Privacy Policy
MB Inovacijų dialogas (operating as Brillio)
Last updated:
1. Data Controller
The data controller responsible for your personal data is:
MB Inovacijų dialogasP. Vileišio g. 15-25, 10306 Vilnius, Lithuania
VAT ID: LT100016637613
Email: [email protected]
EU Representative (if applicable):
Data Protection Officer:
2. Personal Data We Collect
We collect and process the following categories of personal data:
- Account information: name, email address, password (hashed), and account preferences.
- Order information: billing address, shipping address, items purchased, and transaction details.
- Unfinished checkout information: the email address you enter at checkout and the contents of your cart, even if you do not finish the order.
- Payment information: processed by our payment service providers; we do not store full card numbers.
- Usage data: IP address, browser type, pages visited, and interaction data collected via cookies and similar technologies.
- Communications: any messages you send us via email or contact forms.
3. Legal Bases for Processing
We process your personal data on the following legal bases under Article 6 of the GDPR:
- Contract (Art. 6(1)(b)): Processing necessary to fulfil your orders and provide our services.
- Legal obligation (Art. 6(1)(c)): Processing required by applicable law (e.g., tax and accounting obligations).
- Legitimate interests (Art. 6(1)(f)): Fraud prevention, security, service improvement, reminding you by email about an order you started but did not finish (see Section 4), and AI-assisted store operations (see Section 9).
- Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies, where you have provided explicit consent.
4. How We Use Your Data
- Processing and fulfilling orders.
- Sending order confirmations and shipping notifications.
- Sending you a few short reminder emails about the items left in your cart if you enter your email address at checkout but do not finish the order. Each reminder has an unsubscribe link, and the reminders stop when you place the order or unsubscribe.
- Providing customer support.
- Preventing fraud and maintaining security.
- Complying with legal obligations.
- Improving our store and services through analytics.
- Sending marketing communications (only with your consent).
5. Data Retention
We retain your personal data for the following periods:
A detailed retention schedule will be provided in a separate document.
6. Data Sharing and Recipients
We share your personal data only with:
- Payment processors: to process your transactions securely.
- Shipping providers: to deliver your orders.
- Technology sub-processors: hosting, analytics, and email service providers listed in Section 10.
- Legal authorities: when required by applicable law or court order.
In this online shop, payments are processed using the makecommerce.lt platform, operated by Maksekeskus AS Lithuania filialas, the Lithuanian branch of Maksekeskus AS (Konstitucijos pr. 21A, LT-08105 Vilnius, Lithuania, reg. no. 307639352); therefore, your personal data required to execute and confirm the payment will be transferred to Maksekeskus AS (Liivalaia 45, 10145 Tallinn, Estonia, reg. no. 12268475).
We do not sell your personal data to third parties.
7. International Transfers
Some of our sub-processors are located outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries with an adequacy decision.
8. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access (Art. 15): to obtain a copy of the data we hold about you.
- Right to rectification (Art. 16): to correct inaccurate data.
- Right to erasure (Art. 17): to request deletion of your data where no longer necessary.
- Right to restriction (Art. 18): to limit how we process your data in certain circumstances.
- Right to data portability (Art. 20): to receive your data in a machine-readable format.
- Right to object (Art. 21): to object to processing based on legitimate interests, including direct marketing.
- Right to withdraw consent (Art. 7(3)): to withdraw consent at any time without affecting prior processing.
To exercise your rights, contact us at [email protected]. You also have the right to lodge a complaint with your local supervisory authority.
9. AI-Assisted Store Operations
We use AI services to assist with store management tasks such as generating and translating store content (for example product descriptions, search-engine metadata and image alt text) and drafting replies to customer reviews. Store staff also use an AI assistant that helps them manage the store and can access customer and order data. This processing is carried out on the basis of our legitimate interests (Art. 6(1)(f) GDPR) in operating an efficient and competitive e-commerce store.
Within these AI-assisted features, customer data is sent to an AI provider only when a staff member's request involves it — for example, when they ask the assistant about an order or a customer, or draft a reply to a customer's review. We do not use AI to make fully automated decisions that produce significant legal effects on individuals without human review.
AI providers that process customer data are listed in Section 10.
10. Sub-Processors
We use the following third-party service providers (sub-processors) that may process your personal data on our behalf:
Hostinger
- Country
- Lithuania (EU)
- Legal Basis
- Contract performance (Art. 6(1)(b))
- Transfer Basis
- EU-based, no transfer outside the EEA
- Purpose
- Virtual private server hosting within the European Union (Lithuania). Provides the primary compute and database infrastructure on which the storefront and all of its data run. No transfer outside the EEA.
- Data Categories
- All categories processed on the platform
Cloudflare
- Country
- United States
- Legal Basis
- Legitimate interests (Art. 6(1)(f))
- Transfer Basis
- EU-US DPF + SCCs
- Purpose
- Content delivery network (CDN), DDoS protection, SSL termination, and web application firewall (WAF), plus Cloudflare R2 object storage for media, uploaded files, and generated invoice PDFs (which contain the buyer name, address, and order details). Visitor IP addresses are processed for security and performance purposes.
