Important info, free shipping from 100$ for example

Privacy Policy

Last updated: 15 August 2026

This Privacy Policy explains how MB “Elrebuy” collects, uses, stores, and protects personal data when you visit https://elrebuy.com, create an account, place an order, contact us, subscribe to marketing communications, or otherwise use our online shop.

We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the Law of the Republic of Lithuania on Legal Protection of Personal Data, and other applicable privacy and electronic communications laws.

1. Who We Are

The data controller responsible for your personal data is:

MB “Elrebuy”
Company code: 307497974
VAT number: LT100019426611
Registered address: V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania
Telephone: +370 648 87272
Email: connect@elrebuy.com
Website: https://elrebuy.com

In this Privacy Policy, “Elrebuy,” “we,” “us,” and “our” refer to MB “Elrebuy.”

2. Personal Data We Collect

Depending on how you use our website, we may collect the following categories of personal data:

  • Identity and contact data: name, surname, billing address, delivery address, email address, and telephone number.

  • Order and transaction data: products ordered, order number, order status, purchase value, payment status, delivery method, returns, refunds, warranties, complaints, and related communications.

  • Payment data: payment method, payment confirmation, transaction identifiers, and limited payment details supplied by the payment provider. Full payment-card details are processed by the payment provider and are not stored by us unless expressly stated otherwise.

  • Account data: username, encrypted password, saved addresses, order history, and account preferences.

  • Technical and usage data: IP address, browser type and version, device type, operating system, language, time zone, referring page, pages viewed, interactions with the website, cookie identifiers, and security logs.

  • Cart and preference data: products viewed, cart contents, saved items, selected currency or language, and other shop preferences.

  • Communication data: information contained in messages, enquiries, reviews, complaints, warranty requests, and customer-support correspondence.

  • Marketing data: newsletter subscription status, consent records, communication preferences, and engagement with marketing messages.

  • Content submitted by you: reviews, comments, images, or other content, where these features are enabled.

We collect personal data directly from you, automatically from your device, and, where necessary, from service providers involved in payments, delivery, fraud prevention, analytics, or customer support.

3. Why We Use Your Data and Our Legal Bases

Purpose Personal data used Legal basis under the GDPR
To process and deliver orders, accept payment, provide order updates, handle returns, refunds, warranties, and customer service Identity, contact, order, transaction, payment, and communication data Performance of a contract or steps taken at your request before entering into a contract (Article 6(1)(b))
To issue and retain invoices and comply with accounting, tax, consumer-protection, product-safety, and other legal requirements Identity, contact, order, transaction, and payment data Compliance with a legal obligation (Article 6(1)(c))
To create and manage customer accounts Identity, contact, account, order, and preference data Performance of a contract (Article 6(1)(b))
To operate, secure, troubleshoot, and improve the website and prevent fraud, abuse, and unauthorised access Technical, usage, transaction, account, and security data Our legitimate interests in operating and protecting our business and website (Article 6(1)(f))
To respond to enquiries, complaints, and legal claims Identity, contact, order, transaction, and communication data Performance of a contract, compliance with legal obligations, and our legitimate interests in handling disputes and protecting legal rights (Articles 6(1)(b), 6(1)(c), and 6(1)(f))
To send newsletters and promotional communications Identity, contact, marketing, and engagement data Your consent (Article 6(1)(a)), unless another lawful basis is expressly permitted by applicable law
To measure website use and personalise non-essential features Technical, usage, cookie, and preference data Your consent (Article 6(1)(a)), where consent is legally required
To publish and moderate reviews or comments Identity, account, order, communication, and submitted-content data Your consent or our legitimate interests in operating genuine review and community features, depending on the feature and applicable law (Articles 6(1)(a) and 6(1)(f))

Where we rely on legitimate interests, we assess whether our interests are necessary and balanced against your rights and reasonable expectations. You may object to processing based on legitimate interests as described below.

4. Data Required to Place an Order

Certain personal data is necessary for us to enter into and perform a sales contract, process payment, deliver your purchase, issue accounting documents, and comply with legal obligations. Fields marked as required during checkout must be provided. If you do not provide the required data, we may be unable to accept or fulfil your order.

You may browse the website without creating a customer account. Where guest checkout is available, creating an account is optional.

