Privacy policy
Updated: 25 October 2026.
1. Data controller
The data controller for kvapugama.com is AROMAGAMA, UAB, company number 305243105, VAT number LT100012643616, Mokolų g. 63-21, Marijampolė, Lithuania. Privacy enquiries: pagalba@kvapugama.lt, +370 653 33390.
2. Data, sources and necessity
We receive your name, email, telephone number, billing and delivery addresses, ordered products, variants, quantities and messages from you. The platform and payment providers supply order and payment status, transaction identifiers and payment-method information. For a gift card sent to a recipient, we process the recipient’s name, email, message and scheduled date. Provide recipient details lawfully and inform the recipient of this policy.
When you browse, the platform may process your IP address, device and browser information, session, cart and preference data. Non-essential analytics and advertising technologies are used according to consent choices and applicable rules.
The marked contact, payment and, for physical goods, delivery details are necessary to place and fulfil an order. Without them we may be unable to conclude or perform the contract. Marketing consent and optional information are not a condition of purchase. Card details are entered in the payment service environment; never provide bank passwords to us.
3. Purposes and legal bases
Ordering, payment, delivery, account functions and contractual support rely on steps to enter into and perform a contract (GDPR Article 6(1)(b)). Accounting and mandatory consumer-rights obligations rely on a legal obligation (Article 6(1)(c)).
Security, fraud prevention and defending legal claims rely on legitimate interests in protecting the business, customers and rights, balanced against your interests and rights (Article 6(1)(f)). The basis for handling enquiries depends on their nature: pre-contractual steps, a contract or our legitimate interest in responding.
Optional direct marketing, and analytics or advertising requiring consent, rely on consent where legally required (Article 6(1)(a)). Unsubscribe through the email link or by contacting us. Opting out does not stop order and service messages.
4. Platform, payments and recipients
Shopify provides the store, order, account and digital gift card infrastructure. For processing for which Shopify is independently responsible and related rights, see the Shopify Consumer Privacy Policy and privacy portal.
If a MakeCommerce payment method is offered at checkout and you select it, that payment is processed using the MakeCommerce.lt payment platform. Personal data necessary for that payment is transferred to Maksekeskus AS Lithuania filialas, Konstitucijos pr. 21A, Vilnius LT-08105, Lithuania, registration number 307639352.
For Shopify Payments or PayPal, information necessary for payment is transferred to the respective service provider. Payment providers may also process data for their own legal, security and fraud-prevention obligations under their privacy notices; they are not described solely as our processors.
The chosen postal or courier provider receives recipient contact details, address, shipment and, where needed, parcel-locker details necessary for delivery. Order and delivery apps receive data for the service actually used. Judge.me processes review-submission and display information. Support, accounting and IT providers receive information needed for their functions; competent authorities receive data where legally required.
With consent for the relevant category, Google analytics / advertising, Meta and TikTok services may receive device, interaction and event information. Manage your choices in the store’s cookie settings. This notice does not itself provide additional marketing consent.
5. Retention criteria
Order and accounting records are retained for the mandatory accounting and tax-law period applicable to their category; the starting point follows the rules for the relevant year or document. After that period, we assess whether a record is still needed for a specific unresolved dispute or claim.
Support and returns correspondence is retained until the enquiry is resolved and for the periods necessary to bring or defend claims relating to that order. Account details are retained while the account is used or until an erasure request, with mandatory transaction records kept separately.
Marketing contacts are used until consent is withdrawn or the lawful basis ends. A minimal suppression record and consent evidence may remain to prevent unwanted resubscription and demonstrate lawfulness. Cookie and similar-technology retention depends on the particular cookie / service duration and withdrawal of choices; ask support for further details. Data no longer needed and not subject to a retention obligation is deleted or anonymised.
6. Cookies, transfers and security
Necessary session, security and cart technologies support the requested service. Change optional-category choices using the footer’s “Cookie preferences” link. Browser settings offer additional controls; changing them alone might not withdraw a choice already passed to a service.
Shopify and other international providers may process information outside the European Economic Area. Such transfers must use an appropriate lawful mechanism, such as a European Commission adequacy decision or standard contractual clauses with any necessary supplementary measures. Contact us for details about a recipient, the transfer basis or a copy of safeguards; Shopify also publishes information in its privacy documents.
Access restrictions and platform security measures are used. Absolute security cannot be guaranteed; do not send sensitive payment information by ordinary email.
7. Your rights and requests
Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You can object to direct marketing at any time.
Send requests to pagalba@kvapugama.lt. Identity checks are proportionate. We respond within one month; complex or numerous requests may require an extension under the GDPR, with reasons communicated during the first month. Erasure is not absolute where data is necessary for a legal obligation or claims.
You may complain to the Lithuanian State Data Protection Inspectorate or the competent supervisory authority where you live. This right does not depend on contacting us first.
8. Changes
The current version and update date are published on this page. Material changes are communicated as required by law. Purchase terms and this privacy notice do not replace separate consent where it is required for a particular use of data.