Privacy policy

1. When you visit our website, create an account in our online shop or buy goods without registering, you entrust us with your data, which we process for the purposes set out in this Privacy Policy.

 

2. Personal data means any information that can be used to identify a person, as well as any information about a person who has already been identified.

 

3. Data controller: Biocentras UAB (company code: 120324587, VAT code: LT203245811). Registered office: Pagirių g. 1P, Pagiriai, LT-14118 Vilnius District Municipality, Lithuania, tel. +370 5 266 1313. For data protection matters, please contact us by e-mail at produktai@biocentras.lt

 

4. Biocentras UAB respects your privacy and protects the personal data you provide to us and that we collect, as described in this Privacy Policy.

 

5. Biocentras UAB takes appropriate organisational and technical measures to ensure that your personal data are always secure and that data processing complies with data protection legislation and our internal policies.

 

6. Purpose of data processing: administration of the personal account in the online shop and order management

 

a) Personal data: first name, surname, e-mail address, telephone number, correspondence address; signature (if you receive the goods in person), date and time of purchase and delivery, product names, quantities, prices of purchases and discounts granted, payment method and payment information; history of purchases made through the account

 

b) Legal basis: 1) Consent (when creating an account). We consider your consent to use the account to have been given when you complete the steps required to create an account set out in the Terms and confirm your registration. 2) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. 3) Processing is necessary for compliance with a legal obligation to which the controller is subject. 4) Processing is necessary for the purposes of the legitimate interests pursued by the controller.

 

c) Data retention period: your account will remain active for 2 years after your last login. After this period, the account will be closed and its data deleted. You can delete your account yourself at any time or ask for assistance by e-mail at produktai@biocentras.lt.

 

d) If goods or services were purchased through the account, the data of individual purchases (including the buyer’s details stated on the invoice) are kept in the seller’s accounting records for 5 years.

 

e) Depending on the delivery method you choose, delivery-related data (preferred delivery time, address, other information relevant to the courier) are passed to the partner delivering the goods.

 

f) Depending on the payment method, payment information is passed to the partner administering the payment service (e.g. Paysera).

 

g) If, when completing the account form or consenting to data processing, you chose to receive personalised offers, then in order to get to know you better we will process not only your form data for this purpose but will also analyse and use your purchase history. This allows us to get to know you, tailor offers to your needs and provide other benefits designed specifically for you. For these purposes we use automated data analysis and decision-making, including profiling. We group and analyse your form and/or purchase data and, taking into account your shopping habits and/or other characteristics (e.g. place of residence, specific purchase transactions, etc.), provide you with relevant, interesting and useful offers and other information. Such data are processed for as long as your consent to data processing for personalised offers remains valid. We may keep your consent and proof of it for a longer period if this is necessary to defend ourselves against claims, complaints or legal actions brought against us.

 

7. Purpose of data processing: sale of goods / fulfilment of orders (unregistered users)

 

a) Personal data: first name, surname, e-mail address, telephone number, correspondence address; signature (if you receive the goods in person), date and time of purchase and delivery, product names, quantities, prices of purchases and discounts granted, payment method and payment information;

 

b) Legal basis: 1) Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. 2) Processing is necessary for compliance with a legal obligation to which the controller is subject. 3) Processing is necessary for the purposes of the legitimate interests pursued by the controller.

 

c) Data processing period: purchase data (including the buyer’s details stated on the invoice) are kept in the seller’s accounting records for 5 years.

 

d) Depending on the delivery method you choose, delivery-related data (preferred delivery time, address, other information relevant to the courier) are passed to the partner delivering the goods.

 

e) Depending on the payment method, payment information is passed to the partner administering the payment service (e.g. Paysera).

 

8. Purpose of data processing: handling customer enquiries, complaints, requests and feedback

 

a) Personal data: identification and contact information provided by the Customer: first name, surname, telephone number, e-mail address, residential address, date of birth; content of the Enquiry: the event to which the Enquiry relates, its circumstances, date and place, the Customer’s request, claim or feedback, the product and other information provided in the Enquiry; other documents and/or data submitted with the Enquiry, e.g. purchase receipt details, photographs.

 

b) An Enquiry may be submitted via the website biocentras.lt, by email, by post, by sending a message or comment on social media, or by leaving reviews on websites.

 

c) Legal basis: 1) Consent (when creating an account). We consider your consent to use the account to have been given when you complete the steps required to create an account set out in the Terms and confirm your registration. 2) Processing is necessary for compliance with a legal obligation to which the controller is subject. 3) Processing is necessary for the purposes of the legitimate interests pursued by the controller.

 

d) Data retention period: 12 months. If a legal dispute is initiated in connection with the Enquiry, or there is a likelihood of such a dispute, we may keep your data for longer, until the time limits for lodging a complaint or the limitation periods for legal action laid down by law have expired and/or a final decision has entered into force.

 

e) We use your data only to examine your Enquiry properly and objectively, to provide you with the information you need, to answer your questions and to resolve your requests or claims. We may also analyse Enquiry data in order to improve the quality of our activities and the services we provide to you, taking into account your opinions and suggestions.