- Data Categories
- IP address, Technical data, HTTP headers, Uploaded media, Invoice documents (name, address, order details)
Amazon Web Services (Amazon SES)
- Country
- United States (email processed in the EU — eu-north-1, Stockholm)
- Legal Basis
- Contract performance (Art. 6(1)(b))
- Transfer Basis
- EU-based processing (eu-north-1, Stockholm); no international transfer — US parent is DPF-certified as a residual safeguard
- Purpose
- Transactional and order-related email delivery via Amazon SES (order confirmations, shipping updates, account notifications, and cart reminder emails). Email is processed in the AWS eu-north-1 region (Stockholm, Sweden), within the EEA.
- Data Categories
- Email address, Name, Order details, Email content
Stripe
- Country
- United States
- Legal Basis
- Contract performance (Art. 6(1)(b))
- Transfer Basis
- EU-US DPF + SCCs
- Purpose
- Payment processing and fraud prevention for customer transactions.
- Data Categories
- Payment data, Identity data, Transaction data
MakeCommerce (Maksekeskus AS)
- Country
- Estonia (EU)
- Legal Basis
- Contract performance (Art. 6(1)(b))
- Transfer Basis
- EU-based, no transfer outside the EEA
- Purpose
- Payment processing for Baltic and Nordic markets, where enabled by the merchant.
- Data Categories
- Payment data, Identity data, Transaction data
Twilio
- Country
- United States
- Legal Basis
- Consent (Art. 6(1)(a))
- Transfer Basis
- EU-US DPF + SCCs
- Purpose
- SMS delivery for abandoned-cart recovery messages sent to shoppers who provided a phone number. Twilio receives the recipient phone number and the message content. Recovery messages stop when the shopper replies STOP.
- Data Categories
- Phone number, SMS content
Sentry
- Country
- United States
- Legal Basis
- Legitimate interests (Art. 6(1)(f))
- Transfer Basis
- EU-US DPF + SCCs
- Purpose
- Error monitoring and crash reporting to maintain platform reliability. IP addresses and browser data may be captured in error reports.
- Data Categories
- Technical data, IP address, Browser/device data
OpenAI
- Country
- United States
- Legal Basis
- Legitimate interests (Art. 6(1)(f))
- Transfer Basis
- SCCs
- Purpose
- Review data reaches this provider only if the merchant enables review replies and selects this provider as their content-generation provider (one provider per store). Retrieval embeddings for the AI assistant's knowledge-base search (platform documentation), plus optional AI content and image generation from merchant-supplied store content. OpenAI does NOT run the AI store-management assistant and does NOT receive structured customer or order records (that assistant runs on Anthropic; see below). It can receive limited end-customer personal data in one case: when the merchant selects OpenAI as their AI content-generation provider and uses the review-response feature, the end-customer review author's name and review text are sent to OpenAI to draft the reply. Under OpenAI's API terms, submitted data is not used to train its models. Processed under legitimate interests (Art. 6(1)(f)).
- Data Categories
- Product data, Store configuration, Merchant-authored text, Brand assets, End-customer review content (author name + review text) — when OpenAI is the selected content-generation provider
Anthropic
- Country
- United States
- Legal Basis
- Legitimate interests (Art. 6(1)(f))
- Transfer Basis
- SCCs (Module 2/3) — not DPF-certified
- Purpose
- Review data reaches this provider only if the merchant enables review replies and selects this provider as their content-generation provider (one provider per store). Powers the AI store-management assistant (Claude models) and related safety/intent classification. When a merchant uses the assistant, the request context can include customer and order data — such as customer names, email addresses, and order details — retrieved by the assistant's tools. Under Anthropic's commercial API terms, submitted data is not used to train its models. Processed under legitimate interests (Art. 6(1)(f)); no automated decisions producing legal or similarly significant effects are made without human review.
- Data Categories
- Store configuration, Merchant-authored text, Customer data (name, email, order details) — when the AI assistant is used
Google (Gemini)
- Country
- United States
- Legal Basis
- Legitimate interests (Art. 6(1)(f))
- Transfer Basis
- EU-US DPF + SCCs
- Purpose
- Review data reaches this provider only if the merchant enables review replies and selects this provider as their content-generation provider (one provider per store). AI ad-creative image generation from merchant brand and product assets, and an optional AI content-generation provider the merchant can select. Like OpenAI, Gemini does NOT run the AI store-management assistant and does not receive structured customer or order records. It can receive limited end-customer personal data in one case: when the merchant selects Gemini as their AI content-generation provider and uses the review-response feature, the end-customer review author's name and review text are sent to Gemini to draft the reply. Under Google’s API terms for paid services, submitted data is not used to train its models. Processed under legitimate interests (Art. 6(1)(f)).
- Data Categories
- Brand assets, Product data, Merchant-authored text, End-customer review content (author name + review text) — when Gemini is the selected content-generation provider
11. Cookies
We use cookies and similar tracking technologies. For detailed information, please see our Cookie Policy.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a prominent notice on our website. The date at the top of this document indicates when it was last revised.
13. Contact Us
MB Inovacijų dialogasP. Vileišio g. 15-25, 10306 Vilnius, Lithuania
[email protected]