1. General Information
1.1. This Privacy Policy regulates the main principles and procedures for collecting, processing, and storing personal data of visitors and users of www.ommassage.lt (the Website), managed by UAB “Koreana”. Please read this Policy carefully before using the Website.
1.2. By using the Website, you confirm that you have read and understood this Policy.
1.3. The Website is administered by UAB “Koreana”, legal entity code 305038584, VAT payer code LT100012233916 (the Provider), email info@ommassage.lt, telephone +370 640 86204.
1.4. A User is any natural person using the Website. A User who does not agree with this Policy should not use the Website.
1.5. The Provider follows purpose limitation, accuracy, fairness, data minimisation, confidentiality, and storage limitation principles. Personal data is processed only by authorised persons and retained no longer than necessary.
1.6. Third-party terms may apply when you use external services, including social networks. The Provider does not process reservation data submitted directly through Treatwell.
1.7. Personal data is processed under Regulation (EU) 2016/679 (GDPR), the Law on Legal Protection of Personal Data of the Republic of Lithuania, and other applicable Lithuanian and European Union legislation.
2. Collection, Processing, and Storage of Personal Data
2.1. Personal data that you provide directly or indirectly may be collected, organised, used, and otherwise processed for the purposes described in this Policy and permitted by law.
2.2. You are responsible for ensuring that the data you provide is accurate, correct, and complete, and for informing the Provider if it changes.
2.3. Depending on the feature used, data may include: an email address supplied for a newsletter; name, contact, delivery, and payment information for e-commerce where applicable; name, email, and message submitted through an inquiry; and technical information such as IP address, cookies, and browsing activity used for performance and security.
2.4. Treatwell is responsible for personal data submitted through its booking service. The Provider does not process reservation data submitted directly to Treatwell.
3. Processing for the Purpose of Service Provision
3.1. The Provider offers wellness and massage services and processes client data to take steps before entering into a contract, arrange appointments, and provide the requested services.
3.2. Required client information may include full name and telephone number. A client may voluntarily provide an email address, residential address, and relevant health information.
3.3. Processing is based, as applicable, on consent, performance of a contract, steps requested before a contract, compliance with legal obligations, or legitimate interests such as Website security and fraud prevention.
3.4. Where an online shop uses payment, delivery, or logistics partners, buyer data is shared only to the extent necessary to fulfil the order or comply with law.
4. Processing for Direct Marketing
4.1. Direct marketing is sent only to Users who have consented. The legal basis is consent under Article 6(1)(a) GDPR.
4.2. Consent may be given in a client questionnaire or by entering an email address in a newsletter field. Without consent, the Provider will not use personal data to send promotional or informational messages.
4.3. Data processed for direct marketing may include first name, last name, email address, and telephone number. The Provider does not disclose this data to third parties for their own direct marketing.
4.4. Data may be used to send subscribed newsletters, process purchases and delivery, answer inquiries, improve Website performance and services, maintain security, and comply with law.
5. Personal Data Storage and Retention
5.1. The Provider applies appropriate organisational and technical safeguards against accidental or unlawful destruction, alteration, disclosure, loss, and other unlawful processing.
5.2. The Provider does not intentionally transfer Users’ personal data to third countries unless a lawful transfer mechanism applies and the User is appropriately informed.
5.3. Data is retained only for as long as required for its purpose or by law, and is securely deleted or anonymised afterwards.
5.4. A newsletter email is retained until consent is withdrawn. Buyer and transaction records are retained for statutory accounting periods. Inquiry data is normally deleted within three years if no contract or order relationship arises. Technical and cookie-related data is retained no longer than necessary for infrastructure, consent, and security purposes.
6. Data Subject Rights
6.1. Subject to the conditions in the GDPR, you may request access to your personal data, correction of inaccurate or incomplete data, erasure, restriction of processing, data portability, or object to processing.
6.2. Where processing is based on consent, you may withdraw consent at any time without affecting processing carried out before withdrawal.
6.3. To exercise your rights or complain about the Provider’s handling of personal data, contact info@ommassage.lt. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania.
7. Final Provisions
7.1. The laws of the Republic of Lithuania apply to matters arising under this Policy.
7.2. To the extent permitted by law, the Provider is not responsible for losses caused by a User’s own acts or omissions, incorrect data, intentional misuse, or interruptions caused by unrelated third parties, including electricity or internet service disruptions.
7.3. The Provider may amend this Policy. Changes take effect when published on the Website. Continued use after publication means the updated Policy applies to subsequent use.