PRIVACY POLICY

1.1. This Privacy Policy is a part of Rykas Ltd Personal Data Processing Rules and forms the basis for the Customer's agreement regarding the use of Rykas Ltd websites – the Terms of Purchase. This Privacy Policy applies to online stores (hereinafter referred to as websites) operated by Rykas Ltd. This Privacy Policy describes what data Rykas Ltd collects and for what purposes it uses them when the Customer uses the services provided by the website.

1.2. The purpose of this policy is to regulate the processing of customer‘s personal data by Rykas Ltd, ensuring the compliance and implementation of the Lithuanian Republic Law on Protection of Personal Data (hereinafter referred to as ADTAI) and the General Personal Data Protection Regulation (hereinafter referred to as BDAR) No. 2016/679, other legal acts, other laws and legal acts regulating the protection of personal data.

1.3. Every person using Rykas Ltd websites has to unconditionally adhere to this Privacy Policy, regardless whether they are a registered User or if they are using the Website without having registered (hereinafter referred to as User). Every person who is registering on the Website has to read this Privacy Policy as well as the Terms of Purchase and commit to adhere to them. If any provision of this policy violates laws or other legal acts or because of some reason becomes partially or totally invalid, it does not invalidate the rest of the Privacy Policy Provis

1.4. The User is not obliged to give Rykas Ltd personal information, but after having failed to provide it they may be unable acquire our goods and the overall maximum quality level will not be guaranteed. Without the data necessary for carrying out the order, it is not possible to conclude a contract for the purchase and sale of goods, as Rykas Ltd cannot fulfill such an order.

1.5. Rykas Ltd may use personal data under the conditions specified in this Privacy Policy and in cases where it is necessary to enforce or defend legal requirements, whether under a judicial, administrative or other, extrajudicial procedure. The personal data may also be processed by Rykas Ltd in cases where it is necessary for the fulfillment of a binding legal obligation or to protect the vital interests of the User or another natural person. For this reason, personal data is processed on the basis of a legitimate interest in order to protect and secure the rights of their own, the User and other persons.

1.6. If you have any questions about our personal privacy protection provisions, please contact us at the email address found at the "Contact Us" and/or "About Us" section of this site.

2.1. Personal data processing - means any action performed with the Personal Data: collection, recording, accumulating, storing, classifying, grouping, merging, modifying (adding or correcting), providing, publishing, using, logical and/or arithmetic operations, searching, dissemination , destruction or other action or set of actions. Only Personnel and Managers who are familiar with Rykas Ltd Personal Data Processing Rules and have signed a pledge and/or agreement/contract to comply with the rules for the processing of personal data are entitled to use and manage personal data.

2.2. Data processed by Rykas Ltd. Personal data - refers to any information relating to a natural person - a Data Subject whose identity is known or can be directly or indirectly identified using information relating to a person (hereinafter referred to as data):

• IP of the device from which connection is being established, information about the browser used by the client, the browsing content and universal addresses (URL), which are being connected to, the date and time of connections, name, surname, address, email, phone number, payment information, information about bought goods, price, the history of purchases and actions, the history of communication with Rykas Ltd, information received when connecting to Google and Facebook.

• If logged in using mobile devices, the following log files are also recorded as part of using the site: the model of the mobile device and manufacturer, and the operating system used by the mobile device (iOS, Android).

• if the goods are shipped/received/withdrawn by third parties, basic information of the persons receiving the goods is collected and processed. The User may specify the third party who will withdraw/receive the purchased goods, if such person has provided their consent. By presenting us the information of the third parties receiving/withdrawing the goods the User confirms that they have the consent of such persons for providing, using and processing their personal data,

2.3. Without explicit permission from the User, we do not use the personal data specified in this Privacy Policy, in particular the IP address, unless such use is necessary for our services and (or) for security reasons, in particular for the purpose of cyber-attacks, such as data collection or service blocking prevention and prevention of non-authorized programs.

