease, rental, subscription), prices, discounts, order date and time, order status, installation and maintenance schedule, filter replacement dates, warranty and repair records, returns and refunds, acceptance of our terms and of this Policy (date and time). | Provided by you when you place an order, and generated by us and our service partners in the course of performing the order. |
| Payment data | Payment method, payment date, time and amount, payment status, payment identifier assigned by the payment service provider, last four digits of the card and card expiry date. We never receive or store your full card number or security code: these are entered directly on the secure payment page of our payment service provider Stripe. For payments by bank transfer: payer name and bank account number. | Provided by you when you pay, and received from Stripe or your bank. |
| Communication data | Content of your enquiries, call-back requests, complaints and other correspondence with us (via the Website forms, email or phone), the date and time of the communication and our responses. | Provided by you when you contact us. |
| Marketing consents and preferences | Your consent to receive our newsletter, the date and time of consent and of its withdrawal, information on newsletters sent, delivered and opened and on links clicked, your cookie preferences. | Provided by you when you subscribe or change your preferences, and generated by our newsletter and cookie consent tools. |
| Website usage and technical data | IP address, cookie and device identifiers, browser type and version, operating system, screen resolution, language, time zone, referring address and campaign (UTM) parameters, pages viewed, products viewed, time and duration of visits, clicks and navigation paths, server log data. | Collected automatically from your device by our Website, our hosting provider and, subject to your consent, by cookies and similar technologies of our analytics and advertising partners (see our Cookie Policy [add link to the Cookie Policy]). |
4.2We do not process special categories of personal data (such as health data or biometric data) and ask you not to provide such data to us.
4.3Where personal data are necessary for us to enter into or perform a contract with you, or are required by law, we will tell you so when we collect them. If you do not provide such data, we may be unable to process your order, provide our services or respond to your request.
5. Purposes and legal bases of processing and retention periods
5.1We process your personal data only for the purposes set out below, on the legal bases indicated and for no longer than necessary for those purposes. Where we rely on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal.
5.2 Sale, lease and rental of products and performance of orders
We process your personal data to receive, confirm and perform your orders for our water treatment products, whether you purchase them outright or take them on lease, rental or subscription terms, including to issue invoices, process payments, arrange delivery and installation, handle returns, refunds, warranty and complaint matters, and communicate with you about your order.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Identification and contact data, account data, order and contract data, payment data, communication data relating to the order. | Performance of a contract with you or taking steps at your request before entering into a contract (Article 6(1)(b) of the GDPR). Where you act on behalf of a business customer: our legitimate interest in concluding and performing the contract with that customer (Article 6(1)(f) of the GDPR). | 10 years after the order is performed or the contract ends, as required by Lithuanian accounting and archiving legislation for the retention of accounting documents. |
5.3 Provision of services (installation, maintenance, filter replacement, repairs)
Where you subscribe to or otherwise use our services, we process your personal data to schedule and carry out installation, periodic maintenance and repairs, to send you replacement filters and membranes, to remind you of upcoming service dates and to manage your subscription (including its renewal, suspension and cancellation).
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Identification and contact data, order and contract data, payment data (including recurring payments), communication data relating to the services. | Performance of a contract with you (Article 6(1)(b) of the GDPR). | For the duration of the service relationship and 10 years thereafter for data contained in accounting documents. |
5.4 Customer account on the Website
If you create an account on the Website, we process your personal data to register and administer your account, to allow you to log in, view your orders and manage your data, and to ensure the security of your account.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Account data, identification and contact data, order and contract data linked to the account. | Performance of a contract with you (the terms of use of the Website) (Article 6(1)(b) of the GDPR). | Until you delete your account or ask us to delete it. Order and accounting data are then retained for the period indicated in Clause 5.2 above. |
5.5 Responding to enquiries, call-back requests and other communications
When you contact us through the contact or call-back forms on the Website, by email or by phone, we process your personal data to respond to your enquiry, to prepare a quotation, to call you back at the number you have provided and to handle complaints.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Identification and contact data, communication data. | Taking steps at your request before entering into a contract (Article 6(1)(b) of the GDPR) and our legitimate interest in responding to enquiries and maintaining relations with existing and prospective customers (Article 6(1)(f) of the GDPR). | 1 year after our last communication with you on the matter, unless the enquiry results in an order (in which case the data are retained with the order) or is needed for the establishment, exercise or defense of legal claims. |
5.6 Newsletter
