Last updated: 3 October 2026
The short version
- We collect only what we need to make, ship and support your order - and to keep the records the law requires.
- We never sell your data and never use it for anything unrelated to your order without asking.
- Payments are handled by Stripe and PayPal. We never see or store your full card details.
- You can shop without creating an account.
- You can ask us at any time what we hold about you, and ask us to correct or delete it.
- Questions? Write to mbdinerija@gmail.com - the people who make our products will reply.
The full details are below.
1. Who we are
This website is run by MB „Dinerija“, a small Lithuanian business that makes doll clothes, dollhouse miniatures and digital sewing patterns under the name DiNerija.
MB „Dinerija“
Company code: 307083261
VAT number: LT100017606713
Saltoniškių g. 54-32A, LT-08106 Vilnius, Lithuania
Email: mbdinerija@gmail.com
We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). As a micro business we are not required to appoint a Data Protection Officer - all privacy questions go directly to the email above.
2. What data we collect
When you place an order
- Name, billing and shipping address, email address and phone number (the phone number is used only if the carrier needs it).
- What you ordered, prices, taxes, shipping method and any order notes you write.
- Your country - we need it to charge the correct VAT.
When you pay
Payments are processed directly by Stripe or PayPal. We receive only a confirmation, the payment method type and, for cards, the card brand, the last four digits and the expiry date. We never receive your full card number.
When you buy digital downloads
For sewing patterns and paper dolls we record the date, time and IP address of each download, so we can deliver your files and help if a download fails.
If you create an account
An account is optional and can be created at checkout. We store your email, your saved addresses and your password (encrypted - we cannot see it).
When you contact us
Your name, email address and the content of your message, including any photos you send us (for example, of your doll for a sizing question).
When you comment on the blog
Your name, email address, optional website, your comment and your IP address (used to block spam). Your email address is never shown publicly.
Automatically, when you browse
Technical data such as your IP address, browser type and the pages you visit are recorded in our hosting provider’s server logs for security. See also section 8 (Cookies).
We also use your IP address to estimate your country, so the shop can show prices in the right currency and with the right VAT before you enter your address. The country lookup uses a GeoLite database stored on our own server. This product includes GeoLite data created by MaxMind, available from https://www.maxmind.com.
We do not ask for sensitive data (such as health or religious information) and kindly ask you not to send it.
3. Why we use your data
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Processing and delivering your order, sending order and shipping emails | Order, contact and address data | Performance of a contract - Art. 6(1)(b) |
| Delivering digital downloads | Email, order, download log | Performance of a contract - Art. 6(1)(b) |
| Handling returns, refunds and complaints | Order and contact data, messages | Contract - Art. 6(1)(b); legal obligation under consumer law - Art. 6(1)(c) |
| Invoicing, accounting and VAT, including EU OSS reporting | Name, address, country, order and payment data | Legal obligation - Art. 6(1)(c) |
| Answering your questions | Contact data, message | Legitimate interest in replying to you - Art. 6(1)(f), or steps before a contract - Art. 6(1)(b) |
| Running your optional customer account | Account data | Performance of a contract - Art. 6(1)(b) |
| Preventing fraud and keeping the website secure | IP address, payment signals, server logs | Legitimate interest - Art. 6(1)(f) |
| Blog comments | Comment data | Legitimate interest in running a blog and blocking spam - Art. 6(1)(f) |
Do you have to give us your data? Your name, email, address and country are needed to fulfil and invoice an order - without them we cannot sell to you. Everything else (phone number, account, comments) is optional.
We do not send marketing emails. If we start a newsletter, it will be strictly opt-in and this policy will be updated first.
4. Our legitimate interests
Where we rely on legitimate interest, it is to reply to people who write to us, to protect our shop and customers against fraud and spam, to keep the website running securely, and to establish or defend legal claims. You can object to this at any time (see section 9).
