GDPR & CCPA

1. Who is controller and who is processor

For the personal data inside a merchant's store, the merchant is the controller and MB „Liūto media“ is the processor. We act only on the merchant's instructions, given by installing the app and configuring it.

For our own business contacts — people who email us, and merchant account details — we are the controller.

2. What each app processes

3. Legal bases (GDPR)

• Processing on behalf of the merchant — Article 28. The merchant determines the purpose; we process under our data processing agreement.
• Marketing messages to shoppers — the merchant's legal basis, normally consent collected at checkout. Repeatly reads that consent from Shopify and skips customers who did not give it.
• Our own operations — legitimate interest for security logs and abuse prevention; contract performance for billing and support.

4. Data subject rights (EU/UK)

Individuals whose data we process on a merchant's behalf have the right to:

• Access the personal data held about them
• Rectify inaccurate data
• Erasure (“right to be forgotten”)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

Requests normally go to the merchant, who is the controller. Shopify forwards them to us automatically through its mandatory data webhooks, and we act within the required timeframe: a redaction request deletes that person's records from our systems, and a data request returns everything we hold so the merchant can pass it on.

Shoppers can also stop Repeatly messages themselves at any time: a one-click unsubscribe link in every email, an unsubscribe button in every push notification, and a self-service page linked from the store footer.

5. California residents (CCPA/CPRA)

Under the California Consumer Privacy Act as amended by the CPRA, we act as a service provider to the merchant. This means:

• We do not sell or share personal information as those terms are defined by the CCPA — not for money, not for cross-context behavioural advertising.
• We use personal information only to perform the service, and never for our own commercial purposes, profiling, or building audiences.
• We do not combine personal information received from one merchant with data from any other source.
• California residents may request to know, delete, or correct their information, and may not be discriminated against for exercising those rights. Requests reach us through the merchant or Shopify's data request webhooks.

Because we do not sell or share personal information, there is no “Do Not Sell or Share My Personal Information” action to take with us — but any such request received will be honoured and passed through.

6. International transfers

All processing and storage happens on our servers in the European Union. Data is not transferred outside the EU/EEA by us.

Where a merchant or their customers are outside the EU — for example in the United States — the data still lands in the EU, which provides an equivalent or higher standard of protection. Where any transfer out of the EEA were ever required, it would be covered by the European Commission's Standard Contractual Clauses.

7. Sub-processors

We will announce any new sub-processor on this page before it starts processing data.

8. Retention and deletion

• Data is retained only while the app is installed.
• Uninstalling an app deletes all of that store's data automatically.
• Encrypted backups are kept for 7 days and then destroyed.
• Server logs used for security are kept for a limited period and contain no shopper personal data beyond what is necessary to trace a request.

9. How to make a request

Merchants and individuals can write to app@liutomedia.lt. Include enough detail for us to identify the store and, where relevant, the person concerned. We confirm receipt quickly and respond within the statutory deadline — one month under GDPR, 45 days under CCPA.

EU residents also have the right to lodge a complaint with a supervisory authority. In Lithuania this is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija).

See also our privacy policy, terms and DPA and security policy.