Last updated: 2026-07-06
This policy explains how CandyBoxBuys, operated by UAB Wise Trading Group (Ramybės g. 4-70, LT-02103 Vilnius, Lithuania), as data controller, processes your personal data under the EU GDPR. Contact for privacy matters: hello@candyboxbuys.eu.
To process your order we collect: your name, email, phone (optional), delivery address, order contents and order history. Card payments are handled by our processor Stripe — we receive a payment confirmation but not your card number. We set two strictly-necessary cookies (an anonymous cart-session id and your language choice); we do not use advertising or tracking cookies.
To perform our contract with you (Art. 6(1)(b)): processing and delivering your order, order-status communication, handling returns. To meet legal obligations (Art. 6(1)(c)): accounting, invoicing and tax/VAT records. Legitimate interests (Art. 6(1)(f)): fraud prevention and securing our shop.
Only as needed to fulfil your order: our payment processor (Stripe), the delivery carrier, our email provider (Google Workspace), and our accounting/ERP systems. We do not sell your personal data. Processors act under contract and only on our instructions.
Where a processor transfers data outside the EEA, it is protected by an adequacy decision or EU Standard Contractual Clauses.
Order and delivery data for as long as needed to complete your order and handle returns/warranty, then for the retention period required by Lithuanian accounting and tax law (generally up to 10 years for accounting records). After that it is deleted or anonymised.
You have the right to access, rectify, erase, restrict, and port your data, and to object to processing based on legitimate interests. To exercise these, email hello@candyboxbuys.eu. You may also lodge a complaint with the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, Vilnius — ada.lt.