Privacy policy

Last updated: 13 October 2026

This policy explains what personal information Kalvė collects when you visit kalvejewellery.com, place an order, create an account, subscribe to our messages or contact us, why we use it, who receives it, how long we keep it and what you can do about it. We have tried to keep it plain. If anything is unclear, write to hello@kalvejewellery.com.

1. Who we are

The controller of your personal information, meaning the company that decides how and why it is used, is:

  • MB Kalvė, company code 307413990
  • Adomo Mickevičiaus gatvė 38, Vilnius, 06292, Lithuania
  • E-mail: hello@kalvejewellery.com

Every privacy request, question or complaint can be sent to that e-mail address. We run our online store on Shopify.

2. Information we collect

We collect information in three ways: from you directly, automatically from your device, and from the service providers that help us run the store.

Information you give us

  • Order and delivery details: your name, billing and delivery address, e-mail address, phone number (if you provide one), the items you order and any gift message.
  • Payment details: card and wallet payments are handled by Shopify and the payment providers shown at checkout, for example Shopify Payments, Shop Pay, PayPal or your card network. We do not see or store your full card number. We receive confirmation that a payment was made, the payment method used and, where relevant, the last four digits of a card.
  • Account details: if you create a customer account, your name, e-mail address and order history.
  • Messages to us: what you write when you e-mail us, together with any photographs or order numbers you send.
  • Newsletter sign-up: your e-mail address and, if you choose to give it, your phone number, together with a record of when and how you agreed.

Information collected automatically

  • Device and visit information: IP address, browser and device type, approximate location derived from the IP address, language and currency, the pages and products you view, search terms, the page that referred you and how you move through the site.
  • Cookie and similar identifiers: see the Cookies section. Where the law requires your consent, non-essential cookies are only set after you accept them.

Information from others

  • Delivery partners tell us when a parcel has been delivered or returned.
  • Payment providers and Shopify’s fraud tools tell us whether a payment succeeded and whether an order looks risky.
  • Advertising and analytics providers return aggregated reports about how visitors use the site and how our advertising performs.

You do not have to give us your personal information, but we cannot process an order or reply to a message without the details needed for it.

3. Why we use it

The table sets out each purpose, the legal basis under Article 6 of the General Data Protection Regulation (GDPR) and what the basis means in practice.

Purpose Legal basis
Taking and delivering your order, taking payment, sending order confirmations and delivery updates, handling returns, exchanges and warranty requests Performing our contract with you (Article 6(1)(b))
Running your customer account, if you have one Performing our contract with you (Article 6(1)(b))
Issuing invoices, keeping accounting and tax records, meeting consumer-law duties Legal obligation (Article 6(1)(c))
Answering your questions and resolving complaints Performing our contract, or our legitimate interest in helping customers (Article 6(1)(b) and (f))
Detecting fraud, keeping the store secure, establishing or defending legal claims Our legitimate interests (Article 6(1)(f)). We weigh these against your rights and you may object.
Sending marketing e-mails or text messages Your consent (Article 6(1)(a)). You can withdraw it at any time.
Analytics, advertising and measuring our campaigns through cookies and similar technologies that are not strictly necessary Your consent (Article 6(1)(a)), given through our cookie banner where the law requires it
Strictly necessary cookies that keep the cart, checkout and sign-in working and remember your consent choice Not subject to consent under the ePrivacy rules; our legitimate interest in running the store (Article 6(1)(f))

We do not sell your personal information, and we do not use it for any purpose that is incompatible with those above.

4. Marketing messages

We send marketing e-mails, and text messages if and when we offer them, only if you have agreed. We use Omnisend to send them. For that purpose Omnisend receives your contact details, your subscription status and information about your activity with our messages and store, such as whether you opened a message, which products you viewed and what is in your cart.

We may group customers by what they have bought or looked at so that messages are relevant to them. This is profiling for marketing only. It has no legal effect on you and you can object to it at any time.

Every message contains an unsubscribe link. You can also write to hello@kalvejewellery.com and we will remove you. Withdrawing consent does not affect messages already sent. We will still send you service messages about an order you have placed, such as a confirmation or a delivery notice. These are not marketing.

