Privacy policy

Updated: 8 October 2026

1. Who processes your data

The data controller responsible for your personal data is:

UAB “Deco ID” (hereinafter the Seller or we), trading under the “Idea&Design” brand
Company code: 307962672
VAT number: LT100020332211
Registered address: Vėjų g. 35-1, Riešės k., Avižienių sen., Vilniaus r. sav.
Showroom and correspondence address: Verkių g. 44, Unideco shopping centre, 2nd floor, LT-09109 Vilnius
Email: info@ideadesign.lt
Telephone: +370 620 37022
Online shop: ideadesign.lt

This privacy policy explains what personal data we collect, what we use it for, how long we retain it and what rights you have. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, hereinafter the GDPR) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.

2. What data we collect and why

2.1. Purchases and order fulfilment

Data: first name, surname, email address, telephone number, delivery and billing address, order contents and amount, payment method, payment confirmation details.
Purpose: to conclude and perform the contract of sale, deliver the goods, accept payment, fulfil guarantee obligations and handle returns.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.2. Accounting and tax

Data: the buyer's details shown on the invoice, order and payment information and, in the case of legal entities, the company code and VAT number.
Purpose: to issue and retain accounting documents.
Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

2.3. Online shop account

Data: email address, first name, surname, telephone number, saved addresses, order history.
Purpose: to make shopping more convenient for you and to let you view your orders.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.4. Newsletter and marketing

Data: email address, first name, telephone number (if you provide it), your interests and purchase history.
Purpose: to send you news, offers and information about new collections.
Legal basis: your consent (Article 6(1)(a) GDPR). If you have already made a purchase from us, we may send you offers of similar goods on the basis of our legitimate interest (Article 6(1)(f) GDPR); however, you always have the right to opt out.
How to opt out: click the “Unsubscribe” link in any of our emails or write to info@ideadesign.lt. Withdrawing your consent does not affect the lawfulness of processing carried out before its withdrawal.

2.5. Customer service and enquiries

Data: the content of correspondence, contact details, information about the product or order.
Purpose: to respond to your enquiries, advise you on products, interior design solutions and measurements, and handle claims.
Legal basis: performance of a contract or legitimate interest (Article 6(1)(b) and (f) GDPR).

2.6. Website operation, security and statistics

Data: IP address, device and browser data, time of visit, pages viewed, and the source from which you reached the website.
Purpose: to ensure the operation and security of the website, prevent fraudulent orders, and analyse and improve the website.
Legal basis: legitimate interest (Article 6(1)(f) GDPR) or your consent where data is collected by means of non-essential cookies.

3. How long we retain data

Order and accounting data – 10 years from the business transaction, as required by the legislation governing accounting and the retention of documents.
Account data – for as long as you have an account; when the account is deleted, the data is erased, except for data that we are required to retain for accounting purposes.
Marketing data – until you withdraw your consent or object to the processing; thereafter, we may keep your email address on a suppression list to ensure that we do not contact you again.
Enquiries and correspondence – 2 years from the last contact.
Guarantee and claim documents – for the duration of the guarantee period and for 1 year thereafter.
Website logs – up to 14 months.

Once the retention period has expired, data is erased or irreversibly anonymised.

4. Who we share data with

We do not sell personal data. We disclose it only to the extent necessary to fulfil orders and to carry on our business:

The online shop platform – Shopify Inc. (operation of the shop, hosting of order and customer data).
Payment service providers – payment data is processed by the payment service providers themselves; we do not see or store your card details.
Courier and postal service providers and parcel locker operators – the data necessary for delivery.
Providers of accounting and point-of-sale systems – for accounting and invoicing purposes.
Manufacturers and suppliers of goods – where goods are ordered directly from the manufacturer or a guarantee claim is being handled.
Providers of IT, email and marketing tools – for technical support and communication purposes.
Providers of legal and debt collection services, and public authorities – where this is necessary to defend our legitimate interests or where we are required to do so by law.

All service providers act under data processing agreements and may process data only for the purposes we specify.

5. Transfers of data outside the European Economic Area

Some service providers (for example, providers of the shop platform or of marketing tools) may process data outside the EEA. In such cases, data is transferred only on the basis of an adequacy decision or where standard contractual clauses approved by the European Commission have been concluded and supplementary security measures implemented.

6. Your rights

As a data subject, you have the right to:

know whether we process your data and obtain a copy of it;
request the rectification of inaccurate or incomplete data;
request the erasure of your data (the “right to be forgotten”) where there is no longer a legal basis for retaining it;
request restriction of the processing of your data;
object to processing based on legitimate interest and, at any time, object to direct marketing;
receive your data in a structured, machine-readable format and transmit it to another data controller;
withdraw your consent at any time.

To exercise any of these rights, please write to info@ideadesign.lt. We will respond within 30 calendar days at the latest. To protect your data, we may ask you to verify your identity.

7. Complaints

If you believe that we are processing your data unlawfully, please contact us first – we will do our best to resolve the matter. You also have the right to lodge a complaint with the supervisory authority:

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)
L. Sapiegos g. 17, 10312 Vilnius
Tel. +370 5 271 2804
Email: ada@ada.lt
vdai.lrv.lt

8. Cookies

Our website uses cookies – small files that are stored on your device.

Strictly necessary cookies – required for the website to function: for the shopping basket, logging in and security. They are stored without separate consent, as the shop would not work without them.
Analytics cookies – help us understand how the website is used so that we can improve it.
Marketing cookies – enable us to show more relevant advertising and measure its effectiveness.

Non-essential cookies are stored only with your consent. You can change or withdraw your consent at any time in the website's cookie settings, and you can also delete or block cookies in your browser settings. If you disable certain cookies, some features of the shop may be limited.

9. Data security

We apply technical and organisational measures to protect data: an encrypted connection (HTTPS), access restricted to those employees who need the data for their work, confidentiality undertakings and reliable service providers. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we continually review and update our measures.

10. Children's data

The online shop is intended for adults. We do not knowingly collect the data of persons under the age of 16. If we become aware that we have received such data without the consent of a parent or guardian, we will delete it.

11. Changes to this policy

We may update this policy. The current version is always published on this page, and the date of the latest update is shown at the top. We will notify you of any material changes by email or by means of a notice on the website.