PRIVACY AND COOKIE POLICY

Last updated: 5 November 2026

1. General Provisions

1.1. This Privacy and Cookie Policy (hereinafter referred to as the "Privacy Policy") sets out the principles governing the collection, use, storage and protection of personal data when visiting the website and online store www.gerimetai.lt (hereinafter referred to as the "Website"), visiting GERI METAI's physical premises (shop, café and wine tasting area), purchasing goods, ordering services or otherwise communicating with GERI METAI.

1.2. The personal data controller is:

• Company name: Vevaldis, UAB

• Brand name: GERI METAI

• Company registration number: 134587630

• VAT identification number: LT345876314

• Address: Kun. Antonijaus Dzekano g. 1A, Ponasų k., Sužionių sen., LT-15111 Vilniaus r., Lithuania

• Email: gerimetai@gerimetai.lt

• Telephone: +370 698 27592

• Website: https://gerimetai.lt

1.3. When processing personal data, we comply with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, hereinafter referred to as the "GDPR"), the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania and other applicable legislation.

1.4. We respect every individual's right to privacy and undertake to process personal data lawfully, fairly, transparently and solely for clearly defined purposes.

1.5. This Privacy Policy applies to Website visitors, customers, individuals booking wine tastings and other services, visitors to our physical premises, and individuals who contact us by email, telephone or other means of communication.

2. What Personal Data Do We Collect?

2.1. Depending on how you use the Website and our services, we may collect and process the following personal data:

2.1.1. Customer identification and contact details:

• Full name;

• Telephone number;

• Email address;

• Delivery address;

• Information required for issuing invoices.

2.1.2. Order and payment information:

• Goods and services ordered;

• Order number, date and amount;

• Selected delivery and payment methods;

• Order status;

• Payment confirmation and transaction identification details;

• Purchase history, if stored in the online store system.

When payments are made through electronic payment service providers, the information required to process payments may be handled directly by the relevant payment service providers in accordance with their privacy policies. We do not store payment card details or security codes (CVV/CVC).

2.1.3. Communication data:

• Content of emails and enquiries;

• Information concerning requests, complaints and claims submitted;

• Other information voluntarily provided by individuals when communicating with us.

2.1.4. Technical and Website usage data:

• IP address;

• Browser and device technical information;

• Date and time of visits;

• Cookie identifiers;

• Information about browsing activity on the Website, where the collection of such information is lawful.

2.1.5. Age verification data:

As alcoholic beverages are also sold through the online store, we may process information necessary to verify a customer's age in cases provided for by applicable legislation.

We aim to collect only the information necessary to ensure that alcoholic beverages are sold and handed over exclusively to individuals who are legally entitled to purchase them.

3. Purposes and Legal Bases for Processing Personal Data

3.1. We process personal data for the following purposes:

3.1.1. Receiving and fulfilling orders

Personal data is used to process orders, administer payments, prepare goods, arrange delivery or handover to customers, organise services and send order-related notifications.

Legal basis: Article 6(1)(b) of the GDPR (performance of a contract or taking steps prior to entering into a contract).

3.1.2. Accounting and compliance with legal obligations

Personal data is used to issue and retain accounting documents, fulfil tax obligations and comply with other statutory requirements.

Legal basis: Article 6(1)(c) of the GDPR (compliance with a legal obligation).

3.1.3. Customer service

Personal data is used to respond to enquiries, resolve order-related matters, handle complaints and ensure appropriate customer service.

Legal basis: Article 6(1)(b) of the GDPR where an enquiry relates to a contract, or Article 6(1)(f) of the GDPR (legitimate interests) where the purpose is to respond to other enquiries, handle complaints or protect legitimate interests.

3.1.4. Direct marketing

Where applicable, personal data may be used to send newsletters and information about new products, wine tastings and other offers, in compliance with applicable direct marketing legislation.

Legal basis: Article 6(1)(a) of the GDPR (consent), except where legislation permits marketing communications to be sent to existing customers without separate prior consent, provided that they are given a free and easy means of opting out.

The advertising of alcoholic beverages and related commercial communications are subject to specific restrictions under the laws of the Republic of Lithuania. This Privacy Policy does not authorise any prohibited advertising of alcoholic beverages.

3.1.5. Ensuring Website functionality and security

Technical data is used to ensure the proper functioning of the Website, maintain system security, identify errors and prevent misuse.

Legal basis: Article 6(1)(f) of the GDPR (legitimate interests) and, where applicable, Article 6(1)(c) (compliance with a legal obligation).