5. Who we share your data with
We share only what each service needs to do its job:
| Recipient | What for | Location |
|---|---|---|
| Stripe (Stripe Payments Europe Ltd.) | Card and other online payments, fraud prevention | Ireland; may transfer data to the USA |
| PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.) | PayPal payments | Luxembourg; may transfer data to the USA |
| Delivery carriers: Lietuvos paštas, PostNL, FedEx, UPS, USPS and other postal and courier services, depending on the destination | Delivering your parcel (name, address, phone, email for tracking) | Lithuania, the EU and the destination country |
| Hosting provider (Hostinger International Ltd.) | Storing the website and its database | Cyprus; servers in the EU |
| Google (Gmail) | Our email inbox | Ireland; may transfer data to the USA |
| Customs and postal authorities | Customs declarations for parcels sent outside the EU | Destination country |
| Public authorities | Only when required by law (for example, the tax authority) | Lithuania |
Stripe and PayPal act as independent controllers for some of the data they process, for example to meet financial regulations. Their own privacy policies apply: Stripe, PayPal.
We do not sell or rent your personal data to anyone.
6. Transfers outside the EU
Some of the services above may process data outside the European Economic Area, mainly in the USA. Such transfers are protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework, where the company is certified) or by the European Commission’s Standard Contractual Clauses. If you order delivery outside the EU, your address is necessarily passed to carriers and customs in the destination country.
7. How long we keep your data
| Data | How long |
|---|---|
| Orders and invoices | 10 years from the end of the year of the order, as required by Lithuanian accounting and archiving rules |
| Customer account | Until you ask us to delete it, or automatically after 24 months without logging in (your past orders are kept as described above) |
| Unpaid, failed or cancelled orders | Up to 60 days |
| Download logs | As long as the related order is kept |
| Emails and messages | Up to 2 years after the conversation ends, unless they relate to an order or a claim |
| Blog comments | Until the comment is removed, or until you ask us to remove it |
| Server logs | For a short period set by our hosting provider, for security purposes |
If there is a dispute or a legal claim, we may keep the relevant data until it is resolved.
8. Cookies
Cookies are small files that your browser stores. We use only cookies that are strictly necessary for the shop to work, so we do not ask for cookie consent. We do not use advertising or analytics cookies. If that ever changes, we will ask for your consent first and update this list.
You can delete or block cookies in your browser settings. If you block these cookies, the cart and checkout will not work.
9. Your rights
Under the GDPR you have the right to:
- access the data we hold about you and get a copy;
- correct inaccurate data;
- delete your data - except what we must keep for accounting and tax purposes;
- restrict how we use your data;
- receive your data in a portable format;
- object to processing based on legitimate interest;
- withdraw consent at any time, where we rely on consent (this does not affect processing before the withdrawal).
To use any of these rights, email mbdinerija@gmail.com. We will reply within one month, free of charge. We may ask you to confirm your identity, usually by writing from the email address used for your order.
If you think we have handled your data incorrectly, please tell us first - we will do our best to put it right. You also have the right to lodge a complaint with the Lithuanian supervisory authority:
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)
L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
ada@ada.lt · vdai.lrv.lt
or with the data protection authority in the EU country where you live. Customers in the UK may contact the Information Commissioner’s Office (ico.org.uk).
10. Automated decisions
We do not make decisions about you based solely on automated processing. Our payment providers run automated fraud checks; if your payment is blocked, contact us and we will look into it with you.
11. Children
Our products are loved by doll fans of all ages, but purchases must be made by adults. This website is not intended for children under 14 (the age of digital consent in Lithuania), and we do not knowingly collect their data. If you believe a child has sent us personal data, please contact us and we will delete it.
12. Security
The website uses an encrypted (HTTPS) connection. Card payments are handled on Stripe’s and PayPal’s secure systems. Access to order data is limited to the people who run DiNerija.
13. Changes to this policy
We may update this policy when our shop or the law changes. The date at the top shows the current version. Significant changes will be announced on the website.
14. Contact
MB „Dinerija“ · Saltoniškių g. 54-32A, LT-08106 Vilnius, Lithuania · mbdinerija@gmail.com