If you subscribe to our newsletter, we will send you by email information about our products, services, offers and news. You may unsubscribe at any time by clicking the link included in every newsletter or by contacting us. We use a newsletter platform to manage subscriptions and send newsletters, and an email delivery service (SMTP2GO) to deliver transactional and other emails. The platform records whether a newsletter was delivered and opened and which links were clicked, so that we can assess the effectiveness of our communications.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Email address, name (if provided), date and time of consent and of its withdrawal, newsletter delivery, opening and click data. | Your consent (Article 6(1)(a) of the GDPR and the Law on Electronic Communications of the Republic of Lithuania). | Until you withdraw your consent, but no longer than 3 years from the date of consent, after which we will ask you to confirm your subscription again. We keep a record of the fact of your consent and of its withdrawal for 10 years for the purpose of demonstrating compliance. |
5.7 Website analytics
Subject to your consent given through the cookie consent banner, we use Google Analytics to understand how visitors use our Website (pages viewed, time on page, navigation paths, traffic sources, approximate location derived from a truncated IP address) and to improve its content and functionality. We use the resulting statistics in aggregated form and do not use them to identify individual visitors.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Website usage and technical data (online identifiers, technical data, behavioral data). | Your consent (Article 6(1)(a) of the GDPR and the Law on Electronic Communications of the Republic of Lithuania). | Cookie-based identifiers: for the periods set out in our Cookie Policy. User- and event-level data in Google Analytics: for the retention period selected in our Google Analytics settings (up to 14 months), after which they are automatically deleted. Aggregated reports: for as long as they remain useful for analytical purposes. |
5.8 Advertising and measurement of advertising effectiveness
Subject to your consent given through the cookie consent banner, we use the advertising tools of Google (Google Ads), Meta (Facebook and Instagram) and LinkedIn (LinkedIn Ads), including their tags and pixels placed on the Website, to show our advertisements to you and to persons with similar interests on those platforms, to measure whether visitors who have seen our advertisements visit the Website or place an order (conversion measurement), and to optimise our campaigns. We do not upload lists of our customers to these platforms and do not use your personal data for advertising without your consent.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Website usage and technical data (online identifiers, technical data, behavioural and conversion events such as page views, products viewed, call-back requests and orders). | Your consent (Article 6(1)(a) of the GDPR and the Law on Electronic Communications of the Republic of Lithuania). In respect of the collection of data through the Meta and LinkedIn tags and their transmission to Meta and LinkedIn, we and those providers act as joint controllers (Article 26 of the GDPR). The essence of these arrangements is available from the providers’ terms referred to in Clause 6 and on request from us. | Cookie-based identifiers: for the periods set out in our Cookie Policy. Campaign and conversion data held by the advertising platforms: for the periods set out in the respective platform’s terms, after which they are deleted or aggregated by the platform. |
5.9 Embedded YouTube videos
Our Website may contain videos hosted on YouTube (a service of Google). The videos are embedded in privacy-enhanced mode and are loaded only when you play them. When you play a video, YouTube may set cookies and collect data on your device and may associate it with your Google account if you are logged in. Such processing is governed by Google’s privacy policy.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Website usage and technical data (online identifiers, technical data, information on videos played). | Your consent, given when you choose to play the video and, where applicable, through the cookie consent banner (Article 6(1)(a) of the GDPR). | Cookie-based identifiers: for the periods set out in our Cookie Policy and in Google’s privacy policy. |
5.10 Security and proper functioning of the Website
We process technical data to operate the Website, to ensure its security and stability, to detect and prevent fraud, abuse and attacks, and to resolve technical problems. Our Website is hosted by Hostinger, whose servers record access logs.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Website usage and technical data (IP address, date and time of access, pages requested, browser and device information, server log data), account data. | Our legitimate interest in ensuring the security and proper functioning of the Website and in protecting our systems, customers and business (Article 6(1)(f) of the GDPR). | Server logs: [__] days from the date of recording, unless a security incident requires longer retention. |
5.11 Compliance with legal obligations
We process your personal data to comply with our obligations under accounting, tax, consumer protection and other applicable legislation, including to issue and retain invoices and accounting documents and to respond to lawful requests of courts, supervisory and law enforcement authorities.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Identification and contact data, order and contract data, payment data and other data required by the relevant legislation. | Compliance with a legal obligation to which we are subject (Article 6(1)(c) of the GDPR). | For the period required by the relevant legislation (for accounting documents, 10 years). |
5.12 Establishment, exercise and defence of legal claims
Where necessary, we process your personal data to establish, exercise or defend legal claims, for example, in the event of unpaid invoices, product returns, warranty disputes or complaints.
