Privacy Policy

Updated: July 2026

1. Who We Are

The carista.lt website is operated by MB “Autonas” (company code 305316375, VAT ID LT100012756513, Kaunas, Lithuania)—the official representative of Carista products in the Baltic States. For questions regarding personal data, please contact us by email at info@carista.lt or by phone at +370 613 81311.

2. What Data Do We Collect?

  • Order details — first name, last name, shipping address, email address, phone number, items ordered.
  • Payment Information — Payments are processed by Revolut (Revolut Bank UAB — an EU-licensed bank). We do not see or store your card information.
  • Account information — if you create an account: login email address and order history.
  • Correspondence data — when you contact us by email or through the contact form (first name, email address, message content).
  • Browsing data — statistical information collected by cookies (see Section 8).
  • Newsletter subscription — your email address, if you have agreed to receive updates.

3. Why, and on what legal basis?

  • Contract fulfillment — order processing, delivery, warranty service, and returns.
  • Legal Obligations — Accounting and Tax Requirements.
  • Legitimate interest — ensuring the website's operation, security, and protection against fraud.
  • Consent — newsletters and analytics/marketing cookies. You can withdraw your consent at any time.

4. Who We Share Data With

We share data only to the extent necessary to provide the service, and we require our partners to ensure its protection:

  • To the payment service provider (“Revolut”) — to process the payment.
  • Courier services (“Omniva,” “LP Express”) — packages delivered via the selected method.
  • For providers of website hosting and IT maintenance services.
  • Analytics service providers ("Google Analytics") — for aggregated traffic statistics.

We never sell or rent your data to third parties.

5. International Orders and Data Transfers Outside the EEA

We serve customers throughout the European Union and the European Economic Area (EEA). When service providers located outside the EEA (e.g., Google in the U.S.) are used, data transfers are governed by the Standard Contractual Clauses (SCCs) approved by the European Commission and other safeguards provided for in Article 46 of the GDPR.

6. How long do we retain data?

  • Order and accounting data — 10 years (in accordance with Lithuanian law).
  • Account data — as long as the account is active or until you request that it be deleted.
  • Newsletter subscription — until you unsubscribe (each email contains an unsubscribe link).
  • Analytics data — up to 2 years.

7. Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

  • access your data and obtain a copy of it;
  • request that inaccurate data be corrected;
  • to request the erasure of data (“the right to be forgotten”);
  • to restrict the processing of data or to object to it;
  • receive data in a portable format (data portability);
  • withdraw your consent at any time.

Please contact us by email at info@carista.lt — we will respond within 30 days. You may submit your inquiries in Lithuanian or English.

8. Cookies

Cookies are small text files that are stored on your device to enable the website to function and to "remember" your preferences.

  • Essential cookies — session, shopping cart, login (WooCommerce, PHPSESSID). The store cannot function without them; they do not collect any personal data.
  • Technical — remembers your consent to cookies (valid for 1 year).
  • Statistics — Google Analytics (_ga — 2 years, _gid — 24 hours, _gat — 1 minute) collects aggregated traffic statistics. These are enabled only after we receive your consent.

You can disable or delete cookies at any time in your browser settings.

9. How We Protect Data

All communication between your browser and the website is encrypted using the SSL/TLS protocol. Payments are processed exclusively through PCI DSS-certified providers. Access to data is restricted to those individuals who need it to perform their job functions.

10. Complaints

If you believe your privacy rights have been violated, please contact us first—we will do our best to resolve the issue. You also have the right to file a complaint with the State Data Protection Inspectorate (L. Sapiegos St. 17, 10312 Vilnius, email: ada@ada.lt). EU residents may also contact their country’s data protection supervisory authority.

11. Changes

We may update this policy—the current version is always posted on this page, with the update date shown at the top.