1. Scope
This policy explains how MB DeepRocket, operator of the LuresBack brand and luresback.com (“we”, “us”, “our”), processes personal data when you browse the Website, contact us, create an account, subscribe to marketing or place an order. It applies to customers, potential customers, business partners and Website visitors.
“Personal data” means information relating to an identified or identifiable person. We process it in accordance with the EU General Data Protection Regulation (GDPR), Lithuanian law and other applicable privacy law.
2. Data we collect
Information you provide
- Identity and contact data: name, email address, telephone number, billing and delivery address.
- Order data: products, quantities, order number, price, currency, delivery method, returns, refunds and support history.
- Account data: login identifier, encrypted password and saved preferences, if accounts are enabled.
- Communications: questions, reviews, photographs or other content you send.
- Marketing choices: consent, subscription status and communication preferences.
- Business enquiries: company, role and information supplied for distribution or licensing discussions.
Information collected automatically
- IP address, browser, device type, operating system, language and approximate country;
- pages visited, referral URL, interaction, error and diagnostic information;
- cookie or similar identifiers, where permitted by your settings and consent.
Payment data
Live payments may be handled by an independent payment provider. We normally receive transaction status, method type and a limited reference, not your complete card number or security code.
3. Why we use data and our legal bases
- Contract: to take steps at your request, process and deliver orders, provide order updates, manage returns, refunds, warranties and support.
- Legal obligation: to keep tax and accounting records, comply with consumer law, respond to authorities and prevent prohibited transactions.
- Legitimate interests: to secure and improve the Website, prevent fraud, understand aggregate performance, manage stock, respond to business enquiries and establish or defend legal claims. We balance these interests against your rights.
- Consent: to send optional email marketing, use non-essential cookies or publish content where consent is the appropriate basis. You may withdraw consent at any time without affecting earlier lawful processing.
We do not use personal data for solely automated decisions that produce legal or similarly significant effects unless we tell you and provide applicable safeguards.
4. When we share data
We disclose only what is reasonably necessary to:
- hosting, ecommerce, email and IT providers supporting the Website;
- payment processors, banks and fraud-prevention providers handling transactions;
- warehouses, carriers, postal operators and customs agents fulfilling delivery and returns;
- professional advisers such as accountants, lawyers and insurers;
- analytics or advertising providers where enabled and lawfully consented to;
- public authorities, courts or regulators where legally required;
- a buyer, investor or successor in a genuine corporate transaction, subject to confidentiality and legal safeguards.
Service providers may use personal data only under our instructions or as independently disclosed in their own policies. We do not sell personal data.
5. International transfers
Some providers may process data outside the European Economic Area. Where the destination has not been recognised as adequate, we use an approved safeguard such as the European Commission’s Standard Contractual Clauses and, where needed, supplementary measures. Contact us for information about the relevant safeguard.
6. Retention
We retain data only as long as needed for the purpose collected, including legal, accounting, tax, fraud-prevention and dispute requirements. Typical periods are:
- order, invoice and accounting records: for the period required by Lithuanian tax and accounting law, commonly up to 10 years;
- customer service and warranty correspondence: normally up to 3 years after resolution, longer if a claim remains possible;
- account data: while active and for a limited period after closure;
- marketing preferences: until withdrawal, plus a minimal suppression record so we respect the opt-out;
- security and technical logs: generally days or months unless required to investigate an incident;
- cookie data: as listed in the Cookie Policy.
We may anonymise data so it no longer identifies anyone and retain that anonymous information for statistical purposes.
7. Security
We use proportionate technical and organisational safeguards, including access controls, encryption in transit, managed hosting, software maintenance, backups and provider due diligence. No internet system is completely secure, so we cannot promise absolute security. If a breach creates a risk to your rights, we will notify the competent authority and affected people where law requires.
8. Your privacy rights
Depending on where you live, you may have the right to:
- access personal data and receive a copy;
- correct inaccurate or incomplete data;
- request deletion where no lawful reason requires continued processing;
- restrict processing in specified circumstances;
- receive data you supplied in a structured, commonly used, machine-readable format and transmit it elsewhere;
- object to processing based on legitimate interests, and object at any time to direct marketing;
- withdraw consent at any time;
- complain to a supervisory authority.
To exercise a right, email info@luresback.com. We may request proportionate information to confirm identity. We normally respond within one month, subject to lawful extensions. We will not charge unless a request is manifestly unfounded or excessive.
You may complain to Lithuania’s State Data Protection Inspectorate or the authority in your EU/EEA country of residence or work.
9. Marketing
We send promotional email only where permitted, normally with consent or an applicable existing-customer rule. Every marketing email will include an unsubscribe method. Service messages about an order, safety issue or policy change are not marketing and may still be sent where necessary.
10. Cookies and local storage
The Website uses necessary browser storage for core functions such as the demonstration cart. Non-essential analytics, advertising or personalisation technologies will be used only where permitted and after any required consent. See the Cookie Policy for details and controls.
11. Children
The Website is not directed to children and we do not knowingly collect personal data from a child who cannot lawfully consent. If you believe a child has provided information without appropriate involvement of a parent or guardian, contact us so we can investigate and delete it where required.
12. Third-party links and social media
The Website may link to third-party sites. Their operators control their own data practices, and this policy does not apply to them. Review their privacy information before providing data.
13. Changes and contact
We may update this policy to reflect changes in law, technology or our services. We will post the revised date and provide additional notice where a change materially affects your rights.
Questions, requests and complaints can be sent to MB DeepRocket at info@luresback.com.