Privacy policy

Last updated: 9 September 2026

1. Introduction

This Privacy Policy explains how Bruno’s Glam, operated by St. Bruno Group Of Companies, MB (“we”, “us” or “our”), collects, uses, shares and protects your personal data when you visit www.brunosglam.com, make a purchase or communicate with us.

We are committed to handling your personal data transparently and in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Lithuanian data protection and electronic communications legislation.

2. Data Controller & Contact Details

The controller responsible for the processing described in this policy is:

St. Bruno Group Of Companies, MB
Legal Entity Code: 305992396
VAT Code: LT100016032917
Registered Address: Šv. Stepono g. 27C-47, LT-01315 Vilnius, Lithuania
Email: help@brunosglam.com
Website: www.brunosglam.com

For privacy enquiries, complaints or requests to exercise your data protection rights, please contact us using the details above. Our response commitments are set out in Section 9.

3. Personal Data We Collect

We collect personal data directly from you, automatically through your use of our website and, where necessary, from service providers involved in processing payments and delivering orders. For example, payment providers may supply transaction status and fraud indicators, and delivery partners may supply tracking and delivery confirmations.

A. Device & Website Usage Information

When you visit our website, we may collect:

IP address.
Browser type and version.
Device type and operating system.
Time zone.
Cookie identifiers.
Pages and products viewed.
Search terms entered on our website.
Information about your interactions with the website.

This information supports website functionality, security, fraud prevention, troubleshooting and, where you have consented, analytics and advertising.

It is collected through technologies such as cookies, pixels and log files. Further information about consent and cookies is provided in Section 10.

B. Account, Order & Checkout Information

When you create an account or place an order, we may collect:

Full name.
Billing and shipping addresses.
Email address.
Phone number.
Account information.
Products purchased and order history.
Payment status, transaction references and payment information made available to us by the payment provider.
Delivery details and tracking information.

Payment providers process the payment credentials required for your chosen payment method. The information available to us depends on the provider and payment method used.

We use this information to manage your account, process payments, fulfil orders, arrange delivery, issue invoices and communicate with you about your purchase.

Information required to process an order is necessary for us to fulfil the purchase contract or meet legal obligations. If you do not provide it, we may be unable to complete your order.

C. Customer Support & Communications

When you contact us, we may collect:

Your name and contact details.
Order numbers and tracking references.
The content of your messages.
Attachments or supporting information you provide.
Records of our correspondence and the action taken.

We use this information to answer enquiries, resolve issues, provide customer support and handle requests or complaints. Please provide only information relevant to your enquiry.

D. Marketing Preferences

Where you subscribe to marketing communications or make privacy choices, we may record:

Your name and email address.
Subscription preferences.
Consent records.
Unsubscribe requests and objections.
Cookie preferences.

We use these records to manage your choices and ensure that our communications respect them.

4. Sharing Your Personal Data

We share personal data where necessary for the purposes described in this policy, with appropriate protections. Recipients may include:

Shopify: To host and operate our online store and support order and account management.
Payment service providers: To process payments, refunds and transaction checks.
Delivery partners: To arrange shipping, delivery, tracking and returns.
Technology and support providers: To support website operation, communications, security and customer service.
Analytics and marketing providers: Where you have given the required consent.
Professional advisers: Where necessary for accounting, legal advice or the establishment, exercise or defence of legal claims.
Public authorities: Where disclosure is required by law or a legally binding request.

We limit the information shared to what is necessary for the relevant purpose.

Where a provider processes personal data on our behalf, we require appropriate contractual protections. Some recipients, such as payment providers, may also process information as independent controllers for their own legal and regulatory obligations.

We do not sell your personal data.

5. Direct Marketing & Analytics

Marketing Communications

With your consent, we may send promotional emails about products, updates and offers.

You can withdraw your consent at any time by:

Using the unsubscribe link in a marketing email; or
Contacting help@brunosglam.com.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Once you unsubscribe or object to direct marketing, we will stop using your personal data for that purpose. We may retain a limited record of your preference to ensure that you are not added back to marketing lists.