The use of non-essential cookies and similar technologies is based on the visitor's consent.

3.1.6. Ensuring the safety of property and individuals

To ensure the safety of property and individuals, video surveillance may be carried out at GERI METAI's physical premises located at Kun. A. Dzekano 1A, Ponasų k., Vilniaus r. (shop, café, wine tasting pavilion and surrounding areas).

Such surveillance may involve the collection of video images of individuals entering the field of view of surveillance cameras located on GERI METAI premises.

The data is collected for the purposes of the service provider's legitimate interests (Article 6(1)(f) of the GDPR).

4. Personal Data Retention Periods

4.1. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by applicable legislation.

4.2. The following data retention periods apply:

• Order processing data: Retained for the duration of the contract and thereafter for as long as necessary to establish, exercise or defend legal claims and comply with statutory obligations (10 years unless otherwise provided by law).

• Accounting documents: Retained for the period prescribed by applicable legislation (10 years unless a different period applies to specific documents).

• Customer enquiries and correspondence: Retained for 2 years from the last communication, unless a longer period is necessary due to an ongoing contract, dispute or legal obligation.

• Direct marketing data: Retained until consent is withdrawn or another lawful basis for processing marketing data ceases to apply.

• Cookies and technical data: Retained according to the purpose of the specific cookies, their validity periods and the established data retention periods.

• Video surveillance data recorded at the service provider's physical premises: Retained for 30 days from the date of recording.

4.3. Once the applicable retention period expires, personal data is deleted or anonymised, unless applicable legislation requires it to be retained for a longer period.

5. Disclosure of Personal Data to Third Parties

5.1. GERI METAI does not sell products through this online store in foreign markets and delivers goods exclusively within the territory of the Republic of Lithuania.

5.2. In the course of our activities, we may disclose personal data only to service providers and recipients who require such information to provide specific services or comply with legal obligations.

Such recipients may include:

• Delivery and courier service providers operating in Lithuania;

• Banks and electronic payment service providers;

• Accounting service providers;

• Website hosting, e-commerce platform and IT maintenance service providers;

• Legal, auditing or consulting service providers, where necessary;

• Government and law enforcement authorities, where disclosure is required by law.

5.3. We provide data recipients only with the personal data necessary for the performance of their functions.

5.4. Customers' personal data is not transferred to foreign commercial or logistics partners for the purpose of fulfilling international orders, as GERI METAI does not ship goods abroad.

5.5. When using an e-commerce platform, hosting services, payment services or other technological services, personal data may be processed within the European Economic Area (EEA).

If the activities of a particular service provider result in the transfer of personal data outside the EEA, such transfers may take place only in compliance with Chapter V of the GDPR and subject to appropriate data protection safeguards.

5.6. We do not sell customers' personal data to third parties.

6. Personal Data of Minors and the Sale of Alcoholic Beverages

6.1. Under the laws of the Republic of Lithuania, alcoholic beverages may only be sold to individuals aged 20 or over.

6.2. GERI METAI sells alcoholic beverages exclusively to individuals who have reached the legally required age.

6.3. Customers' ages may be verified when placing an order and/or upon handover of goods, in accordance with applicable legislation.

6.4. An identity document may be requested for age verification purposes; however, no copy of the document is retained.

6.5. If it is established that an individual is not legally entitled to purchase alcoholic beverages, the sale or handover of such products will not take place.

7. Direct Marketing and Newsletters

7.1. GERI METAI may inform customers about its activities, new products, events and wine tastings to the extent permitted by applicable legislation.

7.2. Electronic direct marketing communications are sent with the individual's consent or in other cases expressly permitted by law.

7.3. Every individual has the right to opt out of direct marketing communications at any time and free of charge by:

• Clicking the unsubscribe link in a received communication, where such a link is provided;

• Sending an email to gerimetai@gerimetai.lt.

7.4. Withdrawal of consent does not affect the lawfulness of data processing carried out before the withdrawal.

7.5. We do not use customers' contact details obtained during order fulfilment for prohibited advertising of alcoholic beverages.

8. Use of Cookies

8.1. The Website may use cookies — small text files stored on a visitor's device — to ensure the proper functioning of the Website and, subject to the visitor's consent, to provide additional features.

8.2. Cookies may be divided into the following categories according to their purpose:

Strictly Necessary Cookies

These cookies are required for essential Website functions, such as the shopping cart, order placement, security and the storage of selected privacy preferences.

Separate consent is not required for these cookies where they are strictly necessary to provide a service explicitly requested by the visitor or to enable the transmission of electronic communications.