2.4. The purposes and ways of data collection, usage and processing. The collected personal data has to be accurate, appropriate and only of such scope that is necessary for them to be collected and further processed. Rykas Ltd processes data automatically, that means they fully or partially process data by using automatic tools.

Ways of collecting personal data: Rykas Ltd

receive personal data directly from the User (for example name, surname, address and others), part of the data (for example IP, browsing URL addresses and similar) is collected while the User uses communication and other technical measures (computer, mobile phone and other devices) while performing actions in Rykas Ltd Website (for example purchases, paying, communication history and similar).

Purposes of processing personal data:-

client identification;

• sending information necessary for providing services;

• online sales;

• direct marketing;

• settlement of disputes, enforcement and defense of terms and rights;

• analysis of site usage and evaluation for the purposes of continual improvement of products and services;

• Website safety, protected data and cybernetic attack and prevention of other threats to the Website‘s integrity;

• other legitimate and other purposes, defined before data collection.

2.5. Rykas Ltd can hire external service providers for specific services. These service providers undertake data processing procedures on behalf of Rykas Ltd and according to the instructions of Rykas Ltd. Rykas Ltd treats third parties who handle personal data carefully and in accordance with applicable data protection laws. These procedures include:-provision

of technical infrastructure on Websites and local servers;

• provision of delivery services;

• usage analysis;

• customer service and query processing;

• payment processing and secure billing

• Site maintenance and security.

2.6. Duration of personal data storage. Personal data is processed for no longer than is necessary and kept for as long as necessary for the fulfillment of the contract for the purchase and sale of goods. Personal data processed with the consent of the User is processed and stored until the date of cancellation of the User's consent or two years after the last time of using the Companies services. In all cases, personal data is stored no shorter than we are required by legal acts regulating our activities. When Personal Data is no longer needed for the purpose of their processing, they are destroyed, except those that, in the cases specified by law, must be transferred to state archives.

3.1. At any time the User has the right to:

• be informed about data, which we are processing and request a copy of this data (the right to be informed), with all data, which the User actively provides in the Rykas Ltd site, additionally the data can be found on their account;

• ask us to correct incorrect data and fill in missing data (right to correction), all Data, which has been actively provided to us in the site can be also at any time changed in the account (except sent and received messages);

• require that the Data is deleted (right to deletion);

• require to limit the processing of the Data if it meets the criteria defined by law (right to limit processing);

• if criteria defined by law are met, the right to receive submitted Data in a readable and structured form, which could be given to another data processor or when it is technically possible, to allow that they would be given by Rykas Ltd (right to data portability);

• be under the influence of not fully automated Processing based decision making, unless the conditions applicable for such decision making, defined by law are met

• as well as in exceptional circumstances have the right to refuse statutory data processing. When data is processed for the processed for the purposes of direct marketing, to refuse such processing (right to refuse).

• as well as the right to at any time cancel any agreement which they made while registering or while using Rykas Ltd services. Such cancellation will not affect the legitimacy of data processing performed until cancellation and based on provided consent.

• be able to refuse consent to receive newsletters by changing the Websites client’s account settings, besides in the end of the received newsletter they can press the link “Unsubscribe”.

3.2. Submission of requests for the processing of personal data. Requests can be submitted in the following ways in

the client’s personal account on this Website;

• by sending a request to the email specified in the "Contacts" and/or "About us" part of this Website.

• upon arrival at Rykas Ltd commercial outlets.

3.3. The Company immediately informs the Data Subject, at the latest within 5 (five) business days, if correction or destruction of personal data has been performed or not.

3.4 The company also ensure all other personal data subject rights, guarantees and interests guaranteed by the laws of the Republic of Lithuania and other legal acts. Despite any other remedies, the User also has a right to submit a complaint to supervisory authorities at any time.

4.1. Personal data may be provided only to Data receivers with whom the Company has signed respective agreements on the transfer/provision of Personal data and the Data receiver ensures adequate security of transferred Personal data. Personal data may also be transferred to third parties in other cases and order defined in the laws of the Republic of Lithuania and other legal acts.