Essential communications about orders, payments, deliveries or customer support are separate from marketing and may still be sent when necessary.

Analytics

With your consent where required, we may use analytics tools, such as Google Analytics, to understand how visitors use our website and identify improvements.

Further information is available through:

The browser add-on is an additional option and does not replace the privacy choices available through our website.

6. How We Use Personal Data & Our Legal Bases

Under GDPR, we rely on the following legal bases:

Performance of a Contract

Creating and managing an account requested by you.
Processing orders, payments, deliveries, returns and refunds.
Providing support relating to your purchase.

Steps Before Entering into a Contract

Responding to enquiries and taking steps at your request before you make a purchase.

Compliance with Legal Obligations

Keeping accounting and tax records.
Handling data protection rights requests.
Responding to legally binding requests from competent authorities.

Legitimate Interests

Answering general enquiries and managing correspondence, in our interest in communicating with customers and operating our business.
Protecting our website, detecting fraud and preventing misuse, in our interest in securing our services and protecting customers and our business.
Establishing, exercising or defending legal claims, in our interest in protecting our legal rights.
Maintaining limited records of marketing objections to respect your preferences.

Where we rely on legitimate interests, we consider the impact on your rights and freedoms and do not rely on that basis where your interests or fundamental rights override ours.

Consent

Sending promotional emails.
Using non-essential analytics and advertising technologies.

Where we need to use your personal data for a new purpose, we will assess whether that use is permitted by law and provide any information or obtain any consent required before proceeding.

Automated Decision-Making

You have the right, subject to the conditions and exceptions in GDPR, not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. Where such processing applies, we will provide the required information about the logic involved, its significance and its envisaged consequences, together with the applicable safeguards and ways to exercise your rights.

7. International Data Transfers

Some service providers may process personal data outside Lithuania or the European Economic Area (“EEA”), including in Canada and the United States.

Where personal data is transferred outside the EEA, we rely on an appropriate legal transfer mechanism, such as:

A European Commission adequacy decision covering the recipient and processing concerned; or
European Commission-approved Standard Contractual Clauses, together with additional safeguards where necessary.

Shopify uses international infrastructure and service providers. Information about its transfer arrangements is available in Shopify’s international data transfer guidance.

You may contact help@brunosglam.com for further information about the safeguards applicable to your personal data or to request a copy of relevant safeguards, subject to necessary redactions protecting confidential information and the rights of others.

8. Data Retention & Security

Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including applicable legal, accounting and reporting obligations.

We determine retention periods using the following criteria:

Account information: Whether your account remains active or the information is needed to provide requested services.
Order and transaction records: The time needed to fulfil the order, handle returns or disputes and comply with applicable Lithuanian accounting and tax retention requirements.
Customer support correspondence: The nature of the enquiry, its resolution and whether records remain necessary for related disputes or legal claims.
Marketing information: Whether your consent remains valid, subject to retaining limited records of consent, withdrawal or objection where necessary.
Security and technical records: The period reasonably necessary to investigate incidents, prevent misuse and maintain service security.
Privacy request records: The period necessary to document our handling of requests and demonstrate compliance.

Records may be retained longer where required by law or necessary for an ongoing dispute or legal claim. When personal data is no longer required, we delete it securely or anonymise it.

You can contact us for further information about the retention period applicable to a particular category of your personal data.

Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss and destruction.

Access is limited to people and service providers who need the information for their responsibilities. Security measures are assessed in light of the nature of the data and the risks involved.

No method of transmission or storage is entirely secure. If a personal data breach occurs, we will assess it and make any notifications required by applicable data protection law.

