Privacy policy

This is an English translation provided for convenience only. The legally binding version is the Lithuanian one; if the versions differ, the Lithuanian text prevails.

1. Controller

Your personal data is processed by MB Prekybos idejos, registration no. 32312345, address Aluonos g. 16, Vijuku km., Kaunas raj., Lietuva, email [email protected] (NORE), which runs the NORE marketplace (nore.lt, its subdomains and the domains assigned to shops).

Goods on the marketplace are sold by sellers. When you place an order, the seller receives the data needed to fulfil it and processes it as an independent controller – you may also contact the seller about it.

2. What data we process and why

Purpose	Data	Legal basis	Retention
Taking orders, payments, delivery	name, email, phone, billing and delivery address or parcel locker, order contents, payment status (we never receive card details)	concluding and performing the contract (GDPR Art. 6(1)(b))	10 years, as the basis of accounting documents
Invoices and accounting	buyer and seller details shown on invoices, amounts	legal obligation (GDPR Art. 6(1)(c))	10 years (Lithuanian Law on Accounting)
Enquiries and complaints	contact details, correspondence	legitimate interest in answering and defending claims; legal obligation to handle consumer complaints	3 years after the matter is closed
Seller registration and agreement	name, personal identification code, individual activity certificate or business licence number, company details, VAT code, address, contacts, consent to the agreement	performing the contract; legal obligation	while the agreement is in force and 10 years after it ends
Tax reporting (DAC7)	seller identification data, date of birth, account number, sales amounts	legal obligation	5 years after the reporting period
Marketplace security	login data, IP address, activity logs	legitimate interest in security	as long as needed to investigate security incidents
Analytics and marketing	cookie data	your consent	see the cookie policy

Personal identification codes are never published or printed on invoices.

3. Who receives the data

The seller you buy from – to fulfil the order and handle returns and complaints.
Paysera – to process payments and refunds.
Carriers (e.g. LP Express, Omniva) – from the seller, when shipping your order.
Service providers processing data on our behalf: email delivery (Resend) and hosting (Fly.io; servers in the European Union).
Public authorities – where the law requires it (e.g. the State Tax Inspectorate).

Where a service provider processes data outside the European Economic Area, this is done with the safeguards the GDPR provides for (e.g. Standard Contractual Clauses approved by the European Commission or the EU–US Data Privacy Framework).

4. Your rights

You have the right to:

access your data;
have it corrected;
have it erased when there is no longer a basis to process it;
restrict its processing;
receive your data in a portable format;
object to processing based on legitimate interest;
withdraw consent at any time (cookie settings can be changed at the bottom of the page).

Write to [email protected]. We answer within 1 month. If you believe your data is processed unlawfully, you may complain to the State Data Protection Inspectorate (L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt).

5. Changes