4.2. Under certain circumstances, Rykas Ltd external service providers may be granted access to personal data of Users, but only for specified data processing purposes. According to the agreement, such third parties are obliged to ensure that their data protection level is equivalent to that guaranteed by Rykas Ltd and the applicable legal acts.

4.3. Some of these service providers may be located in countries outside the EU / EEA, whose data protection level according to EU / EEA standards may be considered insufficient. Rykas Ltd undertakes to conclude appropriate agreements (or otherwise secure guarantees) with such service providers that guarantee the protection of personal data is in accordance with applicable requirements.

4.4. Rykas Ltd is legally obliged to provide personal data and/or data about the use of the website to public or supervisory authorities to the extent necessary to avoid risk to the public and to prosecute for crimes.

4.5. In all other cases, data is transferred to third parties if the User's consent/authorization has been obtained or the User has provided third parties with access to their own data.

5.1. Access to the User account is protected by a password set by the User. The User does not have the right to disclose his password to third parties and after he has finished using the site, he must log out of the account, especially if he is using a public computer. The User is warned that the transmission of data over the Internet (for example, by e-mail) is not always completely secure and it is not possible to ensure that third parties will not connect to them.

5.2. Rykas Ltd takes all the technical and administrative security measures necessary to protect data from unauthorized loss and access and from unauthorized alteration, disclosure or deletion. Access to consumer data is granted only to those persons who are required for the purposes described in this Data Protection Policy.

6.1. When the User is visiting websites or using them, as well as using Rykas Ltd services or messaging channels, Rykas Ltd or services providers qualified by it can use cookies. Cookies help to serve content more quickly and reliably. They are small text files, which are downloaded into the user’s device, while browsing the site. Usually no information which could identify the User is stored in the cookies, but personal information which is processed by Rykas Ltd could be associated with information received and stored in the cookies.

6.2. Cookie types, usage and management modes.

• functional cookies - they allow you to browse the site and use its features (for example the "add to cart" feature). These are the minimum cookies that are mandatory and cannot be refused. So the Website to be easier to use, cookies are required to activate key features, such as page browsing and access to secure areas of the Website. Without these cookies, the site will not work properly.

• analytical cookies - allow us to evaluate and analyze how customers use the site to improve its performance and shopping experience, these cookies, collect anonymous information and report on the behavior of visitors on the site.

• cookies that remember consumer preferences – while browsing or purchasing these cookies remember choices, and this ensures the smoothest purchasing process, more custom-tailored. The settings cookies remember the information on which depends the behavior and look of the Website, such as the chosen language or region in which the User is located.

• targeting or advertising cookies - used to provide customized promotional offers, as well as restrict advertisements so the User would see them only a certain number of times, and helps to measure the effectiveness of promotional campaigns.

• unclassified cookies are such cookies the classification of which is being performed together with separate cookie providers.6.3. Unless otherwise specified in this data protection policy, the necessary cookies are essential for the functionality and operation of the site. This includes cookies that allow the User to sign up for a secure part of the Website, purchase a product, or use an online payment system. Most cookies from a User's device are deleted after the end of the User's browser session. Rykas Ltd uses the information stored in the required cookies to provide the desired services and features.

6.4. When a User logs in to the site, a cookie message is displayed and the request for permission to store the cookies in the User‘s device is shown. Information from cookies is used to improve site customization and to customize advertising to the User's needs. If the User gives permission to send marketing messages, this information is used to offer personalized marketing information (targeting cookies).

6.5. If the User continues using the website after a cookie message is displayed, it is considered that the User agrees that cookies will be used for the above purposes.

6.6. The user can configure his browser to refuse some or all of the cookies or to have them request permission before accepting them. Many browsers allow you to cancel or remove cookies. These actions vary depending on the particular browser and its corresponding version. By refusing cookies, the functionality of some services may be restricted. If a user connects to a site using multiple devices (such as a smartphone, tablet, computer, etc.), they must ensure that each device's browser is configured for cookie preferences.

Rykas Ltd is constantly developing services, so they leave the right to change this Privacy Policy at any time in accordance with the law. All changes will be immediately published on the site.