Privacy policy

This is an English version for information. The Lithuanian text at curtain.lt/privatumas is the one that applies.

This privacy policy (the "Policy") sets out how curtain.lt (the "Company", "we", "our") handles your personal data when you use our website curtain.lt, send an enquiry, book a measuring visit, ask for a quote, order made-to-measure curtains or contact us by any other channel (the "Services").

Data controller: MB Gojer, 307464230.

Contact for privacy questions: [email protected]

By using the Services you confirm that you have read this Policy. If you do not agree with it, please do not use the Services to the extent that this conflicts with your expectations about how your data is handled.

1. Scope and interpretation

1.1. The Policy applies to everyone who visits the website, communicates with us, sends an enquiry or becomes a client.

1.2. The Policy is read together with the applicable law, including the GDPR and national law.

1.3. Terms not defined in the Policy have the meaning given in the GDPR.

2. What data we collect

2.1. Data you give us. When you fill in forms, book a measuring visit or communicate with us, we may process (depending on the situation):

Identity and contact data: first name, surname, e-mail address, phone number, language of communication, preferred way of contact.

Address and location data: the address and any details needed to get there, such as the floor, the stairwell or the entry code, if a measuring or fitting visit is booked.

Enquiry and order data: the description of the order, fabric and design choices, budget ranges, deadlines, versions of quotes, commercial correspondence.

Measuring and technical data: window dimensions, track types, fitting methods, details of the rooms, fitting instructions, notes on risks (for example fragile walls or non-standard fixings).

Images (if provided): photos or videos of rooms and windows needed for a quote, design, quality control or the prevention of disputes.

Financial and accounting data: invoice details, payment method, payment status, discounts, debt administration information (where applicable).

Customer service data: your complaints, feedback, warranty requests, claims and service history.

Technical enquiry data: together with an enquiry, the IP address and browser identifier are recorded automatically, for security, abuse prevention and record keeping.

Important: if you do not provide the minimum data needed to handle an enquiry or provide a service, we may be unable to give a quote or provide the service.

2.2. Data collected automatically. When you visit the website we may collect:

IP address, device identifiers, browser type, operating system, language, time zone;

the date and time of the visit, pages viewed, clicks, referring sources, approximate location (from the IP address);

technical logs needed for security, error diagnosis and system stability.

This data is usually collected using cookies and similar technologies.

2.3. Data from third parties. We may receive data from:

advertising and analytics partners (for example visitor traffic statistics),

payment service providers (for example payment confirmations),

subcontractors (for example fitters' notes about work done),

publicly available sources, where needed for a legitimate interest (for example checking company details for B2B invoices).

3. Purposes and legal bases

We process data for these purposes (examples, not an exhaustive list):

3.1. Providing services and performing contracts. Receiving enquiries, planning measuring visits, giving quotes, made-to-measure production, fitting, delivery, warranty service. Basis: entering into and/or performing a contract.

3.2. Customer service and quality. Communication, quality control, dispute prevention, process improvement, staff training (for example analysis of anonymised cases). Basis: legitimate interest.

3.3. Legal and accounting obligations. Invoicing, bookkeeping, tax obligations, archiving documents, meeting legal requirements. Basis: legal obligation.

3.4. Website operation, security and abuse prevention. IT security, incident management, fraud prevention, access control, system audits. Basis: legitimate interest.

3.5. Marketing (where applicable). Newsletters, special offers, remarketing, audience building, measuring advertising performance. Basis: consent and/or legitimate interest (where the law allows it and the balance of your rights is ensured).

You may withdraw consent at any time; this does not affect the lawfulness of processing before the withdrawal.

4. Cookies and similar technologies

4.1. We use necessary, analytics and (where applicable) marketing cookies.

4.2. Where the law requires it, analytics and marketing cookies are only activated after you consent through the cookie banner.

4.3. You can change your cookie settings at any time through the cookie management tool or your browser settings, but some functions may then work only in part.

5. Recipients and disclosure

5.1. We share data only as far as necessary with these recipients:

providers of IT, hosting, domain and e-mail services;

CRM, project management and e-mail sending platforms;

the payment service provider Maksekeskus AS (the makecommerce.lt platform) and banks;

logistics and courier services (where applicable);

subcontractors (for example fitters), where this is needed to provide the service;

internal messaging and communication platforms (for example Telegram), through which minimal enquiry information (name, phone number) is passed on quickly so that we can contact you;

lawyers, auditors, accountants;

authorities, where the law requires it or to defend our legitimate interests.

