Version 1.6 · 2026-09-27
Privacy policy
In short
- We collect only what the register, our emails and orders need: your email, chosen model and size, and delivery details when you buy. Photos, class lists and collaboration requests only when you send them yourself.
- We send emails only after you agree and confirm by email. Every email has a one-click unsubscribe link.
- No advertising cookies, no tracking pixels, and we never sell data.
- Data is stored in the European Union. Ask to see, correct or delete it any time: info@kuncewear.com.
01Who handles your data
The controller is MB Kūno Kultūros Apranga, company code 307102644, registered office Kosmonautų g. 18, LT-68145 Marijampolė, email info@kuncewear.com (“Kunce”, “we”).
We have no data protection officer, as the GDPR does not require one for us. Send any privacy question to info@kuncewear.com.
This policy covers the website kuncewear.com, the class register (waitlist), our emails and, once the shop opens, orders.
02What we collect, why, and for how long
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| The register and emails about Kunce lessons, early access and short surveys | Email, first name (optional), chosen model (print or colour) and size, language, class number, referral code, survey answers (e.g. “would you buy?”) | Your consent (GDPR Art. 6(1)(a)) | While you are in the register. After unsubscribing, see “Proof of consent and of unsubscribing”. |
| Unconfirmed signup | The same data, until you click the confirmation link | Your consent, which you confirm by clicking the link (GDPR Art. 6(1)(a)) | Deleted after 30 days if not confirmed |
| Proof of consent and of unsubscribing | Version of the consent text, time, the page you agreed on, confirmation time, unsubscribe time | Legitimate interest in proving that we had consent (GDPR Art. 7(1)) and in defending claims (GDPR Art. 6(1)(f)) | While you are in the register and 3 years after unsubscribing, then the whole record is deleted |
| Referrals | Who invited whom (an internal link between records) and the number of confirmed referrals | Legitimate interest in running the referral programme under the register rules (GDPR Art. 6(1)(f)) | Same as the register record |
| Campaign measurement | Where you first came from: campaign tags (utm), the previous page address, the first page | Legitimate interest in knowing which campaigns work (GDPR Art. 6(1)(f)) | Same as the register record. Nothing is stored on your device, see “Cookies”. |
| Protection against bots and abuse | A one-way hashed key of your IP address (the IP itself is not stored); bot-protection check data | Legitimate interest in protecting the site and the form (GDPR Art. 6(1)(f)) | The key is deleted after 2 days |
| Email delivery | Which email, when it was sent, whether it was delivered, bounced or marked as spam | Legitimate interest in making sure emails arrive and not sending to dead addresses (GDPR Art. 6(1)(f)) | 12 months |
| Correspondence | Your email address, your message and our reply | Legitimate interest in answering questions (GDPR Art. 6(1)(f)) | Up to 2 years after the last message |
| Error monitoring | Technical data about an error (browser, page, time). Emails, IP addresses and form contents are not sent. | Legitimate interest in a working website (GDPR Art. 6(1)(f)) | 90 days |
| Discount codes and the referral programme | The code used on an order; when a friend buys with your code, a one-time code is created for your entry and emailed to you (only if you receive our letters). The friend never sees your data, nor you theirs. | Performance of the contract (GDPR Art. 6(1)(b)) and our legitimate interest in running the referral programme (Art. 6(1)(f)) | As order data; an unused code expires after 90 days |
| Orders | Name, email, phone, delivery address or parcel locker, items ordered, payment and delivery status, returns and withdrawals (name, order, email, time), the invoice (and company details if you add them) | Performance of the contract (GDPR Art. 6(1)(b)) and legal obligation for accounting (GDPR Art. 6(1)(c)) | Accounting documents (invoices) for as long as accounting and archive law requires (currently 10 years). Phone and delivery point are deleted 3 years after delivery. Data of unpaid orders is deleted after 30 days |
| Reminder about an unfinished order | Email and items of an unpaid order | Your consent to our emails (GDPR Art. 6(1)(a)); sent once, only to people who receive our emails | As an unpaid order |
| Collaboration requests | Name, email, phone, organisation and link (the last three optional), and the message you send through the “Work with us” form. | Our legitimate interest in answering and discussing a collaboration (GDPR Art. 6(1)(f)) | 1 year from the request; then deleted |
| Class set | The list's name, the organiser's name (optional) and, for everyone who joins, a name, model and size. Only the person who opened the list sees the sizes; others see names only. | Entering into and performing the contract (GDPR Art. 6(1)(b)) and our legitimate interest in putting a group order together (Art. 6(1)(f)) | 30 days from when the list is opened; then it is deleted (the order is kept as order data) |
| Buyer photos (if you send one) | The photo you send from your order page and, if you wish, a name and a few words with it. Once reviewed, we show it on the lesson page and may show it on Kunce's social media. We remove location and camera data from the photo. | Consent (GDPR Art. 6(1)(a)) | Until you withdraw consent: take the photo down at any time on your order page or by writing to us. The photo stays yours: you let us show it free of charge until you take it down. We remove social media posts within 7 days of a request (there the network, e.g. Meta, also handles it under its own rules). A code already given is not taken back. A photo we do not show is deleted right after review |
For the register only your email address is required; without it we cannot add you. Name, size and survey answers are optional. An order needs your name, email, phone and delivery point; without them we cannot make the contract or deliver.
