Privacy policy
Effective from 27 October 2026
1. Who processes your data
This website and the Thrifting Dept shop are operated by Gustas Šilgalis, individual activity (individuali veikla), Lithuania, address Studentų g. 41-86, LT-08106 Vilnius, Lithuania, email info.thriftdept@gmail.com.
For any question about your data, write to info.thriftdept@gmail.com.
2. What we collect
When you place an order: your name, email address, phone number, delivery address, the items ordered and the order total.
When you contact us: the content of your message and the details we need to reply.
Technical data: IP address, browser type and time of visit, recorded automatically by the server for security purposes.
We do not collect more than is needed to fulfil an order. We never ask for a national ID number, date of birth or payment card details.
3. Why, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Fulfilling and delivering your order | Performance of a contract (GDPR Art. 6(1)(b)) |
| Accounting and tax | Legal obligation (GDPR Art. 6(1)(c)) |
| Replying to your enquiry | Legitimate interest (GDPR Art. 6(1)(f)) |
| Website security | Legitimate interest (GDPR Art. 6(1)(f)) |
4. How long we keep it
Order and accounting records are kept for 10 years from the order, as required by Lithuanian accounting law. Correspondence unrelated to an order is kept for one year. Server logs are kept for up to six months.
5. Who we share it with
- Delivery carriers — Omniva, LP Express and other partners, so that your parcel can be delivered. They receive only what delivery requires: name, address, phone number.
- Our accountant — for invoicing and bookkeeping.
- Technical service providers — the site runs on Lovable and Supabase, and the domain is served through Hostinger. These providers process data on our instructions.
We do not sell your data and do not pass it on for advertising.
6. Payments
Orders are currently paid by bank transfer. We do not collect or store card details — the site does not ask for them at all.
7. Cookies
We use strictly necessary cookies and local storage — the ones without which the cart would not work. They are not used for analytics or advertising.
If we ever add analytics or marketing cookies, we will ask for your consent before switching them on and update this policy.
8. Transfers outside the EU
If you order delivery to the USA, your delivery details are passed to a carrier outside the European Economic Area, to the extent needed to deliver the parcel.
Some technical providers may store data outside the EEA. Where that happens, transfers rely on the European Commission's standard contractual clauses.
9. Your rights
You have the right to:
- access your data and receive a copy of it;
- have inaccurate data corrected;
- have data erased once it is no longer needed for the purpose it was collected for;
- restrict or object to processing;
- receive your data in a common format and transfer it to another controller.
Send your request to . We will reply within 30 calendar days.
Please note: accounting records cannot be deleted before the statutory retention period ends, even on request.
If you believe your data is being handled improperly, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt).
10. Changes to this policy
If this policy changes, the updated version will be published on this page and the effective date above will be changed. For significant changes, we will notify customers who have placed an order by email.