5. Analytics and advertising

We use tools that measure how visitors use the site and how our advertising performs. They are set up through Shopify’s Customer Events and are controlled by the cookie banner. Where the law requires consent, they only run after you accept. If you decline, they do not run.

  • Store analytics (Shopify): counts visits, sessions and orders so that we can see how the store performs.
  • Google Analytics 4 and Google Ads: measure traffic and the pages visitors use, and measure the results of Google advertising. See Google’s privacy policy.
  • Meta pixel and Conversions API: measure results of advertising on Facebook and Instagram and help show our advertising to people likely to be interested. The Conversions API sends some of this information from our systems, which can include hashed contact details, to Meta. See Meta’s privacy policy.
  • TikTok pixel: we plan to add this to measure and improve advertising on TikTok. We will not switch it on until this policy and the cookie banner describe it. See TikTok’s privacy policy.

You can change your choice at any time with the cookie preferences link in the footer of every page. You can also manage advertising settings directly with each platform. Blocking cookies in your browser reduces tracking by cookies but may not stop every kind of signal shared with advertising partners, so please use the cookie preferences link as well.

6. Who receives your information

We share personal information only with those who need it for the purposes above. They are processors acting on our instructions, or independent controllers with their own legal duties.

  • Shopify, which provides our store, checkout, customer accounts and payment tools, and hosts our data. Some Shopify features, such as Shop Pay, are governed by Shopify’s own privacy terms. See Shopify’s privacy policy.
  • Payment providers shown at checkout, which process your payment and carry out their own fraud and compliance checks.
  • Carriers and couriers, which receive your name, delivery address, phone number and e-mail address to deliver your parcel.
  • Omnisend, for marketing messages, as described above.
  • Google, Meta and, once added, TikTok, for analytics and advertising measurement, as described above and only in line with your cookie choice.
  • IT, hosting, e-mail and accounting service providers who support our business and are bound by confidentiality and data protection terms.
  • Professional advisers, courts, authorities and law enforcement, where the law requires it or where we need to establish, exercise or defend legal claims.
  • A buyer or successor, if our business is ever sold or reorganised. They would have to respect this policy.

Transfers outside the European Economic Area

Some of these providers process information outside the European Economic Area, including in the United States and Canada. Where that happens we rely on a lawful transfer mechanism under Chapter V of the GDPR. In practice this means the provider is covered by an adequacy decision, for example the EU–US Data Privacy Framework for certified US companies, or we and the provider have entered into the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for information about the safeguards that apply by writing to hello@kalvejewellery.com.

7. How long we keep it

  • Orders, invoices and accounting records: 10 years from the end of the financial year in which they were made, because accounting and tax law requires us to keep them.
  • Customer account: until you ask us to close it. Order records linked to it are kept for the period above.
  • Marketing subscriptions: until you unsubscribe or withdraw consent. After that we keep a minimal record, such as your e-mail address on a suppression list, so that we do not message you again.
  • Support e-mails and enquiries: 3 years from the last message in the conversation, unless a longer period is needed for a warranty or legal matter.
  • Analytics and advertising data: for the period set in each provider’s tool, which we keep as short as is practical. Cookie lifetimes are listed in the Cookies section.

When a period ends we delete or anonymise the information. If we need it for a legal claim that has been raised, we keep it until that matter is closed.

8. Your rights and complaints

Under the GDPR you have the right to:

  • Access the personal information we hold about you and receive a copy of it (Article 15).
  • Correct information that is inaccurate or incomplete (Article 16).
  • Erase your information in the cases the law provides for (Article 17).
  • Restrict how we use it in certain cases (Article 18).
  • Receive your information in a portable format, or have it sent to another provider, where we process it by automated means on the basis of consent or contract (Article 20).
  • Object to processing based on our legitimate interests, and object at any time to direct marketing, including profiling linked to it (Article 21).
  • Withdraw your consent at any time, where we rely on it (Article 7(3)). This does not affect what we did before you withdrew.

