Privacy policy

Last updated: 3 October 2026

This policy explains what personal data ChristmasAdvents collects when you visit christmasadvents.com or order from us, why we use it, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is [Seller's legal name, address and registration number: to be added before launch]. For any question about your data, write to us through our contact page.

2. What data we collect

Order data: your name, delivery and billing address, email address, phone number, the items you ordered and your order history.
Payment data: the payment method you used and whether the payment succeeded. Card details go straight to the payment provider. We never see or store your full card number.
Messages: what you send us through the contact page or by email.
Technical data: IP address, device and browser type, pages viewed and cookie identifiers.

3. Why we use it and on what legal basis

To take, deliver and invoice your order, and to handle returns and guarantee claims. This is needed to perform our contract with you (Article 6(1)(b) GDPR).
To keep accounting and tax records. The law requires this (Article 6(1)(c) GDPR).
To answer your messages, keep the website secure and prevent fraud. This is our legitimate interest in running a safe shop (Article 6(1)(f) GDPR).
To send marketing emails and to use analytics or advertising cookies. We do this only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

4. Who receives your data

Shopify, which hosts our shop and runs the checkout.
The payment provider you choose at checkout.
Our order-processing service (DSers) and the suppliers and carriers that send your parcel. They receive your name, delivery address, phone number and the items you ordered, because your order is sent to you directly from the supplier's warehouse.
Public authorities, where the law requires it.

We do not sell your personal data.

5. Transfers outside the European Economic Area

Some of these recipients are outside the European Economic Area, including in China, the United States and Canada. Where the European Commission has not recognised a country as giving adequate protection, the transfer relies on safeguards the GDPR allows, such as the Commission's standard contractual clauses. Sending your delivery details to the supplier that ships your order is necessary to perform our contract with you (Article 49(1)(b) GDPR).

6. How long we keep it

We keep order and invoice records for as long as tax and accounting law requires. We keep messages for as long as it takes to deal with your request and delete them afterwards, unless the law requires us to keep them. Data we use with your consent is kept until you withdraw that consent.

7. Your rights

You have the right to:

get a copy of your data
have wrong data corrected
have your data deleted
restrict or object to how we use it
receive your data in a portable format
withdraw your consent at any time

To use any of these rights, write to us through our contact page. We answer within one month. You can also complain to the data protection authority in your country. In Lithuania that is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt).

8. Cookies

We use cookies that are necessary for the shop to work, for example to remember your cart and to run the checkout. Analytics and advertising cookies are used only if you agree to them in the cookie banner. You can change your choice at any time.