Privacy Policy

Effective from July 15, 2026.

UAB "Lonas", address Ukmergės g. 18, Jonava, LT-55101 Lietuva, company code 156871188, tel. +48 (73) 2081307, e-mail [email protected] (hereinafter – the Company) is the controller of your personal data. We respect your privacy and protect your personal data that you provide to us and that we collect for the purposes specified in this privacy policy. Please read it carefully to understand why and how we collect your data, as well as how we will process it.

Table of Contents

1. Data Controller and Contact Details

2. Key Principles of Data Processing

3. What Data We Process and for What Purposes

4. Our Legitimate Interests

5. Is Providing Data Mandatory?

6. Data Recipients

7. Transfers of Data Outside the European Economic Area

8. Cookies and Similar Technologies

9. Analytics, Advertising, and Marketing Tools

10. Direct Marketing and Newsletter

11. Profiling and Automated Decision-Making

12. Your Rights

13. Complaint to the Supervisory Authority

14. Children's Data

15. Data Security, External Links, and Changes to This Policy

1. Data Controller and Contact Details

The controller of your personal data is UAB "Lonas", with its registered office at: Ukmergės g. 18, LT-55101 Jonava, Lithuania.

Data Controller Identification Details:

• Legal entity code: 156871188,

• VAT number: LT568711811,

• Website: www.lonas.pl,

• Contact email: [email protected].

If you have any questions regarding privacy or the protection of personal data, you can contact us:

• by email: [email protected],

• by post: UAB "Lonas", Ukmergės g. 18, LT-55101 Jonava, Lithuania.

This contact address may also be used to submit requests related to the exercise of the rights described in this Privacy Policy.

2. Key Principles of Data Processing

We process personal data in accordance with the GDPR and other applicable laws. This means that:

• we process personal data only when we have a legal basis for doing so,

• we collect data for specific, clearly defined purposes,

• we process only the amount of data necessary for a given purpose,

• we retain personal data only for as long as necessary,

• we protect personal data using appropriate technical and organizational measures,

• we respect the rights of data subjects.

3. What Data We Process and for What Purposes

The scope of data collected depends on how you use the website or online store. We process different types of data when you simply browse the website, place an order, contact customer support, subscribe to the newsletter, or apply for a job.

Table: Purposes of processing, categories of personal data, legal bases, and retention periods

Purpose of processing

Categories of personal data

Legal basis

Retention period

Złożenie i realizacja zamówienia, dostawa, montaż, obsługa zwrotów i reklamacji → Order placement and fulfillment, delivery, installation, and the handling of returns and complaints

First name, last name, delivery address, email address, phone number, order details, payment information, and information related to complaints, returns, or installation.

Article 6(1)(b) of the GDPR – performance of a contract or taking steps at the request of the data subject prior to entering into a contract; Article 6(1)(c) of the GDPR – compliance with a legal obligation; Article 6(1)(f) of the GDPR – establishment, exercise, or defense of legal claims.

For the duration of the contract, and thereafter for the period required by law or necessary for the establishment, exercise, or defense of legal claims.

Customer account management

First name, last name, email address, securely stored password, addresses, order history, and data saved in the account.

Article 6(1)(b) of the GDPR – performance of a contract or taking steps at the request of the data subject prior to entering into a contract.

For the duration of the account existence; after the account is deleted, the data may be retained to the extent required by law or necessary for the defense of legal claims.

Handling inquiries and customer communication

Contact details, correspondence content, contact history, and order details, if the inquiry relates to an order.

Article 6(1)(b) of the GDPR, if the contact relates to a contract; Article 6(1)(f) of the GDPR – handling inquiries and ensuring the quality of customer service.

For the duration of handling the matter, and thereafter for the period necessary to defend legal claims or demonstrate the history of communication.

Accounting, taxes, invoices, and sales documentation

Identification, address, and contact details, order details, payment information, and invoice data.

Article 6(1)(c) of the GDPR – compliance with a legal obligation.

