Legal
Privacy policy on the processing and protection of users’ personal data
2024-01-02 · edition for alvaline.lt — 2026-09-11
This Privacy policy on the processing and protection of users’ personal data (hereinafter the “Policy”) has been adopted by and is in force at MB „Alvaline LT“ (hereinafter the “Company” or “we”). The controller of personal data is MB „Alvaline LT“, company code 306110517, address: Girulių g. 10-201, LT-12112, Vilnius, Lithuania; tel. +370 645 75736, e-mail: info@alvaline.lt. The personal data that the user provides to us while using our websites and mobile applications (the “Sites”) from any device and while communicating with us in any form are collected, used and stored in accordance with this Policy, with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and with the Law of the Republic of Lithuania on Legal Protection of Personal Data. By using our Sites and providing us with their personal data, the user consents to the processing of their personal data in accordance with this Policy.
01
Key definitions
“Personal data” – information relating to an identified or identifiable natural person (the data subject). “Processing of personal data” – an operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
02
Data we collect
We process: – personal data provided to us when filling in information fields on our websites, including when filling in the contact form, subscribing to our newsletter, or registering for events (webinars, conferences); – personal data provided when purchasing the services offered by the Company, as well as for the purpose of concluding a contract; – personal data necessary for the proper and safe provision of cosmetology services, namely information about the state of health, illnesses, pregnancy, allergies and other information which the relevant specialist asks for in a specific situation in order to carry out a cosmetology treatment or procedure; – technical data automatically transmitted by the device through which the user uses our Sites, including the device specifications and the IP address; – information stored in cookies. Depending on the browser and device used, different sets of cookies are applied, including strictly necessary, performance, functional and analytical cookies; – personal data that we collect by means of video surveillance during a visit to our cosmetology services centre.
03
Purposes of processing personal data
We process personal data solely for the purposes for which they were provided, including: – providing the user with information about the Company, our services and events, and sending the user our messages. E-mails are sent only with the user’s voluntary consent. Together with e-mails containing information materials, the user will always receive from us a link with the option to unsubscribe. If the user chooses this option, their e-mail address will be removed from our database and no further information will be sent; – communicating with the user when they contact us; – providing services to the user in accordance with our service agreement; – web analytics of the Site; – carrying out our marketing activities directed at the user in connection with current and future contracts; – contacting the user for purposes related to permitted marketing activities, in particular and with the user’s consent, by e-mail. For example, in order to answer a question asked in the contact form, or to send e-mails in the form of a newsletter about current events at the Company, promotions and news. We carry out video surveillance both for the personal safety of the user and for the safety of our employees, clients and property. Surveillance is carried out in public areas in accordance with strict security and privacy rules, using modern technology and equipment. Areas under surveillance are marked with appropriate information signs. The user will be informed separately about the conditions of processing of personal data for purposes of which they have not been informed in this Policy. We do not take any decisions producing legal effects concerning the user or otherwise affecting their rights and legitimate interests solely on the basis of automated processing of personal data.
04
Legal basis for the processing of personal data
We process personal data if one of the following conditions is met: – the user has given consent to the processing of their personal data; – the processing of personal data is necessary for the performance or conclusion of a contract; – the processing of personal data is necessary for compliance with legal obligations imposed on us by law (e.g. in order to provide information to the State Tax Inspectorate); – the processing of personal data is necessary to protect our legitimate interests (e.g. we carry out video surveillance to ensure the safety of our property, and we may also apply to a court for debt recovery, etc.); – the processing of data is necessary to protect the vital interests of the user or of another natural person.
05
General principles of processing personal data
The Company ensures that personal data are processed in accordance with the following principles: – purpose limitation – personal data are processed solely for the purposes of processing and use of data specified in this document, or for actions to which the data subject has consented; – data quality and proportionality – personal data are processed as accurately as possible and updated where necessary. Personal data are up to date, adequate and collected in amounts not exceeding what is necessary in view of the purpose of processing; – transparency – the purposes of data processing should be clear to the data subject; – security – when processing data we apply technical and organisational security measures appropriate to the risk, e.g. measures preventing accidental or unlawful destruction of data, alteration, unauthorised disclosure or access; – minimisation – personal data are regularly reviewed in order to delete data that are no longer necessary for the purpose of processing.
06
Security of personal data
To ensure the security of personal data during their processing, we take the necessary and sufficient legal, organisational and technical measures to protect personal data against unlawful or accidental access to them, their destruction, alteration, blocking, copying, provision, dissemination, and against other unlawful actions involving personal data.
