Privacy policy

1. Data controller

InSpe, IĮ, company registration number 120650387, VAT number LT206503811. Registered address: Savanorių pr. 178F-105, Vilnius, LT-03154, Lithuania. Email: [email protected]. Telephone: +370 659 92118.

Send data protection questions to [email protected] with “Personal data” in the subject. This policy covers Drobės.lt visitors, accounts, buyers, gift recipients and enquiries.

2. Data, purposes and legal bases

3. Photographs and other people

Upload only photographs you are entitled to submit for printing. A person’s image can be personal data; the purchaser’s contract does not itself establish a contractual legal basis for every person in a photograph. Consider privacy when using photographs of other people or children, and obtain appropriate permission where needed.

We do not request copies of identity documents, health data or other special category data. An ordinary photograph is not itself a biometric template used for facial identification. Do not upload sensitive content; contact us first about a lawful special order. We consider requests from people shown in photographs separately, without disclosing other customers’ files.

4. Sources of data

You provide data, and your browser and the service generate some technical data. A buyer may provide a gift recipient’s contact details; these do not authorise advertising. Information about such collection is provided under GDPR Article 14 where required.

Account contact details and order history were transferred from the previous system for account continuity. Old customer photographs were not imported. The new store is operated by InSpe, IĮ; historic orders are not new orders. Old marketing consent is not automatically transferred or expanded. Signing in to a transferred account may require email verification.

5. Recipients

Access is limited to authorised staff and contracted service providers who need it for their function. These may include hosting, print preparation, payment, courier, email and SMS services, accounting systems and authorities making a lawful request. Couriers do not need original photographs or design files.

An Interneto vizija server is used for website hosting and file storage; Sender is used for order and sign-in emails. Payments use the Paysera payment page, which receives the order ID, amount and payment information it needs. The courier receives recipient contacts, the address and parcel details. An authorised InSpe accountant handles invoices. We send an SMS about preparation of a paid order through LightSMS (Paysera), which receives the phone number and message text. These are order-related messages, not marketing. InSpeID is not required for an account or an order.

If you separately consent to marketing measurement, Meta Pixel sends Meta Platforms Ireland Limited information about visits to public website pages, browser identifiers and technical data. After an actual Paysera-verified payment, the server may send Meta a purchase event containing the time, total in EUR, browser User-Agent, valid _fbp / _fbc identifiers if present, and a hash of the random order identifier for deduplication. Private order pages are not measured by Meta Pixel. Photographs, designs, the buyer’s name, email, phone, payment card and the order number itself are not sent for this measurement. Meta processes data under its privacy terms; appropriate safeguards apply to international transfers. These marketing technologies are not enabled before your choice.

If you separately consent to analytics, Google Analytics 4 sends Google Ireland Limited public page views, catalogue and basket actions, browser identifiers and technical data. After verified payment, only the order ID, total in EUR and currency may be sent. Photographs, designs, the buyer’s name, email, phone, card details and delivery address are not included in analytics events. Analytics is independent of marketing consent; consent to Google advertising personalisation is not granted. Google’s privacy terms and appropriate international transfer safeguards apply.

If a provider or its support team accesses data outside the EEA, the transfer’s legal basis is assessed first: an adequacy decision or appropriate safeguards such as standard contractual clauses and supplementary measures. Contact us for a copy of the safeguards applying to a specific transfer.

6. Retention

An order form draft containing contacts, billing details, delivery method and address is temporarily saved in the browser tab’s sessionStorage so it survives a refresh. It is tied to the buyer session, is not used for advertising and does not contain consent or design approvals. It is not restored more than 24 hours after its last save and is removed after successful order submission. Clearing website data in the browser can remove this local draft; it does not delete an order already submitted to the server.

Projects and favourites saved in “My creations” are linked to the browser session or account and can be removed there. A wall photograph used for a personal room preview remains in the browser window and is not uploaded to the server.

A phone transfer link lasts 15 minutes and permits one file upload. It does not grant account access. A photograph not confirmed on the computer is removed when the link is cancelled or expires; expiry is checked every minute. A confirmed photograph follows the normal design file retention rules.

Files for unpurchased projects are retained while needed for the project or account service you use. Order designs and print files are retained to fulfil the order and handle possible quality claims. On account or project deletion or a separate request, we assess which files can be removed and which still have a specific lawful retention basis. The website is not a permanent personal photograph archive.

Retention of files and account data depends on project use, order fulfilment, unresolved claims and applicable obligations. Photograph retention is not automatically equated to accounting document retention. Contact [email protected] about a specific file’s retention or deletion.

When actual VAT invoices are issued, the general rule stated by the Lithuanian tax authority is retention for 10 years from issue. A dispute or legal obligation may require retention only of relevant data. Deletion requests also require consideration of restricted-use backups; if the system is restored, the request must be applied again.

7. Your rights

Data rights requests are normally answered within one month. If complexity or the number of requests requires up to two additional months, you are informed of the extension and reason within the first month. Identity checks are proportionate; a document copy is not a routine requirement. Erasure is not absolute, for example where retention is required by law. Email requests to [email protected].

• Receive information and a copy of your personal data; correct inaccurate data.
• Request erasure or restriction where the legal conditions are met.
• Receive data in a portable format where the right to portability applies.
• Object to processing based on legitimate interests; object to direct marketing at any time.
• Withdraw consent as easily as it was given; this does not invalidate earlier lawful processing.
• Complain to VDAI or seek a judicial remedy.

State Data Protection Inspectorate

8. Marketing, cookies and automation

Meta marketing measurement and Google Analytics 4 analytics rely on two separate, prior and freely given consents. They are not necessary for an account, design, order or payment. You may accept or reject either, and rejection is as easy as acceptance. Change either choice at any time using “Cookie settings” in the footer. Withdrawing the relevant consent stops new events in that category and removes first-party _fbp / _fbc or _ga cookies from this domain; earlier lawful processing is not undone. Choices are saved in the browser for no more than 180 days. A purchase event is sent only if the relevant consent existed before payment and the customer opened the paid order page within seven days of verification. Not all sales will therefore appear in measurement reports. These choices do not enable marketing emails. Order status messages are separate from advertising.

Resolution assessment, pricing and design preparation are not assessments of a person’s behaviour. We do not currently use solely automated decisions having a legal or similarly significant effect on a person, or advertising profiling.

Cookies