Rimta Tema

Privacy Policy

Last updated: 13 April 2026

We understand the importance of protection of your personal data, therefore we process your personal data lawfully, transparently, and fairly, for pre-determined purposes and only to the extent necessary to achieve those purposes. When we process your personal data, we make every effort to ensure that they are accurate, secure, confidential, properly stored and protected.

When processing your personal data, we comply with legal requirements, including the requirements of the Regulation (EU) 2016/679 (General Data Protection Regulation) ("GDPR") and Amazon's Data Protection Policy ("DPP").

1. What Is This Document?

1.1. This Privacy Policy (the "Privacy Policy") informs you of our policies regarding the collection, use and disclosure of data when you purchase our products through the Amazon marketplace, contact us for customer support, or otherwise provide your personal data.

1.2. Please read this Privacy Policy carefully to find out how we process your personal data, where we get them from and what your rights as a data subject are.

1.3. The term "personal data" as used in this Privacy Policy means any information which could be used to identify you directly or indirectly.

2. Who Is the Data Controller?

2.1. In accordance with the relevant legal provisions, we are a controller of your personal data, i.e. the legal person responsible for the collection, processing and/or use of personal information.

2.2. If you have any questions about our Privacy Policy and practice, or the processing of your personal data, please contact us at rimtatema@burga.eu.

3. How Do We Collect Your Personal Data?

3.1. We process your personal data obtained in the following ways:

3.1.1. Through Amazon Seller Platform. When you place an order for our products on Amazon, we receive your order-related personal data through the Amazon Selling Partner API (SP-API). This data is provided to us by Amazon for the purposes of order fulfillment, shipment and delivery of your products, and providing shipment tracking information.

3.1.2. Directly from you. When you contact us via email, Amazon messaging, or social media for customer support, warranty claims, product inquiries, or to provide a product review.

3.1.3. Indirectly. We may collect personal data from publicly available sources or from third parties who have your consent to pass your details to us.

4. What Personal Data We Process and for What Purposes?

4.1. We process your personal data for the following purposes:

4.1.1. To fulfill and ship your orders.

We receive order data through the Amazon SP-API to process, pack, ship and deliver your orders. This includes automated retrieval of new orders and submission of shipment tracking information back to Amazon.

Personal data categories	First name, last name, delivery address, telephone number, email address, order details (items purchased, order number, order date, order value).
Legal basis	Processing is necessary for the performance of a contract (Article 6(1)(b) of GDPR).
Time limit for processing	Personal data obtained via Amazon SP-API is retained for no longer than 30 days after shipment, unless a longer retention period is required by applicable tax or regulatory law. Where legally required, data is stored in encrypted offline/cold backup only.
Data source	Amazon (via SP-API); you.
Data recipients	Courier, delivery, and postal service providers; Amazon (shipment tracking data).

4.1.2. To process returns and refunds.

If you return a product, we process your data to manage the return and issue a refund.

Personal data categories	First name, last name, delivery address, order details.
Legal basis	Processing is necessary for the performance of a contract (Article 6(1)(b) of GDPR) and for the performance of a legal obligation (Article 6(1)(c) of GDPR).
Time limit for processing	In accordance with applicable tax and accounting laws (up to 10 years where required by law).
Data source	Amazon (via SP-API); you.
Data recipients	Payment service providers; Amazon.

4.1.3. To comply with tax and legal obligations.

We are legally required to retain certain transaction data for accounting, tax reporting and regulatory compliance purposes.

Personal data categories	Name, address, order details, transaction amounts, invoice data.
Legal basis	Processing is necessary for compliance with a legal obligation (Article 6(1)(c) of GDPR).
Time limit for processing	As required by applicable tax and commercial laws (typically up to 10 years). Data is stored in encrypted form.
Data source	Amazon (via SP-API); you.
Data recipients	Tax authorities and auditors where required by law.

4.1.4. To provide customer support and improve product quality.

When you contact us with questions, complaints or feedback about our products and services, we process your personal data to respond to you and improve our offerings.

Personal data categories	Name, email address, telephone number, date and content of the inquiry or complaint.
Legal basis	Your consent (Article 6(1)(a) of GDPR); our legitimate interest in evaluating customer feedback and improving the quality of our products and services (Article 6(1)(f) of GDPR).
Time limit for processing	1 year from the day you submit your inquiry to us.
Data source	You.
Data recipients	Third party service providers whose services we use for data storage and technical services.

4.1.5. To send direct marketing messages (if applicable).

If you have opted in to receive marketing communications, we may send you updates about our products and offers.

Personal data categories	Name, email address.
Legal basis	Your consent (Article 6(1)(a) of GDPR).
Time limit for processing	Until you withdraw your consent or unsubscribe.
Data source	You.
Data recipients	Email marketing service providers.
How to opt out	You can opt out at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at rimtatema@burga.eu.

4.2. We may also use the information we collect in aggregate or otherwise anonymized form, i.e. information that does not identify you or any specific person. We may use this general data for research, development, and analytics.

4.3. We do not collect or process special categories of personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, or data about your sexual life and sexual orientation. Please do not provide this personal data to us.

5. Amazon Selling Partner API (SP-API) Data Usage

5.1. We access customer order data through the Amazon Selling Partner API (SP-API) strictly for the following purposes:

• Retrieving and processing new orders;
• Managing order fulfillment and shipment;
• Submitting shipment tracking information to Amazon;
• Processing returns and refunds;
• Generating invoices and complying with tax obligations.

