How UAB Logvira (Divemen) handles your personal data when you shop on divemen.lt, send an inquiry about a course or trip, write to us or call us, and what rights you have.
The controller
The controller of your personal data is UAB Logvira (brand: Divemen), company code 301566890, Justiniškių g. 144C-1, LT-06153 Vilnius, Lithuania, e-mail info@divemen.lt, phone +370 681 42659, +370 521 95469.
We have not appointed a data protection officer. For any question about personal data, write to info@divemen.lt.
We process personal data under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Lithuanian Law on the Legal Protection of Personal Data. This policy covers the divemen.lt website and its online shop.
What data we process, why and for how long
Orders and invoices
- Data: name, e-mail, phone number, delivery address or parcel locker, items ordered, prices, delivery and payment method, payment status, order notes; if you buy for a company, the company name, company code and VAT number. The shop system also saves your IP address and browser type with the order automatically.
- Purposes: to accept and fulfil your order, deliver the goods, issue the invoice, handle returns, guarantee claims and complaints, and keep the accounts.
- Legal basis: entering into and performing the contract (GDPR Article 6(1)(b)); invoices and accounting are a legal obligation (Article 6(1)(c), Lithuanian Law on Financial Accounting); the IP address is our legitimate interest in protecting the shop against fraud (Article 6(1)(f)).
- Retention: 10 years after the contract is performed, the period for which accounting documents and purchase contracts must be kept.
- You do not have to give the data needed for an order, but without it we cannot fulfil the order.
Customer account
- Data: e-mail, password (stored only in encrypted, hashed form), name, addresses, phone number, order history.
- Purpose: to let you buy faster and see your orders.
- Legal basis: the contract for using the account (GDPR Article 6(1)(b)).
- Retention: while you use the account. We delete the account at your request, and we delete accounts unused for 3 years. Order data is then kept as described above.
Course and trip inquiries
- Data: name, phone number, e-mail, the course or trip and option chosen, preferred time, message.
- Purpose: to answer the inquiry and arrange the course or trip.
- Legal basis: steps taken at your request before entering into a contract (GDPR Article 6(1)(b)). In the form you tick that you agree to your details being used to answer the inquiry.
- Retention: 2 years after our last contact with you.
- The inquiry is stored in the website’s admin area and forwarded to our e-mail. The form’s spam protection does not store your IP address.
- If the inquiry is about a child, the child’s details are given by a parent or guardian.
E-mails and phone calls
- Data: name, e-mail address or phone number, content of the correspondence.
- Purpose: to answer questions, serve customers and handle requests and complaints.
- Legal basis: steps at your request or performance of a contract (GDPR Article 6(1)(b)); our legitimate interest in answering you and defending legal claims (Article 6(1)(f)).
- Retention: 2 years after the last message; if there is a dispute, until it is resolved.
Gift vouchers
- Data: the buyer’s order data, the voucher code, validity and a note when it is used; if the buyer gives them, the recipient’s name and a message, which are printed on the voucher.
- Purpose: to issue the voucher and let it be used.
- Legal basis: the contract with the buyer (GDPR Article 6(1)(b)); for the recipient’s name and message, our legitimate interest in carrying out the buyer’s request (Article 6(1)(f)). We receive the recipient’s details from the buyer.
- Retention: together with the order data.
Cookies, statistics and marketing
- Necessary cookies keep the site, the cart and checkout working.
- Statistics tools (Google Analytics, Microsoft Clarity) and the marketing tool (Meta Pixel) are used only with your consent (GDPR Article 6(1)(a)). If you decline, Google Analytics receives only anonymous signals without cookies or identifiers.
- Each cookie choice is recorded without anything that identifies you (a random ID, the time, the choice, the policy version and the language) and kept for 3 years, so we can show that consent was given.
- YouTube and TikTok videos load only when you press play.
- More in the Cookie policy. You can change or withdraw your consent at any time.
Server logs
For security and technical reasons the web server logs requests (IP address, time, browser details). The legal basis is our legitimate interest in keeping the site secure (GDPR Article 6(1)(f)). The logs are kept for a short time and deleted automatically.
Social networks
When you contact us through our accounts on social networks, the operators of those networks also process your data under their own privacy rules.
Who receives your data
We do not sell personal data. We share it only with those who need it for the purposes in this policy:
- Paysera LT, UAB – to process payments and refunds. Paysera processes payment data as an independent controller under its own privacy policy.
- Carriers – AB Lietuvos paštas (LP Express, Unisend) and Omniva LT, UAB: name, phone number, e-mail, delivery address or parcel locker.
- Telia Lietuva, AB – website hosting and e-mail (processor).
- Our accounting service provider – invoice and payment data (processor).
- Google Ireland Limited, Microsoft Ireland Operations Limited, Meta Platforms Ireland Limited – data on how the site is used, only with your consent to statistics or marketing cookies (Google Analytics also receives anonymous signals without cookies).
- Public authorities and courts – where the law requires it.
Processors handle your data only on our instructions and under contracts with us.
Transfers outside the European Union
Website and e-mail data is stored in the European Union. Google, Microsoft and Meta may transfer data to the United States, to companies in the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Implementing Decision (EU) 2023/1795).
How we protect your data
The site uses a secure connection (HTTPS), only the people who work with the data can access it, and we choose service providers that protect data properly.
Your rights
You have the right to:
- access your data and receive a copy;
- have inaccurate data corrected or incomplete data completed;
- have your data erased when it is no longer needed or there is no legal basis for it (except data we must keep by law);
- have the processing restricted;
- object to processing based on our legitimate interest;
- receive the data you gave us in a structured, machine-readable format and have it passed to another controller (data portability);
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
We do not make automated decisions that have legal effects on you.
To use your rights, write to info@divemen.lt. We may ask you to confirm your identity. We reply free of charge within 1 month; for complex requests we may extend this by 2 more months and will tell you if we do.
Complaints
If you think your data is processed unlawfully, you can complain to the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija): L. Sapiegos g. 17, LT-10312 Vilnius, e-mail ada@ada.lt, vdai.lrv.lt. We suggest contacting us first: we will try to resolve the matter quickly.
Changes to this policy
We update this policy when our processing or the law changes. The current version is published on this page.
Updated 4 October 2026.