1. Who processes your data
Data controller – MB Supyk
Company code 308139407
Registered office: Perkūnkiemio g. 19, LT-12120 Vilnius
Email: info@pykpouches.com
Phone: +370 672 22142
We don't have a data protection officer (it isn't required for a company of our size). Write to info@pykpouches.com with any data questions.
2. What data we process and why
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Fulfilling and delivering orders | Full name, email, phone, parcel locker, products, amount, payment status, tracking number. When buying for a company – company name and code. | Performance of a contract (GDPR Art. 6(1)(b)) | 10 years from the order |
| Accounting and invoices | Order and payment data, invoices | Legal obligation (GDPR Art. 6(1)(c)) | 10 years (retention period for accounting documents) |
| Subscription and account | Subscription settings (quantity, frequency, parcel locker), payment method – the card is stored by Stripe, we only see its type and last 4 digits, account login codes | Performance of a contract | While the subscription is active, then as for orders; login codes – 15 minutes |
| Repeat subscription check (section 11 of the terms) | If a subscription is cancelled after no more than one delivery – identifying markers for email, phone and parcel locker with name | Legitimate interest – so the subscription discount isn't used for a one-time purchase | 90 days, then deleted |
| Friend referral (section 5 of the terms) | Your email and referral code; which order was paid with your code (we don't disclose your friend's data to you) | Performance of a contract – granting the discount and reward code | Together with orders |
| Emails about your order and subscription (confirmation, shipping, delivery, reminder before a charge) | Email, name, order and subscription data | Performance of a contract | Together with the order |
| Reminders about an unfinished order (up to 3 emails over 3 days) | Email, name, chosen quantity and parcel locker entered in the cart | Legitimate interest (GDPR Art. 6(1)(f)) – reminding you of an order you started yourself | Up to 6 months; if you opt out, we keep a “do not send” marker so we don't write again |
| Newsletters and offers (new flavours, promotions, emails about use, a request to leave a review) | Email, name, purchase history | Consent (GDPR Art. 6(1)(a)) – the checkbox in the cart, or confirmation by email after leaving your address in the pop-up | Until you withdraw consent; if you don't confirm an address left in the pop-up within 30 days, we delete it |
| Reviews | Name, rating, text, photo (without location data), number of boxes tried | Consent | Until you withdraw consent or we delete the review |
| Withdrawal from the contract and complaints | Content of the statement, order number, email, time of receipt, correspondence | Legal obligation and performance of a contract | Together with the order |
| Survey “Where did you hear about us?” | Your answer, linked to the order | Legitimate interest (understanding which channels work). Answering is optional. | Together with the order |
| Ad measurement (Meta) | See section 4 | Consent (cookie banner) | See the cookie policy |
| Running the website and protection against abuse | IP address, browser data, request times | Legitimate interest | As long as needed for security; backups – 30 days |
We neither see nor store card details – Stripe handles them. We only get data from you, and payment and delivery status from Stripe and Omniva.
3. Emails
Every marketing email and reminder contains an “Unsubscribe” link – once you click it, we stop sending marketing emails and reminders. This doesn't turn off emails about your order (confirmation, shipping). Our emails use technical tracking of whether an email was delivered, opened and whether a link was clicked – this helps us notice if emails aren't reaching people.
4. Ad measurement (Meta Pixel)
Only if you press “Accept” in the cookie banner is the Meta Pixel turned on, and we also report purchases to Meta from our server (Conversions API). Meta Platforms Ireland Limited then receives: IP address, browser data, the values of the cookies _fbp and _fbc
, your actions on the website (product viewed, cart, purchase and its amount), and for a purchase – your email, phone and full name hashed irreversibly (SHA-256). This lets us measure whether ads work and show them to more relevant people.
We and Meta jointly control the collection and transfer of data to Meta (joint controllers, GDPR Art. 26); Meta is responsible for further processing – see Meta's privacy policy. Without consent we send nothing to Meta. You can withdraw consent in the cookie settings.
5. Who we share data with
We share data only with those without whom we couldn't sell and deliver the product. We have data processing agreements with our processors.
- Stripe (Stripe Payments Europe, Limited, Ireland) – payments. For fraud prevention and legal compliance, Stripe also acts as an independent controller.
- Omniva – parcel delivery: full name, phone, email, parcel locker.
- Hostinger – the server the website runs on (data centre in Vilnius).
- Supabase – the order database (data stored in the EU, Ireland).
- Resend – sending emails.
- Meta – only with your consent (section 4).
- Our accountant, state authorities and courts – when required by law.
6. Data outside the EU
Some service providers are US companies (the Resend, Supabase, Stripe and Meta groups), or data processed by their sub-processors may reach the US – e.g. Resend stores email data in the US. Such transfers are covered by the EU-US Data Privacy Framework and/or standard contractual clauses approved by the European Commission. You can get a copy by writing to us.
7. Your rights
- Access your data and get a copy of it.
- Correct inaccurate data.
- Ask us to delete data when there is no longer a reason to keep it (we can't delete accounting data before the retention period ends).
- Restrict processing and receive your data in a portable format.
- Object to processing based on legitimate interest, and to direct marketing at any time without giving a reason.
- Withdraw consent at any time; this doesn't affect processing done before withdrawal.
Write to info@pykpouches.com. We'll reply within 1 month. If you think your rights have been violated, you can complain to the State Data Protection Inspectorate (L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt).
8. Other things
- We don't make automated decisions that have legal effects on you.
- The product is for people aged 18 and over – we don't knowingly collect children's data.
- The connection to the website is encrypted, only three members of our team can access orders (logging in with a one-time code), and backups are encrypted.
- Providing data isn't mandatory, but without contact details and a parcel locker we couldn't fulfil the order.
- We may update this policy – the latest version is always here.
Effective from 3 October 2026