This is a translation of the Lithuanian original. In case of any discrepancy, the Lithuanian version prevails.
Effective from: 14 October 2026
This privacy policy explains how MB Freigona prekyba processes personal data when you visit rollpaper.shop, buy goods or contact us. We process data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Lithuanian Law on Legal Protection of Personal Data and the Law on Electronic Communications.
1. Data controller
MB Freigona prekyba
Company code: 304409823
VAT number: LT100010796118
Address: K. Būgos g. 32, Kaunas, Lithuania
Email: info@rollpaper.shop
Phone: +370 612 58454
For any questions about personal data, please email info@rollpaper.shop.
2. What data we collect and why
2.1. Order fulfilment
When you place an order, we collect:
- your name, email address and phone number;
- billing and delivery address (country, city, street, postcode);
- the chosen delivery method and SmartPosti parcel locker, if you choose one;
- ordered goods, quantities, prices, discounts and the order comment;
- company details (name, company code, VAT number) if you buy as a company;
- the payment method and payment status.
We do not receive or store bank card details. They are processed directly by the payment service providers (see section 4).
Purpose: to accept and fulfil the order, deliver the goods, keep you informed about the order, accept returns and handle complaints.
Legal basis: conclusion and performance of a contract (GDPR Art. 6(1)(b)).
2.2. Invoices and accounting
We issue an invoice for each order. It contains the buyer’s details, the goods purchased and the amounts. We keep order and invoice data for as long as accounting and tax legislation requires.
Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c)).
2.3. Correspondence
When you email or call us (e.g. about a wholesale order or an individual business price), we process your name, contact details, company name and the content of your message.
Purpose: to answer your enquiry and make an offer.
Legal basis: steps prior to entering into a contract (GDPR Art. 6(1)(b)) or our legitimate interest in responding to enquiries (GDPR Art. 6(1)(f)).
2.4. Withdrawal form
When you submit a notice through the withdrawal form, we process your name or company name, order number and date, email address, note, and the date and time of submission.
Purpose: to give effect to your right of withdrawal and confirm receipt of the notice.
Legal basis: for consumer notices – compliance with a legal obligation (GDPR Art. 6(1)(c)); for business notices – performance of a contract (GDPR Art. 6(1)(b)).
2.5. Website operation, security and fraud prevention
The website server technically processes your IP address, browser information and request times. When you pay by card, the payment service provider Stripe uses device and browsing information to detect fraud, and may also use an hCaptcha check for this purpose.
Legal basis: our legitimate interest in ensuring the security of the website and payments (GDPR Art. 6(1)(f)).
3. Where we get the data
We receive data directly from you: through the order form, emails and calls. Payment service providers inform us of the payment status (paid or unpaid).
4. Who we share data with
We share data only to the extent necessary for the stated purposes:
| Recipient | Purpose | Data |
|---|---|---|
| Stripe (Stripe Payments Europe, Ltd., Ireland) | Card payments, Apple Pay, Google Pay, Link, Klarna; fraud prevention | Name, email, address, order amount, device data. Card details are processed by Stripe only |
| Paysera (Paysera LT, UAB, Lithuania) | Payments via online banking | Name, email, address, order number and amount |
| SmartPosti (parcel delivery service provider) | Delivery of goods to a parcel locker or by courier | Name, phone number, email, delivery address or parcel locker |
| Hostinger (Hostinger International Ltd.) | Hosting of the website, database and email | All data processed on the website (as a data processor) |
| Accounting service provider, the State Tax Inspectorate and other public authorities | Accounting and legal requirements | Invoice and order data |
Some service providers, such as Stripe, may also transfer data outside the European Economic Area. In that case, the safeguards provided by the GDPR apply: standard contractual clauses approved by the European Commission or the EU–US Data Privacy Framework.
We do not sell your data or share it with third parties for their marketing.
5. How long we keep data
| Data | Retention period |
|---|---|
| Invoices, order and payment accounting data | 10 years from the transaction, as required by accounting and tax legislation |
| Order data not related to accounting (e.g. parcel locker choice, comments) | While the order is being fulfilled and 3 years after fulfilment for handling possible claims |
| Withdrawal notices | 3 years from submission |
| Correspondence that did not result in an order | 1 year from the last message |
| Shopping cart session | Up to 2 days |
When the period expires, we delete or anonymise the data.
6. Your rights
You have the right to:
- obtain information on whether we process your data and access it;
- request correction of inaccurate data;
- request erasure of data when it is no longer needed or there is no basis for processing it (we cannot erase accounting data before the mandatory retention period ends);
- restrict the processing of data;
- receive the data you provided in a structured format and transfer it to another controller;
- object to processing based on our legitimate interest;
- withdraw consent at any time (withdrawal does not affect earlier processing).
Send requests by email to info@rollpaper.shop. We will reply within 1 month at the latest. If necessary, we may ask you to confirm your identity.
If you believe your data is being processed unlawfully, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt). We recommend contacting us first – we will try to resolve the matter quickly.
7. Cookies
Cookies are small files that a website stores in your browser. rollpaper.shop does not use advertising or social media tracking cookies. We use Google Analytics 4 for statistics, but only if you agree to it.
| Cookie | Provider | Purpose | Expiry |
|---|---|---|---|
wp_woocommerce_session_* | rollpaper.shop (WooCommerce) | Shopping cart session | 2 days |
woocommerce_cart_hash, woocommerce_items_in_cart | rollpaper.shop (WooCommerce) | Cart contents status | Session |
pll_language | rollpaper.shop (Polylang) | Selected website language | 1 year |
__stripe_mid, __stripe_sid | Stripe | Payment security and fraud prevention | 1 year / 30 min |
m (m.stripe.com) | Stripe | Payment security and fraud prevention | up to 400 days |
hmt_id, __cf_bm, __cflb | hCaptcha (Intuition Machines, Inc.) / Cloudflare, used by Stripe | Protection against automated requests | up to 30 days |
rp_consent | rollpaper.shop | Your cookie choice | 12 months |
_ga, _ga_DNNLBZ1FDV | Google Ireland Limited (Google Analytics 4) | Website usage statistics, only with consent | 13 months |
Essential cookies (cart, language, payment security) are needed for the website and payment to work. You can delete or block cookies in your browser settings, but the cart and payment may then not work.
Statistics cookies (Google Analytics 4) are set only after you click “Accept” in the cookie notice. They help us understand how visitors use the website: which pages and products are viewed and when an order is started and completed. The legal basis is your consent. Google signals and ad personalisation are turned off, so this data is not used for advertising. Google Analytics data is kept for 14 months. It is processed by Google Ireland Limited and may be transferred to Google LLC (USA) under the EU-US Data Privacy Framework. You can withdraw or change your consent at any time by clicking “Cookie settings” in the website footer. When you withdraw consent, the statistics cookies are deleted and no more data is sent.
During the session, a technical WordPress entry about emoji support is also stored in the browser memory (sessionStorage). It contains no personal data.
8. Automated decisions
We do not make automated decisions that have legal effects for you. When you pay by card, Stripe automatically assesses the fraud risk and may decline a suspicious payment. In that case, please contact us and we will offer another payment method.
9. Data security
The website works only over an encrypted HTTPS connection. Access to order data is granted only to persons who need it for their work. Payment data is processed by licensed payment service providers.
10. Children
The website is intended for adults and businesses. We do not knowingly collect data from persons under 14.
11. Changes to this policy
We may update this policy, e.g. when service providers or legislation change. The current version is always published on this page, together with its effective date.