5.2. We comply with Amazon's Data Protection Policy (DPP) and Acceptable Use Policy (AUP) at all times. Specifically:

• We only access and use customer personally identifiable information (PII) that is necessary for the purposes described above.
• Customer PII obtained via the SP-API is retained for no longer than 30 days after shipment, except where a longer retention period is required by applicable tax or regulatory law.
• Where legally required to archive PII beyond 30 days (e.g., for tax or regulatory purposes), such data is stored in encrypted cold/offline backup only.
• We do not sell, rent, share or otherwise disclose customer PII obtained through Amazon to any third party for marketing, advertising, or any purpose unrelated to order fulfillment.
• We implement appropriate technical and organizational security measures to protect data accessed through the SP-API, including encryption, access controls, and regular security assessments.

6. To Whom Do We Provide Your Personal Data?

6.1. We guarantee that your personal data will not be sold, provided or otherwise transferred to third parties without a legitimate basis, as well as used for purposes other than those for which they were collected. We will not transfer your personal data in any way other than in accordance with this Privacy Policy or applicable law.

6.2. We may transfer your personal data to companies that help us operate (data processors). We require that these data processors handle your data only in accordance with our instructions and applicable data protection legislation. We enter into data processing agreements with such parties.

6.3. We may disclose the personal data we collect about you to the following third parties:

• Amazon, as the marketplace platform, for order fulfillment and customer service purposes;
• Courier, delivery and postal service providers for shipment of orders;
• Payment service providers for processing refunds;
• Our legal and professional advisers, including auditors;
• Governmental bodies, regulators, law enforcement agencies, courts/tribunals where we are required to do so by law or to exercise our legal rights;
• To purchasers and advisers if we sell our business or assets or restructure by merger, reorganization or otherwise.

7. International Transfers of Your Data

7.1. To deliver products and services to you, it is sometimes necessary to share your personal information outside of the European Economic Area (EEA). This will typically occur when service providers (including Amazon) are located outside the EEA or if you are based outside the EEA.

7.2. If we transfer your personal information outside the EEA, we will ensure that the transfer is compliant with data protection law and all personal data will be secure. Our standard practice is to use Standard Contractual Clauses approved by the European Commission or other legally recognized transfer mechanisms.

8. How We Protect Your Data

8.1. The security of your information is important to us. We have put in place physical, electronic, and procedural safeguards. These measures include limiting access, using encryption, testing for vulnerabilities, employing pseudonymization and anonymization techniques, and implementing secure credential management practices in line with Amazon's SP-API security requirements.

8.2. Although we make every effort to protect your personal data, the transmission of information over the internet is not completely secure and we cannot guarantee absolute security. You provide information at your own risk.

8.3. Should we become aware of a personal data breach that could seriously jeopardize your rights or freedoms, we will notify you as soon as we become aware of it and determine what information has been accessed.

9. How Long Do We Store Your Personal Data?

9.1. We store your personal data for no longer than required for the purposes of the processing or as required by law if it provides a longer storage period. Section 4 and Section 5 of this Privacy Policy specify the terms of storage of your personal data separately for each purpose.

9.2. For customer PII obtained through the Amazon SP-API, we adhere to the 30-day post-shipment retention limit unless a legal obligation requires longer retention in encrypted form.

10. What Rights Do You Have?

10.1. When processing personal data, we ensure your rights in accordance with the GDPR. As a data subject, you have the following rights:

• Right to access — to know about and access the personal data we process about you;
• Right to rectification — to request correction of inaccurate or incomplete personal data;
• Right to erasure — to request deletion of your personal data when they are processed unlawfully or are no longer needed for the purposes for which they were collected;
• Right to object — to object to the processing of personal data where the processing is based on legitimate interest;
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal;
• Right to restriction of processing — to request suspension of processing in the event of a dispute or verification of lawfulness, accuracy of data, or where you need the data for legal claims;
• Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format, or to request transfer to another controller where technically feasible;
• Right regarding automated decision-making — where a legal or similarly significant decision has been made about you in a fully automated way, to obtain human intervention, express your point of view and contest the decision.

10.2. To exercise any of these rights, please contact us at rimtatema@burga.eu. We may ask you to verify your identity before processing your request.

10.3. We will respond to your request within 30 calendar days. This period may be extended by two further months where necessary, and we will inform you of any extension within one month of receipt.

10.4. If we refuse to comply with your request, we will clearly state the grounds for such refusal.

11. To Whom Can You Make a Complaint?

11.1. If you wish to make a complaint about our processing of your personal data, please contact us in writing at rimtatema@burga.eu. We will try to resolve any issues promptly.

11.2. If you consider that our processing of your personal data infringes your rights, you have the right to lodge a complaint with the supervisory authority in your region. We seek to resolve all disputes promptly and amicably.

12. Changes to This Privacy Policy

12.1. We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated version with a new "Last updated" date. We encourage you to review this Privacy Policy periodically.

13. Contact Us

13.1. If you have any questions or concerns regarding this Privacy Policy or our data processing practices, please contact us:

UAB „Rimta Tema"
Olimpiečių g. 3-28, LT-09235 Vilnius, Lithuania
Company code: 306740035
Email: rimtatema@burga.eu