Privacy policy
What data we collect, where it is stored, who it is shared with, for how long, and what rights you have.
Version effective from
1. Who processes your data
The data controller is MB „Triovendi“, Company code 307039329 · VAT LT100019279317, registered address V. Nagevičiaus g. 3, LT-08237 Vilnius.
For any questions about personal data, write to info@dukano.lt or call +370 635 55615 during business hours (Mon–Fri 10:00–18:00, Sat 10:00–15:00).
This policy explains what data we collect when you visit the online store, create an account and buy products, for what purposes we use it and what rights you have.
2. What data we process
When you buy, we ask for the data without which an order cannot be fulfilled: your first and last name, email address, phone number and delivery address or chosen DPD parcel locker.
When paying by card or bank transfer, the payment is made on the Montonio page: we neither receive nor store card or online banking credentials. From the intermediary we receive only the payment status and the payment reference it assigns, which are stored with the order.
If you create an account, we additionally store your password (only as an irreversible hash), your address book and your order history. An account is optional — you can buy without one.
If you contact us by email, we process the content of the correspondence and the contact details you provide yourself. Technical data needed for the website to work is processed in server logs: IP address, time of the request and browser type. If a page breaks in your browser, the browser sends us a technical report — the page address without its query part and the error text; it contains neither cookies nor your data.
3. Where data is stored
Orders and accounts are stored in the store system on a server we control within the European Economic Area. Your login is maintained by technical cookies (see "Cookies").
The cart, wish list, comparison list, recently viewed products and a copy of a placed order are also kept in your browser's storage — so that pages work quickly and without logging in. Clearing your browser data deletes this copy, but not the order itself.
The contact form button opens your email app with a prepared message — it is sent only when you send it yourself.
4. Purposes and legal bases
Every processing operation has a specific purpose and a legal basis under the General Data Protection Regulation.
- Fulfilling, delivering and charging for your order (including receiving the payment status from the payment intermediary), and communicating about it — performance of a contract (Article 6(1)(b) GDPR).
- Managing your account — performance of a contract at your request (Article 6(1)(b)).
- Accounting and tax obligations — legal obligation (Article 6(1)(c)).
- Website security and troubleshooting — legitimate interest (Article 6(1)(f)).
- Visit analytics, marketing cookies and newsletters — only with your consent (Article 6(1)(a)), which you may withdraw at any time.
5. How long we keep data
Order-related data is kept for as long as accounting and tax laws require — usually ten years from the transaction.
Account data is kept while the account is active; on request we delete it, and order data remains only for accounting purposes.
Correspondence with customer service is kept for up to two years from the last message, technical server logs for up to six months.
6. Who data is shared with
We do not sell personal data or share it with third parties for marketing purposes. Data is shared only with those without whom an order cannot be fulfilled, and only as far as necessary:
- DPD — the carrier: the recipient's name, phone number and delivery address or parcel locker, so that the parcel is delivered and you receive notifications about it.
- Suppliers who ship products directly from their warehouse: the same shipment details, and only for the products they ship.
- Montonio — the payment intermediary, when you pay by card or bank transfer: first and last name, email address, phone number, delivery address (where the order is shipped), product names, quantities and prices, the amount payable, the chosen language and a purchase reference. Card or bank details entered on the payment page are processed by Montonio as an independent controller under its own privacy policy. For instalment purchases the application is assessed by Inbank under its own privacy terms.
- Email delivery and hosting providers — they act under data processing agreements and do not use the data for their own purposes.
- Public authorities — where required by law.
- If you consent to analytics or marketing cookies — Google (Google Analytics) and Meta (Meta Pixel); their servers may be outside the EEA, and transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.
7. Cookies
We group cookies into three categories. Necessary cookies are always set; analytics and marketing cookies only after you consent in the dialog shown on your first visit. You can change your choice at any time via "Cookie settings" in the page footer; after consent is withdrawn the respective scripts are no longer loaded. The payment page opens on the Montonio domain — cookies set there are controlled by the intermediary and are not covered by this list.
- Necessary: login session (tv_access — 5 min, tv_refresh — 30 days, readable by the server only), displayed name (tv_name — 30 days), a random session marker for wish list synchronisation (tv_session — up to 30 days, grants no account access), your cookie choice (tv_consent — 180 days) and browser storage for the cart, wish list and comparison list.
- Analytics: Google Analytics (_ga — up to 2 years) — visit statistics; IP addresses are anonymised.
- Marketing: Meta Pixel (_fbp — 90 days) — ad performance measurement.
8. Your rights
To exercise any of these rights, write to info@dukano.lt. We reply within thirty calendar days at the latest; if necessary, we may ask you to confirm your identity.
- Access the data we process about you and receive a copy of it.
- Have inaccurate data corrected or incomplete data completed.
- Have data (and your account) erased when there is no longer a basis for processing it.
- Restrict processing or object to it where it is based on legitimate interest.
- Receive your data in a structured, commonly used format and transfer it to another controller.
- Withdraw your consent — this does not make earlier processing unlawful.
- Lodge a complaint with the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt).
10. Changes to this policy
We may update this policy when the law or the way the website works changes. The current version is always published on this page, with its effective date shown at the top.