For the period required by tax, accounting, and other applicable legal regulations.

Payments, installments, leasing, or other forms of financing

Identification and contact details, order details, payment information, and data provided to the payment or financing operator.

Article 6(1)(b) of the GDPR; Article 6(1)(c) of the GDPR; Article 6(1)(f) of the GDPR.

For the duration of payment or financing processing, and thereafter for the period required by law or necessary for the defense of legal claims.

Establishment, exercise, and defense of legal claims, prevention of abuse, and ensuring the security of the website and online store.

Identification and contact details, order and payment information, complaint details, technical logs, IP address, and device data.

Article 6(1)(f) of the GDPR – protection of rights, security, and continuity of the online store’s operations.

For the period of limitation of claims or for the time necessary to investigate an incident and protect the interests of the controller.

Newsletter, promotions, surveys, and marketing communications

First name, email address, phone number, purchase history, marketing preferences, and information about consents, objections, and withdrawals.

Article 6(1)(a) of the GDPR – consent; Article 6(1)(f) of the GDPR – marketing of own products within the limits of applicable law; channel-specific consent in accordance with the Electronic Communications Law.

Until consent is withdrawn, an objection is submitted, or the subscription is cancelled; information about consents and objections may be retained for a longer period to demonstrate compliance of processing activities with legal requirements.

Reminders about incomplete orders or abandoned carts

Email address, cart data, activity in the online store, cookie identifiers, or similar identifiers.

Article 6(1)(a) of the GDPR or Article 6(1)(f) of the GDPR, depending on the method of data collection; sending emails/SMS messages requires channel-specific consent.

For the period necessary to handle the reminder, until the user opts out of communication, or until consent is withdrawn.

Opinie o zakupie lub produkcie

imię lub pseudonim, e-mail, treść opinii, dane zamówienia, ocena produktu lub obsługi

art. 6 ust. 1 lit. a RODO - zgoda; art. 6 ust. 1 lit. f RODO - badanie satysfakcji i rozwój jakości obsługi

do czasu wycofania zgody, usunięcia opinii albo przez okres potrzebny do wykazania prawidłowości procesu zbierania opinii

Reviews of purchases or products

Cookie identifiers, IP address, device identifiers, website activity data, visit source, and browser data.

For necessary cookies: Article 6(1)(f) of the GDPR; for analytics and advertising based on non-essential cookies: Article 6(1)(a) of the GDPR and consent to the use of cookies.

In accordance with the operating period of the relevant tool or until consent is withdrawn.

Cooperation with contractors and their representatives

First name, last name, position, contact details, represented entity, correspondence content, and contract details.

Article 6(1)(f) of the GDPR – conducting business cooperation; in the case of natural persons who are parties to a contract, also Article 6(1)(b) of the GDPR.

For the duration of the cooperation, and thereafter for the period required by law or necessary to pursue or defend legal claims.

Recruitment

dData provided in the CV, cover letter, application form, and recruitment correspondence.

Article 6(1)(b) of the GDPR – taking steps prior to entering into a contract; Article 6(1)(c) of the GDPR – compliance with legal obligations; Article 6(1)(a) of the GDPR – additional data and future recruitment processes; Article 6(1)(f) of the GDPR – defense of legal claims.

For the duration of the current recruitment process, and thereafter for the period necessary to defend legal claims; for future recruitment processes, only with consent.

4. Our legitimate interests

When we process data based on Article 6(1)(f) of the GDPR, our legitimate interests include in particular:

• handling inquiries and maintaining customer relationships,

• ensuring the security of the website and online store,

• preventing abuse and fraud,

• establishing, exercising, and defending legal claims,

• conducting marketing of our own products and services within the limits of applicable law,

• preparing statistics and improving the operation of the website,

• measuring customer satisfaction and service quality,

• conducting business cooperation with contractors.

5. Is providing data mandatory?

Providing the data necessary to place and process an order is required to enter into and perform the contract. Without this data, we will not be able to accept the order, deliver the product, issue a sales document, or handle a complaint.