Functional Cookies

These cookies may be used to remember visitors' preferences, such as language or other settings.

Where such cookies are not essential for a specific feature requested by the visitor, they are used only with consent.

Analytics Cookies

These cookies may be used to collect information about Website traffic, browsing behaviour and technical performance in order to improve the Website user experience.

Where consent is required for such cookies or related technologies, they are activated only after consent has been obtained.

Marketing Cookies

Where used, these cookies may help measure the effectiveness of marketing activities or personalise information presented to visitors.

Such cookies are used only with the visitor's prior consent and in compliance with applicable advertising restrictions.

8.3. Visitors may choose which categories of non-essential cookies they consent to. Refusing non-essential cookies does not prevent visitors from using the Website's core functions.

8.4. Consent to non-essential cookies may be changed or withdrawn at any time through the cookie settings available on the Website.

8.5. Cookie retention periods depend on their purpose. Specific cookies used, their providers, purposes and retention periods must be indicated in the Website's cookie settings or in a separate cookie list.

8.6. Visitors may also manage or delete cookies through their internet browser settings. Removing certain strictly necessary cookies may affect the proper functioning of some Website features.

9. Personal Data Security

9.1. We implement appropriate organisational and technical security measures to protect personal data against unauthorised use, loss, alteration, disclosure or destruction.

9.2. Access to personal data is granted only to the extent necessary and only to employees and service providers who require such access to perform their duties.

9.3. Personal data processors are required to comply with confidentiality obligations and applicable data protection requirements.

9.4. Although we implement appropriate security measures, no system for transmitting data over the internet or storing data electronically can guarantee absolute security.

10. Rights of Data Subjects

10.1. Under the GDPR, you have the right to:

• Receive information about the processing of your personal data;

• Access the personal data we process about you;

• Request the correction of inaccurate data or completion of incomplete data;

• Request the erasure of personal data where there is a legal basis for doing so;

• Request the restriction of personal data processing in cases provided for by law;

• Object to processing based on legitimate interests, including the absolute right to object to the processing of personal data for direct marketing purposes;

• Receive personal data you have provided in a structured, commonly used and machine-readable format and, where applicable, transfer such data to another data controller;

• Withdraw your consent at any time;

• Lodge a complaint with a supervisory authority.

10.2. To exercise your rights, please contact us by email at gerimetai@gerimetai.lt.

10.3. Upon receiving a request, we may ask for additional information if necessary to verify the identity of the person submitting the request.

10.4. We respond to requests without undue delay and no later than one month after receiving them. In complex cases, this period may be extended by a further two months, in which case the person submitting the request will be informed accordingly.

10.5. Where we are legally required to retain personal data, the right to erasure may be restricted. In such cases, we will explain the reasons for refusing the request.

11. Complaints Regarding Personal Data Processing

11.1. If you believe that your personal data is being processed improperly or that your rights have been violated, we encourage you to contact us first by email at gerimetai@gerimetai.lt.

11.2. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania:

State Data Protection Inspectorate

Website: https://vdai.lrv.lt

Email: ada@ada.lt

11.3. Contacting us is not a prerequisite for lodging a complaint with the supervisory authority or exercising any other legal remedies available under applicable legislation.

12. Links to Third-Party Websites

12.1. The Website may contain links to other websites, social media accounts or third-party services.

12.2. Such websites may have their own privacy policies and personal data processing rules. We recommend reviewing the relevant service providers' privacy policies before providing them with your personal data.

13. Automated Decision-Making

13.1. GERI METAI does not make decisions based solely on automated processing of personal data that produce legal effects concerning individuals or similarly significantly affect them, within the meaning of Article 22 of the GDPR.

13.2. Routine technical functions of the online store, such as calculating order totals or managing the shopping cart, do not in themselves constitute such decisions.

14. Amendments to the Privacy Policy

14.1. GERI METAI may periodically update this Privacy Policy in response to changes in legislation, technologies used or operational requirements.

14.2. The latest version of this Privacy Policy is published on the Website at https://gerimetai.lt.

14.3. In the event of significant changes to personal data processing, we will provide appropriate notice and, where necessary, obtain new consent from individuals.

14.4. Amendments to this Privacy Policy do not affect individuals' rights established under applicable legislation.

Vevaldis, UAB

Kun. Antonijaus Dzekano g. 1A, Ponasų k., Vilniaus r., Lithuania

Email: gerimetai@gerimetai.lt

Tel.: +370 698 27592

https://gerimetai.lt

Write your text here...