07
Confidentiality / transfer of personal data
Information about the user’s personal data will not be placed in publicly available sources and will not be disclosed to third parties unless the Company obtains the user’s explicit consent or such information is required by applicable law. Where necessary, the user’s personal data may be disclosed to public authorities and law enforcement bodies in order to protect our legitimate interests. In order to fulfil our obligations towards the user, we may also transfer their personal data to our cooperation partners: data processors that carry out the necessary data processing on our behalf, e.g. IT infrastructure maintenance specialists, marketing agencies, leasing companies, courier companies, etc. In accordance with the applicable laws of the Republic of Lithuania and the European Union and our cooperation agreement, these companies are obliged to protect the user’s personal data and to process them solely for the purposes specified by us. Data recipients and transfers outside the EEA. The user’s personal data are received by: Google Ireland Ltd (Google Analytics 4, Google Ads, Google Tag Manager – only after consent in the cookie banner; the embedded Google map on pages showing a centre’s address); Meta Platforms Ireland Ltd (Meta Pixel – after consent; WhatsApp – the phone number and the correspondence: an administrator replies on WhatsApp to a request in which the user has themselves asked to be contacted this way); Microsoft Ireland Operations Ltd (Microsoft Clarity – session recordings and heatmaps, only after consent, form input is masked); Anthropic PBC, USA (the text of a message to the website assistant together with information about the page being viewed and the contents of the order, and a downscaled copy of the face photo that the user sends to the assistant chat with the “Upload a face photo” button after ticking the consent box – only upon the user’s explicit action; the photo is not stored); Altegio (online booking system: name, phone, e-mail, contents of the visit); Kommo (CRM: the enquiry in full); Telegram Messenger Inc. (the Telegram messenger: a notification to administrators about a new enquiry or booking – name, phone, e-mail and the text of the request – is delivered to a closed staff chat of the network and stored on Telegram’s servers). Transfers to the USA are made on the basis of the EU standard contractual clauses (Article 46 of the General Data Protection Regulation) and/or the EU-US Data Privacy Framework in the case of certified recipients.
08
Rights of the data subject
The user has the right to access the information provided to the Company, to rectify, update, otherwise modify or erase it, and to object to its processing. For this purpose the user may contact us by sending a message with the subject “Question about personal data” or “Withdrawal of consent to the processing of personal data” (in the case of withdrawal of consent to the processing of personal data) to the e-mail address info@alvaline.lt. In the event of a request to erase information concerning the user, we will promptly erase their personal data, as respect for their rights is our priority. Unfortunately, we will not be able to erase the user’s personal data if the law obliges us to retain them. How to submit a request: write to info@alvaline.lt from the phone number or e-mail address given when you contacted us – this is how we make sure the request comes from the data subject. We reply within 30 days at the latest. Upon an erasure request, the data are removed from the website database, the CRM and the staff notification chat; from the online booking system and accounting records – to the extent permitted by law. The user also has the right to lodge a complaint with the supervisory authority – the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, Vilnius, ada@ada.lt).
09
Retention period
All personal data collected from the user will be retained for as long as the user uses our services or, if their personal data are processed on the basis of their consent, until they withdraw that consent. Longer retention periods for personal data are permitted in order to comply with legal requirements regarding minimum retention periods for documents or information, or in order to protect our legitimate interests (including, in particular, for the purposes of accounting or legal proceedings). Specific periods: enquiries and consultation requests left on the website – until consent is withdrawn; the text of messages to the website assistant – anonymised (erased) after 180 days, while service data about the conversation (city, language, date) remain without any link to a person; personal account sign-in codes – 24 hours; data on clicks of the booking button (without name or phone) – 12 months; database backups – up to 60 days; web server logs with the IP address – 14 days. Data in the online booking system and in accounting records are kept for the periods laid down by law. Requests for follow-up without a booking: if the user entered a phone number and ticked consent in the online booking window or in the booking card in the website assistant chat but did not press “Book now” (unfinished booking), left a phone number or email address on the waiting list for free time, or asked for the calculation of a treatment set to be sent via WhatsApp or by email, we keep this contact, the name (if entered) and what was selected – treatments, centre, time – solely to follow up on that request, including via WhatsApp. Like any other request, such requests are passed to the CRM (Kommo) and to the administrators’ internal chat. If we could not reach the user, the phone number, name and email address are deleted from the website database after 30 days or, if by that time an administrator is still handling the request, immediately after the request is closed. Opting out is simple: do not tick consent; data already saved will be deleted on request (section “Rights of the data subject”). Once the purpose of processing personal data has been achieved, we will erase the user’s personal data securely or make them inaccessible (by archiving) or unidentifiable, so that they can no longer be linked to the user.
10
Cookies
We use cookies. More information about the policy and technical matters related to cookies can be found in the relevant section – the Cookie rules.
11
Changes to the privacy policy
The Policy may be changed without prior notice. The modified version of the Policy published on the Site supersedes all previous versions of the Policy. Any changes do not affect the Company’s general policy regarding respect for the rights of the data subject.