Legal · Draft for owner review

Privacy Policy

Last updated: 12 October 2026

1. 01Introduction and data controller

   This Privacy Policy explains how personal data is handled when you visit the AMBREA website, contact us or buy our jewelry.

   AMBREA is a commercial brand name. The legal entity behind it, and the controller of your personal data, is:

   MB "Mini up"
   Company code: 305944654
   VAT code: LT100014556219
   Santariškių g. 101-1, LT-08465 Vilnius, Lithuania
   Email: info@ambrea.eu
   Phone: +370 624 13521

2. 02Personal data we process

   Depending on how you use the website, we process the following categories of data:

   • Order data — name, email address, delivery and billing address, phone number where requested, products bought, prices and order history.
   • Customer service data — the content of emails or calls you send us and the contact details you use.
   • Technical data — IP address, browser and device information processed automatically by our hosting provider and by Shopify when pages, product images and checkout are loaded.
   • Data stored only in your browser — the contents of your shopping bag and the list of pieces saved to your wishlist (see section 8). This information stays on your device and is not sent to us.

   We do not ask for, and do not knowingly process, special categories of personal data.

3. 03Placing an order

   When you choose to check out, your bag is passed to Shopify and you complete your order on a Shopify-hosted checkout page. There, you provide your name, email address, delivery and billing address, phone number where requested, and payment details. We use this information to accept, prepare, ship and support your order, to send order and shipping updates, to handle returns and refunds, and to meet our accounting and tax obligations. AMBREA does not receive or store your full payment card details.

4. 04Contact form and customer support

   The contact form on this website does not send or store messages itself. When you press "Send message", it opens your own email application with a prepared message addressed to info@ambrea.eu; nothing is transmitted until you send that email from your own account. We then process your name, email address, any order number and the content of your message in order to reply. The same applies when you email or call us directly.

5. 05Purposes and legal bases (GDPR)

   We process personal data under the EU General Data Protection Regulation (GDPR) for these purposes:

   • Performing a contract (Art. 6(1)(b)) — processing, delivering and supporting orders, returns and refunds.
   • Legal obligations (Art. 6(1)(c)) — keeping accounting and tax records and meeting consumer protection duties.
   • Legitimate interests (Art. 6(1)(f)) — answering enquiries, keeping the website and checkout secure, preventing fraud and establishing or defending legal claims.
   • Consent (Art. 6(1)(a)) — only where we ask for it, for example for marketing emails. You may withdraw consent at any time, without affecting processing carried out before withdrawal.

   Storing your bag and wishlist in your browser is strictly necessary to provide features you actively use and does not require consent.

6. 06Shopify and payment processing

   Our product catalog, inventory, checkout, orders and payments run on Shopify. Shopify processes order and customer data on our behalf as a service provider (processor). For some activities, such as fraud prevention and operating its own platform services, Shopify may act as an independent controller under its own privacy policy.

   Payments are processed by the payment providers available at checkout. These providers act as independent controllers for payment processing, fraud screening and their own legal obligations, and their own privacy notices apply. The payment methods offered to you are shown at checkout. [Owner to confirm which payment providers are enabled in Shopify, so they can be named here.]

7. 07Shipping and fulfillment

   To deliver your order, we share your name, delivery address, phone number and email address with the carrier delivering your parcel. Carriers may contact you directly with delivery notifications and generally process this data as independent controllers under their own privacy notices. [Owner to confirm the carriers used, so they can be named here.]

8. 08Cookies, browser storage and analytics

   A technical check of this website (12 October 2026) found that it sets no cookies of its own and loads no third-party analytics, advertising or social media tracking scripts. The website stores the following in your browser's local storage:

   • ambrea-shopify-cart — the contents of your shopping bag and a reference to your Shopify cart, so your selection is kept between visits. It remains until you empty your bag or clear your browser storage.
   • ambrea-wishlist — the Shopify identifiers of the pieces you save to your wishlist. It remains on this device until you remove the pieces or clear your browser storage.

   A temporary session entry is also used to remember your scroll position while navigating, and is deleted when you close the tab.