5. Payments

Payments are processed by independent payment service providers acting as separate controllers or processors, depending on the service. They may collect payment-card, bank-account, authentication, device, fraud-prevention, and transaction data under their own privacy terms.

Payment provider(s): [INSERT PAYMENT PROVIDER NAME(S) AND LINK(S) TO THEIR PRIVACY NOTICES]

We receive only the information needed to confirm and administer the payment, such as payment status, transaction identifier, amount, and payment method. Unless expressly stated at checkout, we do not receive or store your complete payment-card number or security code.

6. Delivery and Order Fulfilment

To deliver your order, we share the necessary recipient name, delivery address, telephone number, email address, parcel information, and delivery instructions with the courier, postal operator, fulfilment partner, or collection-point provider selected for the order.

Delivery and fulfilment provider(s): [INSERT COURIER/FULFILMENT PROVIDER NAME(S) AND PRIVACY NOTICE LINK(S)]

These providers may process your data under their own privacy notices when they determine how delivery services are performed.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies to:

  • keep the website and checkout functioning;

  • remember cart contents, session information, language, currency, login, and display preferences;

  • maintain security and prevent fraud;

  • measure website performance and use, where you consent;

  • support personalisation or advertising, where enabled and where you consent.

Strictly necessary cookies are used because they are required to provide the website and services you request. Non-essential analytics, personalisation, and advertising technologies are activated only after consent where required by law.

You can accept, reject, or change your non-essential cookie choices through [INSERT LINK TO COOKIE SETTINGS]. For details about individual cookies, their providers, purposes, and lifetimes, see our [INSERT LINK TO COOKIE POLICY].

Blocking strictly necessary cookies through your browser may prevent the cart, account, checkout, or other essential features from working correctly.

8. Reviews, Comments, and Uploaded Content

Where reviews or comments are enabled, we collect the data entered in the form together with the visitor’s IP address and browser information for moderation, security, and spam detection. Approved reviews or comments, including the displayed name and any submitted content, may be publicly visible.

If the Gravatar service is enabled, an anonymised value generated from your email address may be sent to Gravatar to determine whether you use that service. Gravatar is operated by Automattic, whose privacy notice is available at https://automattic.com/privacy/. After approval, your Gravatar profile image may appear publicly beside your comment.

If the website allows image uploads, do not upload images containing embedded location data, such as EXIF GPS data, unless you want that information to be available. Other visitors may be able to download the image and extract embedded data.

9. Who Receives Your Data

We disclose personal data only where necessary and proportionate. Recipients may include:

  • payment processors, banks, and fraud-prevention providers;

  • couriers, postal operators, collection-point networks, and fulfilment partners;

  • website hosting, infrastructure, backup, security, and technical-support providers;

  • ecommerce, customer-account, email, customer-support, and shop-management service providers;

  • accounting, bookkeeping, auditing, legal, insurance, and professional advisers;

  • analytics, advertising, and marketing providers, but only where the relevant processing is lawful and any required consent has been obtained;

  • public authorities, courts, regulators, law-enforcement bodies, or other parties where disclosure is required by law or necessary to establish, exercise, or defend legal claims;

  • a buyer, investor, adviser, or successor if our business or assets are subject to a genuine merger, sale, restructuring, or similar transaction, subject to appropriate confidentiality and legal safeguards.

Our principal website and service providers are:

  • Hosting provider: [INSERT NAME, COUNTRY, AND PRIVACY NOTICE LINK]

  • Payment provider(s): [INSERT]

  • Courier/fulfilment provider(s): [INSERT]

  • Analytics provider(s), if used: [INSERT OR STATE “NONE”]

  • Email/newsletter provider, if used: [INSERT OR STATE “NONE”]

  • Spam/security provider(s), if used: [INSERT OR STATE “NONE”]

Service providers acting on our instructions may use personal data only to provide the contracted services and must protect it appropriately. We do not sell your personal data.

10. International Data Transfers

We aim to process personal data within the European Economic Area (“EEA”). Some service providers may nevertheless process data in countries outside the EEA.

When personal data is transferred outside the EEA, we use a legally recognised transfer mechanism where required, such as an adequacy decision adopted by the European Commission, the European Commission’s Standard Contractual Clauses, or another safeguard permitted by the GDPR. You may contact us for information about the safeguards relevant to your data.

