Privacy policy
1. Who processes your data
The data controller is MB „Monic“ (company code 308127586, registered office T. Kosciuškos g. 17, LT-01100 Vilnius), which operates under the Tapio brand. Data about the company is kept in the Register of Legal Entities of Lithuania.
For any data question, write to info@tapio.lt or call +370 650 75536.
2. What data we process and why
Enquiries
Data: name, business name, phone number or email address, the content of your message.
Purpose: to reply to your enquiry and arrange your order.
Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR).
Retention: 12 months from our last contact if no contract is concluded.
Orders and accounting
Data: name of the buyer or their representative, business name and details, contact details, order and payment information.
Purpose: to sell and install the cards and to issue accounting documents.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and our legal obligation to keep accounts (Article 6(1)(c) GDPR).
Retention: accounting documents are kept for the period set by law (usually 10 years); other data for 3 years after the last order.
Offers to businesses
Data: business name, address, publicly listed business email address and phone number, and the name of a contact person if it is published.
Source: public sources – Google Maps and business websites we find through Google Search.
Purpose: to offer our services to local businesses.
Legal basis: our legitimate interest in presenting our services (Article 6(1)(f) GDPR).
Retention: no longer than 2 years from the last contact. If you ask us not to write to you again, we keep only minimal data (your email address) so that your request is respected in the future.
You can opt out of further offers in any of our emails – just reply to the email or write to info@tapio.lt.
Visiting the website
Data: technical data recorded automatically by the hosting service (IP address, browser type, time of visit).
Purpose: to keep the website running and secure.
Legal basis: our legitimate interest in keeping the website secure (Article 6(1)(f) GDPR).
Retention: for a short period set by the hosting provider (Cloudflare), for security and operation only.
4. Who we share data with
We do not sell your data. It may be accessed only by those who help us provide our services, and only as far as necessary:
- our email and document service provider (Google Ireland Limited, Google Workspace);
- our website hosting and security provider (Cloudflare, Inc.);
- our contact form provider (Web3Forms);
- other IT service providers whose tools we use to draft emails and handle enquiries;
- public authorities, where required by law.
Some service providers may process data outside the European Economic Area. In such cases, safeguards provided for in the GDPR apply, such as standard contractual clauses approved by the European Commission or an adequacy decision.
5. Your rights
You have the right to:
- access your data and receive a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict the processing of your data;
- receive your data in a common format and transfer it to another controller;
- object at any time to the processing of your data for direct marketing – we will then stop using it for that purpose;
- object to processing based on legitimate interest.
To exercise your rights, write to info@tapio.lt. We will reply within one month at the latest.
6. Where to complain
If you think your data is being processed improperly, please contact us first – we will do our best to resolve it. You also have the right to lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt).
7. Other important information
You are not required to provide your data, but without contact details we cannot reply to your enquiry or fulfil an order.
We do not make automated decisions that have legal effects on you, and we do not use profiling.
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure.
We may update this policy. The latest version is always published on this page.