   Product data and images are loaded from Shopify's servers, which therefore receive your IP address and browser information. The Shopify checkout uses its own cookies for checkout, security and fraud prevention, and may use further cookies depending on the store's Shopify settings; these are described in Shopify's cookie notice shown at checkout. Because the website itself uses only strictly necessary storage, it does not show a cookie consent banner. If optional analytics or marketing tools are added in future, they will only be activated after you consent, and you will be able to withdraw that consent.

   [Owner to confirm whether Shopify analytics, customer privacy (cookie banner) settings, marketing pixels or apps are enabled for the checkout.]

9. 09Newsletter and marketing

   We do not currently send marketing emails through this website. The email field on the homepage is not yet connected to any service and does not store or send your address. If a newsletter is introduced, we will only send it with your consent, name the email provider in this policy, and include an unsubscribe link in every message. If Shopify checkout offers an option to receive marketing emails, that consent is recorded by Shopify only if you tick it. [Owner to confirm whether the marketing consent option is enabled at Shopify checkout.]

10. 10Who receives your data

    We do not sell personal data. We share it only where necessary with:

    • Shopify — e-commerce platform, checkout and order management (processor, and independent controller for some activities);
    • payment providers — payment processing and fraud prevention (independent controllers);
    • carriers — delivery of orders (generally independent controllers);
    • website hosting provider — operating and serving this website (processor);
    • our email provider — receiving and answering your messages (processor);
    • accountants, legal advisers and public authorities — where required by law or to protect our legal rights.

    Processors may use personal data only on our instructions. Independent controllers are responsible for their own processing under their own privacy notices.

11. 11International data transfers

    Some of our service providers, including Shopify, may process personal data outside the European Economic Area, for example in Canada or the United States. Under the GDPR, such transfers must rely on an adequacy decision of the European Commission (for example, for Canada, or for US companies certified under the EU–US Data Privacy Framework) or on other safeguards such as the European Commission's Standard Contractual Clauses. We rely on the transfer mechanisms set out in our providers' data processing terms. You may contact us for more information about these safeguards.

12. 12Retention

    We keep personal data only as long as necessary for the purposes described above:

    • Accounting records (invoices and supporting order documents) — for the period required by Lithuanian accounting and tax law. [Owner or accountant to confirm the exact period.]
    • Other order data — for as long as needed to fulfil the order, handle returns, guarantee claims and possible legal claims. [Owner to confirm the period.]
    • Correspondence — for as long as needed to resolve your enquiry and any related claim. [Owner to confirm the period.]
    • Bag and wishlist — stored only in your browser, until you remove them or clear your browser storage.

13. 13Security

    We use appropriate technical and organisational measures to protect personal data. The website and checkout are served over encrypted connections, payment data is handled by the payment providers rather than by AMBREA, and access to order data is limited to those who need it. No transmission over the internet is completely secure, but we work to protect your information.

14. 14Your rights

    Under the GDPR you have the right to:

    • access the personal data we hold about you;
    • have inaccurate data corrected;
    • have data erased, unless we must keep it, for example for accounting or legal claims;
    • restrict processing in certain cases;
    • object to processing based on legitimate interests, and to direct marketing at any time;
    • receive data you provided to us in a portable format, where processing is based on contract or consent;
    • withdraw consent at any time.

    To exercise these rights, contact info@ambrea.eu. We respond within one month; this may be extended by two further months for complex requests, in which case we will tell you. We may need to verify your identity. Your bag and wishlist are stored only on your device, so you can delete them yourself at any time.

15. 15Right to complain

    If you believe your personal data has been processed unlawfully, you may lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or with the supervisory authority in the EU country where you live or work. We would welcome the chance to address your concern first.

16. 16Changes to this policy

    We will update this Privacy Policy when our services, providers or legal requirements change. The current version is always published on this page with the date of its last update.

17. 17Contact

    For any privacy question, contact MB "Mini up" (AMBREA) at info@ambrea.eu, +370 624 13521, or by post at Santariškių g. 101-1, LT-08465 Vilnius, Lithuania.