11. How Long We Keep Your Data

We retain personal data only for as long as necessary for the relevant purpose, including to comply with legal obligations and resolve disputes. The following periods or criteria generally apply:

  • Orders, invoices, payment records, and accounting documents: for the period required by applicable accounting, tax, and commercial laws.

  • Customer-account data: while the account remains active and until it is deleted at your request, except where particular information must be retained for orders, legal compliance, fraud prevention, or disputes.

  • Customer-service, complaint, return, and warranty records: for the time needed to resolve the matter and thereafter for the applicable warranty, consumer-claim, or legal-limitation period.

  • Marketing records: until you withdraw consent or unsubscribe, followed by limited retention of suppression and consent records where needed to demonstrate compliance and ensure that no further marketing is sent.

  • Cookie and analytics data: for the periods stated in the Cookie Policy and your cookie settings.

  • Security and technical logs: for as long as reasonably necessary to secure the website, investigate incidents, and prevent abuse.

  • Reviews and comments: while the relevant content remains published or until deletion is justified, with moderation and security records retained where necessary.

  • Legal claims and investigations: until the matter is finally resolved and any applicable limitation period has expired.

At the end of the relevant retention period, data is securely deleted or anonymised unless further retention is legally required.

12. Your Data Protection Rights

Subject to the conditions and limitations in the GDPR, you have the right to:

  • obtain information about how we process your personal data;

  • request access to your personal data and receive a copy;

  • request correction of inaccurate or incomplete data;

  • request deletion of your data;

  • request restriction of processing;

  • receive data you provided in a structured, commonly used, machine-readable format and, where technically feasible, have it transmitted to another controller;

  • object to processing based on legitimate interests, including related profiling;

  • object at any time to direct marketing;

  • withdraw consent at any time, without affecting processing carried out before withdrawal;

  • lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, contact us at [INSERT PRIVACY/CONTACT EMAIL]. We may request information necessary to verify your identity. We normally respond within one month, although the GDPR permits an extension for complex or numerous requests. Exercising your rights is generally free of charge, but a reasonable fee may be charged, or a request refused, where it is manifestly unfounded or excessive.

The right to deletion is not absolute. We may retain data where processing is required by law or necessary for the establishment, exercise, or defence of legal claims.

13. Direct Marketing

If you opt in to receive newsletters or promotional messages, we use your contact details and marketing preferences for that purpose. You can withdraw consent at any time by using the unsubscribe link in an email or contacting us at [INSERT PRIVACY/CONTACT EMAIL].

Withdrawing marketing consent does not affect transactional communications necessary to administer an order, payment, delivery, return, warranty, security matter, or customer account.

14. Automated Decision-Making

We do not make decisions that produce legal or similarly significant effects on you solely through automated processing. If this changes, we will provide the information and safeguards required by law before carrying out such processing.

15. Data Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures may include access controls, encrypted connections, software updates, backups, monitoring, and restrictions on staff and service-provider access.

No online system can be guaranteed completely secure. You are responsible for keeping your account credentials confidential and should contact us promptly if you suspect unauthorised account use.

16. Children’s Data

Our online shop is intended for persons who can lawfully enter into a purchase contract. We do not knowingly collect personal data from children where consent or authorisation from a parent or legal guardian is required. If you believe a child has provided personal data unlawfully, contact us so that we can investigate and take appropriate action.

17. Embedded Content and External Links

Pages on our website may contain embedded content or links to third-party websites, such as videos, maps, social-media content, product information, or payment and delivery services. Embedded content may behave as though you visited the third party’s website directly. The third party may collect technical and usage data, use cookies, or monitor your interaction according to its own privacy notice.

We are not responsible for the privacy practices of independent third-party websites. Review their privacy notices before providing personal data.

18. Complaints

We encourage you to contact us first so that we can address your concern. You also have the right to lodge a complaint with the Lithuanian supervisory authority:

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)
Address: L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
Website: https://vdai.lrv.lt/

If you live or work in another EEA country, you may also contact the supervisory authority in that country.

19. Changes to This Privacy Policy

We may update this Privacy Policy when our services, providers, technologies, or legal obligations change. The latest version will be published on this page with a revised “Last updated” date. Where required by law, we will provide additional notice or request renewed consent.

20. Contact Us

For privacy questions or requests, contact:

MB “Elrebuy”
V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania
Email: connect@elrebuy.com
Telephone: +370 648 87272