Providing data in the contact form is voluntary, but necessary to receive a response. Providing data for the newsletter and marketing purposes is voluntary. Refusal to provide consent or withdrawal of consent does not affect the ability to purchase products.

Consent to analytical, advertising, and other non-essential cookies is voluntary. Refusal to provide consent should not limit the use of the basic functions of the website.

6. Data recipients

Data may be transferred only where it is necessary to achieve a specific purpose. Data recipients may include:

• providers of hosting services, IT infrastructure, website and online store maintenance services,

• providers of online store software, CRM systems, customer service tools, and communication tools,

• payment operators, banks, and financial service providers,

• entities handling installment payments, leasing, or other forms of purchase financing,

• courier, transport, installation, logistics, warehousing companies, and entities handling shipments,

• providers of review systems, surveys, and customer satisfaction research tools,

• marketing and newsletter providers, including Omnisend, if the tool is used,

• analytics and advertising providers, including Google, Meta, and Hotjar, if the relevant tools are used,

• accounting offices, tax advisors, lawyers, auditors, and entities supporting the pursuit of legal claims,

• public authorities and other entities authorized under applicable law.

Entities processing data on our behalf act under data processing agreements and only in accordance with our instructions, unless they independently determine the purposes and means of processing as separate data controllers.

7. Transfer of data outside the European Economic Area

As a general rule, we strive to use service providers that process data within the European Economic Area.

If we use providers that may process data outside the European Economic Area, for example in the United States, the transfer of data takes place only where there is an appropriate legal basis under Chapter V of the GDPR. This may include in particular:

• a European Commission adequacy decision confirming an adequate level of protection,

• the provider’s participation in the EU-US Data Privacy Framework, if the relevant provider is certified,

• standard contractual clauses approved by the European Commission together with additional protective measures, where necessary.

Upon request, we will provide information about the safeguards applied or indicate where a copy of such safeguards can be obtained, subject to the protection of business confidentiality.

8. Cookies and similar technologies

We use cookies and similar technologies on our website, such as pixels, tags, local identifiers, and device identifiers. Cookies are small files stored on the user's device or information read from that device.

Cookies may be categorized according to:

• provider – first-party or third-party,
• duration – session or persistent,
• purpose – necessary, preference, analytics, marketing, or social media.

We use the following categories of cookies:

Category

Purpose

Requires consent

Necessary

Website operation, shopping cart, orders, login, security, and remembering privacy settings.

No, if they are necessary for the transmission of communication or the provision of a service requested by the user.

Preference

Remembering selected settings, such as language, region, or other website usage preferences.

Yes, if they are not strictly necessary.

Analytics

Traffic measurement, statistics, analysis of website usage, and improvement of the website and online store performance.

Yes, before their use.

Marketing and advertising

Ad personalization, remarketing, measurement of advertising effectiveness, and limiting the number of ad impressions.

Yes, before their use.

SSocial media

Integration with social media platforms and measuring the effectiveness of activities on these platforms.

Yes, before their use.

Changing browser settings may restrict cookies, but it may affect the operation of certain website features, particularly the shopping cart, login, or placing orders.

9. Analytics, advertising, and marketing tools

Depending on the current configuration of the website, we may use analytics, advertising, and marketing tools provided by third-party providers. These tools help us measure website performance, analyze traffic, improve the purchasing journey, manage newsletters, deliver advertisements, and measure campaign effectiveness.

In particular, these may include:

• Google Analytics 4 and Google Ads – tools provided by Google Ireland Limited used for analytics, campaign performance measurement, and remarketing,

• Meta Pixel – a tool provided by Meta Platforms Ireland Limited used to measure advertising effectiveness and deliver targeted advertising across Meta services,

• Hotjar – a tool used to analyze website usage, including session recordings, heatmaps, or surveys, if enabled,

• Omnisend – a tool used for newsletter management, marketing automation, and customer communication, if enabled.