 

f) Biocentras UAB does not publish its correspondence with customers. However, if a customer’s enquiry or complaint is received through public website comment forms or social media comments, Biocentras UAB reserves the right to reply or comment publicly in the same form in which the enquiry was received.

 

g) At the end of the data processing and retention period set out in this Policy, we will destroy your data or reliably and irreversibly anonymise them as soon as possible, within a period that is reasonably and justifiably necessary to do so. Biocentras UAB will not be able to fulfil this requirement if the enquiry was submitted through websites or social media accounts not administered by Biocentras UAB.

 

9. Cookies. Our website uses cookies. Which cookies are used, for what purposes and how you can give or withdraw your consent is described in the Cookie Policy. Statistics and marketing cookies (e.g. Google Analytics, the Meta (Facebook) pixel) are used only with your consent.

10. Your data may be transferred for processing to third parties who help us provide and administer the Services. Such parties may include database software suppliers, database administration service providers, data centre, hosting and cloud service providers, direct marketing service providers, market research or business analytics service providers, accounting service providers, auditors, legal and financial advisers, etc., and partners engaged to fulfil a specific order (courier services, payment service providers, etc.).

 

11. In each case, a data processor is provided with only as much data as is necessary to carry out a specific assignment or to provide a specific service.

 

12. The data processors we engage may process personal data only on our instructions and may not use it for other purposes or transfer it to other persons without our consent. In addition, they must ensure the security of your data in accordance with applicable legislation and the written agreements concluded with us.

 

13. Data may also be provided to competent public or law enforcement authorities, or to persons performing functions assigned to them by law, e.g. the police or supervisory authorities, but only at their request and only where required by applicable legislation or in the cases and manner provided for by law, in order to protect our rights and the safety of our customers, employees and resources, and to establish, exercise and defend legal claims.

 

14. If Biocentras UAB uses a website analytics service (e.g. Google Analytics) to determine how you use the information provided on the website biocentras.lt, we may exchange your anonymised data with third parties who rely on this information to assess how the website is used, to prepare reports on website activity for website operators and to provide other services related to the use of the website, the internet and mobile applications.

 

15. As a rule, data is processed within the territory of the European Union / European Economic Area; however, in certain cases it may be transferred to and processed outside the EU / EEA.

 

16. Personal data may be transferred to and processed outside the EU / EEA where the transfer is necessary for the conclusion and performance of a contract or the Customer has given consent, and also where appropriate safeguards are in place. Appropriate safeguards are:

 

a) a contract incorporating the standard contractual clauses adopted by the European Commission or other approved clauses, codes of conduct, certifications, etc. approved under the General Data Protection Regulation;

 

b) the non-EU/EEA country in which the recipient of the personal data is located ensures an adequate level of personal data protection by decision of the European Commission;

 

c) the recipient is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (applies to recipients located in the United States).

 

17. A data subject whose data is processed in the course of the Data Controller’s activities has the following rights:

• to know (be informed) about the processing of their data (right to be informed);

• to access their data and how they are processed (right of access);

• to request the correction of inaccurate personal data or, taking into account the purposes of the processing, the completion of incomplete personal data (right to rectification);

• to have their data destroyed or to suspend the processing of their data (except storage) (right to erasure and right “to be forgotten”);

• to request that the Data Controller restrict the processing of personal data on one of the legitimate grounds (right to restriction);

• the right to data portability (right to portability);

• the right to object to the processing of their personal data or to withdraw at any time their consent to the processing of personal data for one or more specific purposes, without affecting the lawfulness of processing based on consent before its withdrawal;

• to lodge a complaint about the processing of personal data with the State Data Protection Inspectorate (vdai.lrv.lt) if you believe that your personal data is being processed in breach of legal requirements.

 

18. For all matters relating to data processing and the exercise of data subject rights, please contact Biocentras UAB: produktai@biocentras.lt

 

19. In order to protect other persons’ data from unlawful disclosure, upon receiving a request to provide data or to exercise other rights, the data controller has the right to take additional steps to verify the person’s identity, e.g. to ask for other relevant details provided in the registration form or to send a verification message to the contact given in the registration form asking you to complete an authorisation step. If the verification procedure fails, the data controller will reject the request.

 

20. Upon receipt of a request to exercise any right and after successful completion of the above verification procedure, the request will be examined within one month of receipt of your request and completion of the verification procedure. Taking into account the complexity and number of requests, the data controller has the right to extend the one-month period by a further two months, informing the data subject before the end of the first month and stating the reasons for the extension.

 

21. If a request is submitted by electronic means, the response will also be provided by electronic means, except where this is impossible (e.g. due to the very large volume of information) or where a different means of response is specified in the request.

 

22. If the circumstances and grounds set out in legislation for refusing a request are established, a reasoned response will be provided.

 

This privacy policy is effective from 29 October 2026 (the previous version was effective from 28 November 2021). If we change this privacy policy, we will publish the updated version on our website biocentras.lt