1. Who controls your data
Data controller:
MB Onebalt (trading as the KBeautyOne webshop)
Company registration number 308099546, Krokuvos g. 53-3, LT-09306 Vilnius, Lithuania
Data protection contact: privacy@kbeautyone.com
We have not appointed a Data Protection Officer; Article 37 GDPR does not require one in our case. Please send all data questions to the address above.
2. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, e-mail, phone, delivery and billing address linked to an order | Fulfilling and delivering the order, contacting you and keeping accounting records | Contract and legal obligation (Art. 6(1)(b), (c) GDPR) | 10 years where needed for order and accounting records |
| Order contents, amount, payment status | Fulfilment and accounting | Contract and legal obligation (Art. 6(1)(b), (c)) | 10 years |
| Account data (e-mail, password hash, preferences) | Running your account | Performance of a contract (Art. 6(1)(b)) | Until deletion or 3 years of inactivity; order/accounting records remain under their separate period |
| Returns and complaints data | Handling returns and statutory claims | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) | Correspondence 3 years; accounting documents 10 years |
| Contact and complaint e-mails (name, e-mail, order no., message) | Answering an enquiry or complaint | Legitimate interest and, where applicable, legal obligation (Art. 6(1)(f), (c)) | 3 years |
| Newsletter e-mail address | Sending the newsletter | Consent (Art. 6(1)(a)), confirmed by double opt-in | Until you withdraw consent |
| Technical and security records (IP address, browser data, server logs) | Site operation, security, fraud prevention | Legitimate interest (Art. 6(1)(f)) | SiteGround archived access logs: 30 days |
| Cookies | See the Cookie Policy | Essential: technical necessity / legitimate interest. All others: consent | See cookie policy |
You provide the data yourself. Name, address, e-mail and payment details are necessary to conclude the contract — without them we cannot fulfil an order.
We do not knowingly collect children's data. The shop is intended for adults.
3. Who we share data with
We do not sell your data. We share only what is necessary, with:
| Recipient | For | Location |
|---|---|---|
| SiteGround (hosting and server-based e-mail sending) | Site and MailPoet data storage, backups, message delivery | EU / subject to provider service terms |
| Warehouse and fulfilment partner (processor) | Name, delivery address, phone and e-mail to prepare the parcel | EU |
| LP EXPRESS / Lietuvos paštas (delivery) | Name, delivery address or locker, phone and e-mail | EU |
| Paysera (payments; may act as an independent controller for a payment) | Payment and order identifiers | Subject to Paysera's privacy policy |
| MailPoet (newsletter tool installed on our site) | E-mail and subscription status stored on our site; current sending method is our host's PHPMail, not MailPoet Sending Service | SiteGround server |
| Google Ireland / Google LLC, only if you use the active Google sign-in | Sign-in identity data | EU / USA under provider terms |
| Our accountant | Accounting records | EU |
| Public authorities | Only where the law requires it | LT |
No analytics or advertising pixels are active on this site today. We will update this and the cookie policy before enabling such a tool.
4. Transfers outside the EU
We seek to keep data in the EU/EEA. If you use Google sign-in, identity data may be transferred to Google group companies outside the EEA. Paysera may use other recipients for payments, including outside the EEA, as described in its privacy policy. Where a transfer outside the EEA applies, appropriate GDPR Chapter V safeguards must be in place. We will confirm the relevant provider contracts and transfer grounds before publication.
5. Your rights
You have the right to:
- access your data and receive a copy;
- rectify inaccurate data;
- erase your data — except where we must keep it by law;
- restrict processing;
- port your data to another controller;
- object to processing based on legitimate interest;
- withdraw consent at any time, without affecting processing carried out before withdrawal.
Contact privacy@kbeautyone.com. We respond within one month; for complex requests we may extend by up to two further months and will tell you.
You can unsubscribe from the newsletter using the link at the bottom of every message.
6. Complaint to the supervisory authority
If you believe we process your data unlawfully, you may lodge a complaint with:
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI)
L. Sapiegos g. 17, 10312 Vilnius, Lithuania
E-mail: ada@ada.lt · Tel. +370 5 271 2804, +370 5 279 1445
vdai.lrv.lt
We would appreciate the chance to resolve it with you first — it is usually faster.
7. Security
The site runs over encrypted HTTPS. Access to order data is limited to authorised people. Passwords are stored only as cryptographic hashes. In the event of a personal data breach we notify VDAI and, where required, you, in line with Articles 33–34 GDPR.
8. Changes
We may update this policy. The current version is always on this page. Last updated: 2026-10-10.