The scope of data processed by these tools may include, in particular: IP address, cookie identifiers, device identifiers, browser information, visit source, website activity, purchase events, information about interactions with advertisements or marketing messages, and contact details if the user has provided them for the purpose of receiving communications.

Information about the data processing practices of these providers can be found in their privacy policies:

• Google: https://policies.google.com/privacy,

• Meta: https://www.facebook.com/privacy/policy,

• Hotjar: https://www.hotjar.com/legal/policies/privacy,

• Omnisend: https://www.omnisend.com/privacy.

10. Direct marketing and newsletter

We may conduct marketing of our own products and services, including sending newsletters, information about promotions, surveys, product recommendations, reminders about abandoned carts, and invitations to leave reviews.

We send marketing communications by email, SMS, telephone, or other telecommunications end-user devices only when we have the required consent for such a communication channel in accordance with the Electronic Communications Law. The legal basis for data processing under the GDPR may be consent or our legitimate interest, but this does not replace the consent required for the communication channel itself.

At any time, you can:

• withdraw marketing consent,

• unsubscribe from the newsletter using the link provided in the message,

• object to the processing of data for direct marketing purposes,

• change communication preferences, if such a function is available.

After unsubscribing, we will no longer send further marketing communications through the relevant channel. However, we may retain information about the withdrawal, cancellation, or objection in order to demonstrate that we respect the user's choice.

11. Profiling and automated decision-making

We do not make decisions concerning users based solely on automated processing that would produce legal effects or similarly significantly affect them. We may carry out marketing and sales profiling, which involves analyzing or predicting user behavior on the website or in the online store. Profiling may include, for example:

• analysis of purchase history,

• analysis of products added to the shopping cart,

• analysis of viewed pages and product categories,

• assessment of responses to newsletters or advertisements,

• selection of content, discounts, promotional codes, cart reminders, or product recommendations.

The result of profiling may be the suggestion of products, promotions, or content that may match the user's interests. Marketing profiling does not produce legal effects and does not determine the possibility of entering into a contract. The user may at any time object to direct marketing, including related profiling, or withdraw consent to cookies and marketing communications.

12. User rights

The data subject has the following rights:

• the right to access data,

• the right to rectify data,

• the right to erase data,

• the right to restrict processing,

• the right to data portability,

• the right to object to processing based on legitimate interest,

• the right to object to direct marketing,

• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal of consent,

• the right to lodge a complaint with a supervisory authority.

Requests regarding the exercise of rights may be sent to [email protected]. We will respond without undue delay, generally within one month. If necessary, we may request additional information to confirm the identity of the person submitting the request.

13. Complaint to the supervisory authority

A user from Poland may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych): ul. Stanisława Moniuszki 1A, 00-014 Warsaw, www.uodo.gov.pl.

As the controller is established in Lithuania, the competent supervisory authority for the controller may also be the Lithuanian data protection authority: Valstybinė duomenų apsaugos inspekcija, https://vdai.lrv.lt/

The data subject may also lodge a complaint with the supervisory authority in the country of their habitual residence, place of work, or the place where the alleged infringement occurred.

14. Children's data

The website and online store are intended for individuals who are able to enter into contracts independently or who use the website with the consent of their legal representative. We do not direct information society services specifically to children under the age of 16.

If we become aware that we are processing a child's data without the required consent of a parent or guardian, we will take steps to delete such data or obtain the appropriate consent, where permitted by applicable law.

15. Data security, external links, and changes to the policy

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, destruction, alteration, or disclosure. These measures are adapted to the nature of the data, the scope of processing, and the risks associated with processing.

The website may contain links to other websites, including websites of manufacturers, partners, payment operators, courier companies, analytics tool providers, or social media platforms. After accessing an external website, the privacy policy of that entity applies.

We may update this Privacy and Cookies Policy when the way we process data, the tools we use, or applicable laws change. The current version is always available on the website www.lonas.pl.