Privacy and Cookie Policy

Last updated: 12 September 2026.

1. Who is responsible for your data

The controller of your personal data is UAB „Airsa“ (trading as Ellips), company registration code 305212939, VAT number LT100012733312, registered at Juliaus Janonio g. 11A, LT-25125 Vilnius, Lithuania.

For anything about your data, write to info@ellips.lt.

2. What we collect

  • Order data. Name, delivery and billing address, email, phone number, the items you bought, the amount paid, order and delivery history.
  • Payment data. Our payment provider processes your card or wallet details. We receive confirmation that payment succeeded, the method type and the last digits of the card. We never receive or store your full card number.
  • Account data, if you create an account: your login details and saved addresses.
  • Communications. Emails and messages you send us, and our replies.
  • Marketing data. Your email address if you subscribe, and whether you opened or clicked our emails.
  • Device and usage data. IP address, approximate location derived from it, device and browser type, pages viewed, referring site, and cookie identifiers.

We do not knowingly collect data from children, and we do not ask you for special-category data such as health data. Please do not send us health information; a cosmetic product needs none.

3. Why we use it, and our lawful basis

Purpose Data Lawful basis (GDPR Art. 6)
Take and deliver your order, handle returns, refunds and guarantee claims, answer your questions Order, payment confirmation, communications Performance of a contract, Art. 6(1)(b)
Manage a recurring-delivery plan and take each agreed payment Order, payment confirmation Performance of a contract, Art. 6(1)(b)
Keep accounting and tax records, and meet cosmetics and consumer-law duties Order and invoice data Legal obligation, Art. 6(1)(c)
Keep the shop secure and prevent fraud Device and usage data, order data Legitimate interests, Art. 6(1)(f)
Send marketing email Email address, engagement Consent, Art. 6(1)(a); or legitimate interests for a similar product to an existing customer, with an opt-out in every message
Measure how the shop is used, and advertising analytics Cookie and usage data Consent, Art. 6(1)(a), given through the cookie banner
Defend or bring legal claims Whatever is relevant Legitimate interests, Art. 6(1)(f)

You do not have to give us data, but we cannot complete an order without the data marked as required at checkout.

4. Who we share it with

We share data only with organisations that need it to provide the shop, each acting on our instructions as a processor unless stated otherwise:

  • Shopify, which hosts the shop and processes orders.
  • Our payment provider, which processes payments as a controller in its own right for fraud prevention and regulatory purposes.
  • Delivery carriers, which receive the name, address and phone number needed to deliver.
  • Email and support tools we use to contact you.
  • Analytics and advertising providers, only where you consented through the cookie banner.
  • Accountants, auditors and advisers, and public authorities where the law requires it.

We do not sell your personal data.

5. Transfers outside the European Economic Area

Some providers process data outside the EEA, including in the United States. Where that happens we rely on an adequacy decision of the European Commission where one covers the provider, or on the Standard Contractual Clauses together with additional safeguards. You may ask us for a copy of the safeguards that apply.

6. How long we keep it

  • Order, invoice and accounting records: for as long as tax and accounting law requires, which in Lithuania is generally 10 years from the end of the financial year.
  • Guarantee and conformity claims: for the duration of the statutory period plus the limitation period for claims.
  • Account data: until you close the account, then deleted or anonymised.
  • Marketing data: until you unsubscribe or withdraw consent, then suppressed so we do not contact you again.
  • Cookie and analytics data: for the retention period stated in the cookie banner, normally no more than 24 months.

7. Your rights

Under the GDPR you may ask us to:

  • Access the data we hold about you, and get a copy.
  • Correct data that is wrong or incomplete.
  • Erase data, where we no longer have a lawful reason to keep it.
  • Restrict how we use it while a dispute about it is resolved.
  • Receive it in a portable form, or have it sent to another controller, where we process it by automated means on the basis of consent or contract.
  • Object to processing based on our legitimate interests, and to direct marketing at any time, which we will always honour.
  • Withdraw consent at any time, without affecting processing already carried out.

Write to info@ellips.lt. We answer within one month and may ask you to confirm who you are before we release data. Exercising these rights is free.

8. Cookies and similar technologies

We set strictly necessary cookies that make the shop work, such as keeping your cart and your session and protecting against fraud. These need no consent.

Any analytics, personalisation and advertising cookies are set only after you agree through the cookie banner. You can change or withdraw your choice at any time through the banner or your browser settings. Blocking strictly necessary cookies will break the cart and checkout.

9. Marketing email

We send marketing only where you subscribed, or where you bought from us and the message concerns a similar product. Every message has an unsubscribe link, and unsubscribing takes effect immediately.

10. Automated decisions

We do not make decisions about you by automated means alone that have a legal or similarly significant effect on you. Our payment provider may run automated fraud checks on a transaction; if a payment is refused for that reason you can contact us and we will look at it.

11. Complaints

If you are unhappy with how we handle your data, tell us first at info@ellips.lt. You may also complain to the Lithuanian supervisory authority:

Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, vdai.lrv.lt. If you live in another EU country, you may complain to the supervisory authority there instead.

12. Changes to this policy

We may update this policy. The date at the top shows when it last changed, and we will tell subscribers about significant changes by email.