PRIVACY AND COOKIE POLICY
Data Controller: MB Leidykla ACE Company code: 306921338 Address: Šilėnų g. 15, Kaunas LT-52245, Lithuania Email: info@worldoface.com Website: www.worldoface.com / www.aceknyga.com
This Privacy and Cookie Policy applies when you visit the websites www.worldoface.com and www.aceknyga.com (the “websites”). It does not apply to third-party websites accessible via links on these websites.
We collect and process personal data in accordance with the Law on Legal Protection of Personal Data of the Republic of Lithuania, the Law on Electronic Communications of the Republic of Lithuania, the European Union General Data Protection Regulation (GDPR) 2016/679, the e-Privacy Directive 2002/58/EC, and the guidance of supervisory authorities.
1. Data we collect
1.1 To fulfil your order
- First and last name
- Delivery address
- Phone number
- Email address
- Order and payment information
Providing this data is a contractual necessity. Without it we cannot process your order or arrange delivery of the goods.
1.2 For use of the website
We collect data about how the website is used through cookies (see Section 5 — Use of Cookies).
1.3 For contact forms
The information you voluntarily provide in the contact form: name, email address, and the content of your message.
1.4 For direct marketing
The email address you provide when subscribing to our newsletter or when you tick the consent box during checkout. We use this data solely to send newsletters and offers (see Section 2).
2. Purposes and legal bases for processing
We process your personal data for the following purposes and on the following legal bases:
Order fulfilment and delivery of goods Legal basis: Performance of a contract (GDPR Art. 6(1)(b)). Your personal data is necessary to process, pack, and deliver your order.
Accounting and financial records Legal basis: Legal obligation (GDPR Art. 6(1)(c)). The Law on Accounting of the Republic of Lithuania requires us to retain invoice and transaction records for 10 years.
Responding to your enquiries Legal basis: Legitimate interest (GDPR Art. 6(1)(f)). Our legitimate business interest is to respond to customer enquiries and ensure good customer service. This interest does not override your privacy rights, as we retain enquiry data only for a limited period and do not use it for any other purpose.
Direct marketing (newsletters and offers) Legal basis: Consent (GDPR Art. 6(1)(a)) when you subscribe to our newsletter or tick the consent box. For existing customers, we may send information about our own similar products on the basis of legitimate interest (GDPR Art. 6(1)(f)) in accordance with the Law on Electronic Communications of the Republic of Lithuania; every message provides an easy way to opt out. You may withdraw your consent or unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us.
Improving the operation of the website Legal basis: Consent (GDPR Art. 6(1)(a)). Analytics cookies are activated only when you give clear consent through our cookie banner.
We do not use automated decision-making or profiling in relation to your personal data.
3. Data retention periods
- Order data and invoices: 10 years (as required by the Law on Accounting of the Republic of Lithuania)
- Contact form enquiries: until your enquiry is answered and for 1 year thereafter
- Cookies: depending on the type of cookie (see Section 5)
- Marketing consent records: until consent is withdrawn, plus 3 years as proof of compliance
4. Who we share your information with
We share your personal data only where necessary, and only with the following categories of recipients:
Delivery partners: LP Express — your delivery address and contact information are transferred for the purpose of delivering your parcel.
Payment service providers: Montonio — your payment information is securely processed by Montonio in order to complete your transaction. Montonio acts as our data processor and is bound by a GDPR-compliant data processing agreement.
Accounting service providers: If we engage an external accountant or accounting software, they may access invoice and transaction data solely for accounting purposes.
Email / newsletter platform: Omnisend (UAB Omnisend, Verkių g. 25C-1, LT-08223 Vilnius, Lithuania) — your email address and marketing consent status are processed in order to send newsletters and manage your subscription. Omnisend acts as our data processor and is bound by a GDPR-compliant data processing agreement. Please note that Omnisend may store data on servers outside the EU/EEA (see Section 4.1).
These partners receive only the minimum data necessary to provide their services and are contractually obliged to ensure confidentiality and comply with GDPR requirements.
4.1 Transfers of data outside the EU/EEA
Some of the third-party services we use (e.g. analytics tools or email platforms) may transfer data outside the EU/EEA. In such cases, we ensure that appropriate safeguards are applied — for example, the Standard Contractual Clauses (SCCs) approved by the European Commission — to protect your data to the same standard as required within the EU.
5. Use of cookies
When you visit our websites, we use cookies to ensure a better browsing experience. Cookies are small text files stored in your browser. They help recognise returning visitors, remember your preferences, and analyse how the website is used.
Non-essential cookies are placed on your device only when you give clear consent through our cookie consent banner. You can change your preferences at any time.
5.1 Essential cookies
These are necessary for the website to function. They enable core features — the shopping cart, secure login, and checkout. Consent is not required for essential cookies; disabling them would affect core website functionality. Duration: For the session or up to 1 year.
5.2 Performance / analytics cookies
These collect anonymous information about how visitors use the website, e.g. which pages are visited most often. All information is aggregated and does not identify individual users. We use it solely to improve the website. Legal basis: Consent. Duration: Up to 2 years.
5.3 Functional cookies
These remember your choices (e.g. your preferred language) and provide enhanced, personalised features. They do not track your browsing on other websites. Legal basis: Consent. Duration: Up to 1 year.
5.4 Managing and deleting cookies
You can manage or withdraw your cookie consent preferences at any time using the cookie settings link on our website. You can also disable cookies in your browser settings, although this may affect website functionality. For independent information on managing cookies, visit: www.aboutcookies.org
5.5 Third-party content
Some pages may contain embedded third-party content (e.g. videos or maps). These third parties may set their own cookies and collect data about you. We do not control third-party cookies and recommend that you review their privacy policies directly.
6. Security
We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure, in accordance with GDPR Art. 32. Access to personal data is granted only to authorised staff who need it to perform their duties.
7. Your rights under the GDPR
Under the GDPR you have the following rights in relation to your personal data:
- Right of access — to obtain confirmation of whether we process your data and to receive a copy of it.
- Right to rectification — to request correction of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”) — to request deletion of data when it is no longer needed or is processed unlawfully.
- Right to restriction of processing — to request that, in certain circumstances, we limit the use of your data.
- Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
- Right to object — to object to processing based on legitimate interest or for direct marketing purposes.
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact us at: info@worldoface.com
We will respond to all rights requests within 30 days of receipt. In complex cases this period may be extended by a further 2 months — we will inform you if so.
You also have the right to lodge a complaint with the State Data Protection Inspectorate (VDAI) if you believe your data is being processed improperly: Website: www.vdai.lrv.lt
8. Changes to this policy
We reserve the right to update this Privacy and Cookie Policy at any time. Any changes will be published on this website with an updated date. We recommend reviewing this policy periodically. Continued use of the website after changes are published is deemed acceptance of the updated policy.
9. Contact
If you have any questions about this Privacy and Cookie Policy or wish to exercise your rights, please contact us:
MB Leidykla ACE Address: Šilėnų g. 15, Kaunas LT-52245, Lithuania Company code: 306921338 Email: info@worldoface.com Website: www.worldoface.com / www.aceknyga.com
Last updated: 10 June 2026