To use any of these rights, write to hello@kalvejewellery.com. We may need to confirm your identity first. We aim to answer within one month, and we do not charge a fee unless a request is clearly unfounded or excessive. Some rights are limited where we must keep information to meet a legal duty, for example accounting records.

Complaints

We would like the chance to put things right, so please write to us first. You also have the right to complain to a data protection authority at any time. Our lead supervisory authority is the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, 10312 Vilnius, Lithuania, vdai.lrv.lt. If you live in another country of the European Economic Area, you may instead complain to the authority in your own country.

9. Cookies

A cookie is a small file that a website stores on your device. We also use similar technologies, such as pixels and local storage, which this section treats in the same way. Some are essential for the store to work. Others, for analytics and advertising, are only used if you agree.

Your choices

When you first visit, a banner asks for your choice. You can change or withdraw it at any time with the cookie preferences link in the footer of every page. You can also delete cookies or block them in your browser settings. If you block essential cookies, parts of the store, such as the cart and checkout, will not work.

Strictly necessary cookies

These make the store work and cannot be switched off. They keep your cart, support checkout and sign-in, protect against fraud and abuse, and remember your cookie choice.

Cookie Set by Purpose Typical lifetime
cart Shopify Keeps the contents of your cart Up to 14 days
cart_sig Shopify Verifies the cart has not been altered Up to 14 days
secure_customer_sig Shopify Keeps you signed in to your customer account Up to 1 year
_tracking_consent Shopify Stores your cookie preferences Up to 1 year
Other session and security cookies Shopify Checkout, fraud prevention and load balancing Session or short

Preference cookies

These remember choices you make so that you do not have to repeat them. They are used only if you agree, unless the law treats them as strictly necessary.

Cookie Set by Purpose Typical lifetime
localization Shopify Remembers your country or region and currency Up to 1 year
cart_currency Shopify Remembers the currency used in your cart About 2 weeks

Analytics cookies

These show us how visitors use the store, so that we can improve it. They run only after you accept.

Cookie Set by Purpose Typical lifetime
_shopify_y, _shopify_s Shopify Store analytics: identify a browser and a visit session Up to 1 year / 30 minutes
_ga, _ga_<container ID> Google Analytics 4 Distinguish visitors and sessions to measure site usage Up to 2 years

Marketing cookies

These measure advertising and help show our advertising to people who may be interested. They run only after you accept.

Cookie Set by Purpose Typical lifetime
_gcl_au Google Ads Links ad clicks to later purchases About 3 months
_fbp, _fbc Meta pixel Identify a browser and an ad click for ad measurement About 3 months
_ttp, ttclid and related TikTok pixel (planned) Measure TikTok advertising once the pixel is in use Up to about 13 months
Identifiers beginning with omnisend Omnisend Link site activity to a subscriber for relevant messages, after consent Varies

The names and lifetimes above are typical values published by each provider. They can change when a provider updates its service, so the banner and the cookie preferences panel are the definitive list at any time.

10. Children, security and automated decisions

Children

The store is intended for adults. We do not knowingly collect personal information from children. Where consent is needed to offer an online service directly to a child, the age at which a child may give it themselves is 14 in Lithuania, and below that age a parent or guardian must give it. If you believe a child has given us personal information, write to hello@kalvejewellery.com and we will delete it.

Security

We use reasonable technical and organisational measures to protect your information, and we choose providers with established security practices. Payment details are handled by Shopify and the payment providers, not stored by us. No online service can be guaranteed to be completely secure, and you should keep your sign-in details private.

Automated decisions

We do not make decisions that have a legal or similarly significant effect on you solely by automated means. Shopify’s fraud tools may flag an order as risky, for example after repeated failed payments, and a flagged order is checked by a person before we decide what to do with it.

11. Changes to this policy

We may update this policy when our practices, tools or the law change. The date at the top shows when it was last revised. If a change is significant, we will tell you in a clear way, for example by a notice on the site or by e-mail. You can always find the current version on this page. Our terms of service explain the rules for using the store.