We make no automated decisions with legal or similarly significant effects on you, and we do not build advertising profiles.
03Who receives data
We never sell data. It is handled only by service providers who help us, under data processing agreements and only on our instructions:
| Who | Purpose | Where |
|---|---|---|
| Website and database hosting providers | Running the site, storing data, admin login | EU |
| Email delivery service | Confirmation, order and news emails | EU |
| Bot protection service | Protecting forms from automated requests | EU and US |
| Email and document service | Our mailbox and invoice archive | EU and US |
| Accounting | Accounting documents | EU |
Where a provider is a US company, we rely on safeguards approved by the European Commission (the EU–US Data Privacy Framework or Standard Contractual Clauses). Ask info@kuncewear.com for the list of specific providers.
Payments are handled by a licensed payment institution and your parcel is delivered by the carrier you choose: they receive only what payment or delivery needs and handle it as separate controllers under their own privacy policies. Some carriers may transfer data outside the EU (for example to Ukraine).
If you pay in instalments, the lender receives the order amount and your contact details as a separate controller and assesses your creditworthiness under its own privacy policy.
Buyer photos we show are public on the site and may be posted on Kunce's social media accounts.
Public authorities receive data only when the law requires it.
05Referrals and your privacy
If you signed up through a friend's link, your friend only sees the total number of confirmed referrals. We never show them your name, email or when you signed up.
We never show your class number publicly next to your name. Sharing it is up to you.
06Age
You can join the register from the age of 14, the age at which a person in Lithuania can consent to their data being used for online services. If we learn that someone younger has signed up, we delete the record.
Buying in the shop (once it opens) is for adults, or minors with a parent's or guardian's consent, as the Civil Code provides.
07Your rights
- Access your data and get a copy.
- Correct inaccurate data.
- Have your data deleted (“right to be forgotten”).
- Restrict processing.
- Receive your data in a portable format (JSON) and pass it to another controller.
- Object to processing based on legitimate interest.
- Withdraw consent at any time; this does not affect what was done before. Unsubscribe with the link at the bottom of every email.
Write to info@kuncewear.com. We reply within one month (in complex cases we may extend this by two more months and will tell you). To protect your data, we reply to the address in question or may ask you to confirm your identity.
If you ask us to delete your data, we delete the whole register record. We cannot delete order accounting documents before the legal retention period ends; in them we keep only what the law requires.
08How we protect data
- The database is in the EU and reachable only from our server; browsers never access it directly.
- All connections are encrypted (HTTPS).
- Keys for confirmation and unsubscribe links are stored only as one-way hashes.
- The admin needs a password and a second code; every action on personal data is logged.
- Only people who need access for their work have it.
If a data breach may put you at risk, we notify the State Data Protection Inspectorate within 72 hours, and you as well if the risk is high.
09Complaints
Write to us first; it is usually faster. You also have the right to complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija): L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania, ada@ada.lt, +370 5 271 2804, vdai.lrv.lt.
10Changes to this policy
When the policy changes, we update the version and date at the top of this page. We will email you about significant changes (for example, a new purpose) before they take effect and ask for new consent where needed.