Privacy Policy

Updated: 12 October 2026

1. Data controller

RJ Gallery – Remigijus Januškevičius, individual activity certificate No. 783711, Gedimino g. 18, 44319 Kaunas, Lithuania. Email: [email protected]; telephone: +370 610 67747. This policy explains how visitors’ and customers’ personal data on www.rjgallery.com are processed under Regulation (EU) 2016/679 (GDPR).

2. Data, sources and legal bases

You provide data when placing orders, submitting enquiries or contacting us. Payment providers supply payment status and carriers supply delivery information.

• Orders and delivery: name, email, telephone, delivery address, ordered items, order amount and payment status; customer or business details where required for invoicing. Legal basis: entering into and performing a contract, GDPR Article 6(1)(b).
• Accounting: invoices and payment records. Basis: legal obligations, Article 6(1)(c).
• Enquiries, complaints and disputes: contact details, correspondence, documents and photographs you provide. Basis: pre-contractual steps and contract performance (b), or our legitimate interest in answering enquiries and defending legal claims (f).
• Website operation and security: IP address, browser, device and technical event information. Basis: our legitimate interest in operating the website and preventing abuse (f).
• Analytics and marketing: visits, page views and website actions collected through the relevant cookies you choose. Basis: consent (a). Buying or accepting purchase terms does not constitute consent to advertising.

3. Recipients

Data necessary for orders are shared with Mozello, the selected payment provider (Paysera, PayPal or bank), the delivery carrier (such as Venipak, DPD, DHL or FedEx), accounting providers where engaged, and authorities legally entitled to receive them. Google Analytics is used according to your cookie choices. Only data needed for the particular service are shared.

Card details are entered in the payment provider’s secure environment; we do not request them by email. Payment providers also process data under their own privacy policies.

4. Transfers outside the EEA

International analytics, payment and delivery providers can process data outside the European Economic Area. Depending on the recipient and destination, transfers rely on a European Commission adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or standard contractual clauses and necessary supplementary safeguards. Delivery to a destination you choose outside the EEA can also require a transfer necessary to perform the contract under GDPR Article 49(1)(b). Contact us for information about specific recipients and safeguards.

5. Retention and security

Order records are retained for contract performance and the applicable warranty, complaint and limitation periods. Accounting documents are retained for the statutory period. Enquiries are retained until the issue and subsequent correspondence are concluded; if a dispute arises, until its conclusion and the applicable limitation period. Data are deleted or anonymised once their purpose and mandatory retention periods expire. You can ask us for the retention period applicable to your records.

Consent-based processing ends when consent is withdrawn or its purpose ends; evidence of consent is retained for the applicable legal claims period. Cookie lifetimes are shown in cookie settings. We use restricted access and secure connections to protect data from unauthorised access.

6. Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. Requests are normally handled free of charge within one month; if a lawful extension is necessary, we explain the reason and deadline. We request only information needed to verify your identity.

Contact [email protected]. You may complain to the Lithuanian State Data Protection Inspectorate or the supervisory authority in your country of residence. Accounting records subject to mandatory retention cannot be erased early.

7. Required data and automated decisions

Required order information is marked in the checkout form. Without it, we cannot fulfil or deliver your order. Optional data and marketing consent are not conditions of purchase. RJ Gallery does not make decisions based solely on automated processing that have legal or similarly significant effects on you.

8. Cookies and choices

Essential cookies support website operation, language preferences and the shopping cart. Manage or withdraw your analytics and marketing cookie choices in the cookie banner’s customisation settings or the footer’s cookie menu. Browser settings also let you delete or block cookies, which can affect cart functionality.

9. Updates and contact

The current policy and update date are published here. Contact Remigijus Januškevičius using the details above with privacy questions. Other linked websites explain their data processing in their own privacy policies.