| Categories of personal data | Legal basis | Retention period |
|---|---|---|
| Any of the above categories of data to the extent relevant to the claim. | Our legitimate interest in establishing, exercising and defending legal claims (Article 6(1)(f) of the GDPR). | For the duration of the dispute and the applicable limitation period under the Civil Code of the Republic of Lithuania (as a rule, 10 years), and until the dispute is finally resolved. |
5.13When a retention period expires, we delete or irreversibly anonymise the relevant personal data. Where data are relevant to an ongoing investigation, dispute or claim, we retain them until the matter is finally resolved.
6. Recipients of personal data
6.1We do not sell your personal data and do not disclose them to third parties except as described in this Policy. We share your personal data with the following categories of recipients, to the extent necessary for the purposes described above:
6.1.1Service providers acting as our processors, who process personal data on our behalf and on our documented instructions under written data processing agreements that meet the requirements of Article 28 of the GDPR. Our principal processors are:
| Service provider | Service | Personal data concerned |
|---|---|---|
| Hostinger International Ltd. (Cyprus) and its group companies | Hosting of the Website and of the data stored on it | All data stored on the Website, including account, order and communication data and server logs |
| SMTP2GO Ltd. (New Zealand) | Delivery of emails sent by the Website (order confirmations, account and service notifications, newsletters) | Email address, name, content of the emails sent, delivery data |
| [__] | Newsletter platform (management of subscriptions and sending of newsletters) | Email address, name (if provided), consent and preference data, newsletter delivery and engagement data |
| Google Ireland Limited | Google Analytics (website analytics) | Website usage and technical data, subject to your consent |
| External accounting services provider | Bookkeeping and preparation of accounts and tax returns | Data contained in invoices and other accounting documents |
| Installation and maintenance contractors | Installation, maintenance and repair of products at your premises | Name, phone number, installation address, information on the equipment and the services ordered |
6.1.2Independent controllers, who process your personal data for their own purposes and under their own privacy policies:
| Recipient | Purpose | Personal data concerned |
|---|---|---|
| Stripe Payments Europe, Ltd. (Ireland) and its group companies | Processing of card payments, including recurring payments, and prevention of payment fraud. Stripe acts as an independent controller for the purposes of payment processing and its regulatory obligations. | Name, email address, payment card data (entered directly on Stripe’s payment page), payment amount, date and identifier, IP address and device data collected by Stripe |
| Courier and postal service providers | Delivery of products, filters and membranes | Name, phone number, email address, delivery address, information on the parcel |
| Google Ireland Limited (Google Ads, YouTube) | Advertising, conversion measurement and video playback | Website usage and technical data, subject to your consent |
| Meta Platforms Ireland Limited (Facebook, Instagram) | Advertising and conversion measurement (joint controllership in respect of the data collected through the Meta tag) | Website usage and technical data, subject to your consent |
| LinkedIn Ireland Unlimited Company (LinkedIn Ads) | Advertising and conversion measurement (joint controllership in respect of the data collected through the LinkedIn tag) | Website usage and technical data, subject to your consent |
| Banks and payment institutions | Execution of bank transfers | Payer name, account number, payment details |
| Courts, supervisory, tax and law enforcement authorities, bailiffs, notaries | Compliance with legal obligations and establishment, exercise or defense of legal claims | Data required by the relevant authority or proceedings |
| Professional advisers (lawyers, auditors, debt collection agencies) | Legal, audit and debt recovery services | Data necessary for the service concerned |
7. Transfers of personal data outside the European Economic Area
7.1We store your personal data within the European Union and the European Economic Area (“EEA”). Some of our service providers and advertising partners listed above are established, or have group companies, outside the EEA. Where your personal data are transferred outside the EEA, we ensure that one of the safeguards provided for in Chapter V of the GDPR applies:
7.1.1New Zealand (SMTP2GO Ltd.): the European Commission has recognised New Zealand as providing an adequate level of data protection (Commission Implementing Decision 2013/65/EU), so no additional safeguards are required.
7.1.2United States of America (Google LLC, Meta Platforms, Inc., LinkedIn Corporation, Stripe, Inc.): transfers take place on the basis of the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the recipient is certified under it, and otherwise on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, supplemented by additional measures where necessary.