5.2. All service providers that process data on our behalf are data processors and act on our instructions and under appropriate contractual terms.

5.3. Payment processing. In the online shop, payments are processed through the makecommerce.lt platform, operated by Maksekeskus AS (Liivalaia 45, Tallinn 10145, Estonia, reg. no. 12268475), so the personal information needed to complete and confirm a payment is passed to Maksekeskus AS.

6. Transfers outside the EEA

6.1. Some of the technology partners we use may be based outside the EEA. In that case we apply appropriate safeguards, such as the European Commission's standard contractual clauses (SCCs), or rely on other lawful transfer grounds. For certain quick-communication tools, we pass on only the minimum data needed to contact you about your enquiry.

6.2. For details of specific transfer safeguards, contact us using the details given.

7. Data security

7.1. We apply reasonable technical and organisational measures that take into account the nature of the data, the scale of processing and the risks (for example access control, authentication, encrypted connections, backups, rights management).

7.2. Although we take these measures, we cannot guarantee absolute security of data transmitted over the internet. In the event of an incident we will act in accordance with the applicable law.

8. Retention periods

We keep data for as long as the purposes require, and additionally as long as needed to protect our legitimate interests (for example limitation periods for claims) and to meet legal obligations.

Indicative periods (unless the law requires longer):

Enquiries that did not become a contract: up to 36 months from the last contact (including quote versions and communication).

Contract and order data: for the term of the contract and up to 10 years after it has been performed (including warranty and dispute needs).

Accounting documents: as the law requires (in practice often longer periods).

Marketing consents: until consent is withdrawn.

IT security logs: up to 24 months, unless longer is needed to investigate an incident.

If we receive a claim or a dispute arises, we may keep the data longer, until the matter is finally resolved and legal claims have expired.

9. Your rights and how to use them

Under the GDPR you have the right of access, rectification, erasure, restriction, portability, objection and withdrawal of consent.

9.1. Making a request. Send requests to [email protected].

In the request, give your name, contact details, what you are asking for and (if possible) any further information that would help identify the data.

9.2. Confirming your identity. To protect your data from unauthorised access, we may reasonably ask you to confirm your identity (for example with additional information or part of a copy of a document), especially if the request comes from a new e-mail address or an unusual channel.

9.3. Response times. We usually reply within the time limits set by the GDPR. In complex cases they may be extended, and we will tell you so as the law requires.

9.4. Excessive or manifestly unfounded requests. Where requests are manifestly unfounded or excessive (for example repeated without reason), we may:

charge a reasonable administrative fee, or

refuse to act on the request, as the GDPR allows.

9.5. Right to object. If we process data on the basis of legitimate interest, you may object. We may, however, continue the processing if we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or if it is needed to establish, exercise or defend legal claims.

10. Photos, measuring data and the privacy of your home

10.1. If you give us photos or video, or allow them to be taken during measuring, we treat this as being solely for preparing a quote, technical implementation, quality assurance and the prevention of disputes.

10.2. We do not aim to collect excessive data, but in practice good measuring may need wider context (for example walls, tracks, radiator areas), so images may show more than just the window.

11. Limitation of liability and disputes

11.1. We are responsible only for data processing under our control. We are not responsible for the privacy practices of third-party platforms reached through links.

11.2. Any dispute about the Policy is first settled by negotiation. Failing that, it is settled under the jurisdiction of the Company's registered office, as far as the applicable law allows.

12. Contacts and complaints

Privacy questions: [email protected]

You also have the right to lodge a complaint with the State Data Protection Inspectorate.

13. The site's chat assistant and window photos

13.1. The website has a chat assistant. It answers questions using only the content of curtain.lt pages. To prepare an answer, your message is passed to providers of AI model services through the OpenRouter platform; they may operate outside the EEA (see section 6).

13.2. We keep a conversation only if you leave your contact details in it. The text of the conversation, the pages the assistant pointed to, and your name and phone number then become an enquiry, which we handle like any other (sections 3.1 and 8). If you do not leave contact details, the conversation stays only in your browser and disappears when the page is reloaded or closed.

13.3. You can add a photo of a window only after confirming your consent. It is used for one purpose: so that the assistant can describe the window and give advice. The photo is passed only to the model service provider; we do not store it or add it to the enquiry, which keeps only a short text description of the window. Basis: your consent, which you may withdraw.

13.4. To limit abuse, we count the messages and photos per IP address per day (section 3.4). To delete a chat enquiry or get a copy of it, write to [email protected] (section 9).