9. Your Data Protection Rights & Response Times

Subject to the conditions and exceptions under applicable data protection law, you have the right to:

Access: Obtain confirmation of whether we process your personal data and receive a copy.
Rectification: Have inaccurate data corrected and incomplete data completed.
Erasure: Request deletion of your personal data where the legal conditions apply.
Restriction: Request that we limit processing in specified circumstances.
Objection: Object to processing based on legitimate interests. You may object to direct marketing at any time.
Data portability: Receive eligible data in a structured, commonly used and machine-readable format and request its transfer to another controller where technically feasible.
Withdrawal of consent: Withdraw your consent at any time without affecting the lawfulness of earlier processing.
Automated decision-making protections: Exercise the applicable rights described in Section 6.
Complaint: Lodge a complaint with a supervisory authority.

These rights are not absolute. For example, we may need to retain certain records to meet legal obligations even after an erasure request.

How to Submit a Request

Email help@brunosglam.com or write to the registered address in Section 2.

Please describe your request and provide enough information for us to identify the relevant account or records. No special form is required.

Our Service Commitments (SLA)

Acknowledgement: We will acknowledge privacy and data protection requests within five business days of receipt.

GDPR rights requests: We will respond without undue delay and within one calendar month of receipt, explaining the action taken or our decision.

Extensions: Where necessary because of the complexity or number of requests, we may extend the response period by up to two additional calendar months. We will notify you within the initial one-month period, explain why the extension is necessary and provide the expected response date.

Other privacy enquiries and complaints: We will provide a substantive response within one calendar month of receipt. If further investigation is needed, that response will explain the outstanding issues and expected completion date. This does not extend any applicable statutory deadline.

Business days: Monday to Friday, excluding Lithuanian public holidays. The acknowledgement period does not replace or extend the applicable GDPR response deadline.

Identity Verification

If we have reasonable doubts about your identity, we may request additional information necessary to verify it before disclosing or changing personal data. We will limit verification requests to information proportionate to the circumstances.

Fees

Requests are generally handled free of charge.

Where a request is manifestly unfounded or excessive, we may charge a reasonable fee reflecting administrative costs or refuse to act, as permitted by GDPR. We will explain the basis for that decision.

Requests We Cannot Fulfil

If we do not act on your request, we will explain the reasons without delay and within one calendar month of receipt. We will also inform you of your right to complain to a supervisory authority and seek a judicial remedy.

10. Cookies & Similar Technologies

Our website uses cookies and similar technologies to operate the store and, where you consent, understand website usage and support advertising.

Types of Cookies

Strictly necessary cookies: Support essential functions such as the shopping cart, checkout, security and remembering privacy choices.
Preference cookies: Remember optional settings and choices.
Analytics and performance cookies: Help us understand visitor activity and improve website performance.
Advertising and social media cookies: Support advertising, campaign measurement and relevant social media features.

Your Choices

Strictly necessary cookies are used without consent where legally permitted because they are required to provide the service you request.

Other cookies and similar tracking technologies are used only after you provide consent where required by law. You may accept or reject non-essential cookies and subsequently change or withdraw your consent through the website’s cookie settings.

Rejecting non-essential cookies does not prevent you from placing an order.

You can also manage or delete cookies through your browser. Blocking strictly necessary cookies may affect functions such as the shopping cart and checkout.

For further information about managing cookies, visit All About Cookies.

11. Updates to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, processing activities or legal requirements.

The current version will be available on this page, with its revision date shown at the top.

Where changes materially affect how we use your personal data, we will provide appropriate notice. If a change requires your consent, we will obtain it before carrying out the relevant processing.

12. Complaints

If you have concerns about how we handle your personal data, you may contact us at help@brunosglam.com. We will handle your complaint in accordance with the response commitments in Section 9.

You also have the right to lodge a complaint directly with a data protection supervisory authority, particularly in the EU/EEA country where you habitually reside, work or believe an infringement occurred.

You do not need to contact us first or wait for our response before contacting a supervisory authority.

Our local supervisory authority is:

State Data Protection Inspectorate of Lithuania (VDAI)
Website: vdai.lrv.lt/en/

Current contact details and information about submitting a complaint are available on the authority’s website.