7.1.3Other countries: transfers take place on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 or another safeguard permitted by the GDPR.
7.2You may request a copy of the relevant safeguards or further information on the transfers by contacting us using the details in Clause 2 of this Policy.
8. Automated decision-making and profiling
8.1We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The advertising tools described in Clause 5.8 use cookie-based data to select the advertisements shown to you on third-party platforms only where you have consented to this, and this does not produce legal or similarly significant effects for you.
9. Security of personal data
9.1We apply appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, including encrypted connections to the Website (HTTPS), access controls, encrypted storage of passwords, the use of a certified payment service provider so that card data never reach our systems, and the selection of service providers that offer sufficient guarantees of security. We have procedures in place to deal with any personal data breach and will notify you and the supervisory authority where required by law.
10. Children
10.1Our Website, products and services are intended for adults. We do not knowingly collect personal data of persons under 18 years of age. If you are under 18, please do not submit any personal data to us. If we become aware that we have collected personal data of a child without the consent of a parent or guardian, we will delete them.
11. Your rights
11.1Under the GDPR, you have the following rights in relation to your personal data, which you may exercise free of charge (some rights apply only in certain circumstances):
11.1.1Right of access (Article 15 of the GDPR): to obtain confirmation whether we process your personal data and, if so, a copy of the data and related information.
11.1.2Right to rectification (Article 16 of the GDPR): to have inaccurate personal data corrected and incomplete data completed.
11.1.3Right to erasure (Article 17 of the GDPR): to have your personal data deleted in certain circumstances, for example, where they are no longer necessary or you have withdrawn your consent. We may refuse erasure where we are required by law to retain the data or need them for legal claims.
11.1.4Right to restriction of processing (Article 18 of the GDPR): to have the processing of your personal data restricted in certain circumstances, for example, while the accuracy of the data is being verified.
11.1.5Right to data portability (Article 20 of the GDPR): to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to have them transmitted to another controller, where the processing is based on consent or a contract and carried out by automated means.
11.1.6Right to object (Article 21 of the GDPR): to object, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object at any time, without giving reasons, to processing for direct marketing purposes.
11.1.7Right to withdraw consent: where processing is based on your consent (newsletter, analytics and advertising cookies, YouTube videos), you may withdraw it at any time by unsubscribing from the newsletter, changing your preferences in the cookie consent banner or contacting us. Withdrawal does not affect the lawfulness of processing carried out before it.
11.1.8Right not to be subject to automated decision-making (Article 22 of the GDPR): as described in Clause 8, we do not take such decisions.
11.1.9Right to lodge a complaint (Article 77 of the GDPR): if you believe that the processing of your personal data infringes the GDPR, you may lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, email ada@ada.lt, website vdai.lrv.lt) or with the supervisory authority of the EU Member State of your habitual residence or place of work. We would, however, appreciate the opportunity to address your concerns first.
11.2To exercise your rights, please contact us using the details in Clause 2 of this Policy. We may ask you to provide information necessary to confirm your identity. We will respond to your request without undue delay and in any event within one month of its receipt. Where a request is complex or we receive a number of requests, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it within one month of receipt of the request.
12. Cookies and similar technologies
12.1Our Website uses cookies and similar technologies (such as tags and pixels). Necessary cookies are used without your consent, as they are essential for the Website to function. Analytics and advertising cookies and similar technologies are used only with your prior consent given through the cookie consent banner, which you may change at any time. Detailed information on the cookies we use, their purposes, providers and storage periods is set out in our Cookie Policy available at [link to Cookie Policy].
13. Links to third-party websites and social media
13.1Our Website and communications may contain links to third-party websites, social media pages (Facebook, Instagram, LinkedIn, YouTube) and other online services. Those third parties process personal data under their own privacy policies, and we are not responsible for their practices. If you interact with our pages on social media platforms, the platform operator processes your personal data under its own policy, and we may process the data you make available to us through those pages (for example, messages and comments) for the purposes of communicating with you.
14. Changes to this Policy
14.1We may update this Policy from time to time to reflect changes in our processing activities, the services we use or the applicable law. The current version of the Policy, with its effective date, is always available on the Website. Where changes are material, we will inform you by a notice on the Website or, where appropriate, by email.
15. Questions
15.1If you have any questions about this Policy or the way we process your personal data, please contact us using the details in Clause 2 of this Policy.