Privacy and Cookies
Who controls your data
Majoma, MB (company code 306697484, VAT number LT100016716516), Reikjaviko g. 10-14, LT-94253 Klaipėda, Lithuania, operates OBDPoint.com and is the controller of the personal data described here. For privacy requests, email info@obdpoint.com.
Data we collect and why
| Activity | Data | Purpose and legal basis |
|---|---|---|
| Shopping and fulfilment | Name, email, delivery and billing address, postcode, phone number, products, order history, company details where supplied | To take payment, fulfil the contract, deliver goods and provide support (GDPR Article 6(1)(b)). |
| Accounting and tax | Invoices, transaction and VAT information, order records | To meet accounting and tax duties (Article 6(1)(c)). |
| Customer enquiries, returns and warranty | Contact details, messages, order and technical information you provide | To perform the contract or respond to a requested pre-sale enquiry (Article 6(1)(b)); to manage legal claims and service quality where relevant (Article 6(1)(f)). |
| Store account | Login identifier, password hash, saved addresses and order history | To provide the account you request (Article 6(1)(b)). We cannot see your password. |
| Security and essential operation | IP address, device/browser data, security and server logs, essential cookies | To keep the store secure and functional (Article 6(1)(f) and, where applicable, Article 6(1)(b)). |
| Optional marketing or analytics | Only the data described in a separate opt-in or cookie choice | Consent where required (Article 6(1)(a)); you can withdraw it at any time. |
Required checkout fields are necessary to fulfil an order. If you do not provide a deliverable address, postcode, contact email or other required details, we may be unable to complete or deliver the order. Company registration and VAT numbers are optional unless needed for the requested invoice or tax treatment.
Payment information
Card payments are processed by Stripe. Stripe receives payment and transaction information needed to process and protect the payment; OBDPoint does not receive or store complete card numbers or card security codes. If you choose SEPA bank transfer, we receive the payment reference and payer details visible in our bank account.
Who receives your data
- Stripe receives data needed for card payment, refund and payment security.
- Siusk24/Alsendo receives shipment details needed to quote and book delivery; the selected postal operator, courier or parcel-locker operator receives the recipient name, address or locker location, contact details and parcel details needed to deliver it.
- Google Ireland Limited receives analytics information only if you consent to optional statistics cookies. This can include page views, product and cart events, transaction ID, products and order value; it does not include your card number.
- Website hosting, WordPress/WooCommerce support and email infrastructure process data needed to operate the shop, store orders and send transactional messages. OBDPoint uses WP Mail SMTP and its configured mail provider for email delivery.
- Professional advisers, banks and public authorities receive relevant data where needed for accounting, legal claims or a legal obligation.
We share only data necessary for each purpose. We do not sell customer data. We do not share customer data for personalised advertising through Google Analytics.
International transfers
Some service providers, including payment and infrastructure providers, may process data outside the European Economic Area. Where EU data-protection law requires it, we rely on an adequacy decision or appropriate safeguards such as the European Commission’s standard contractual clauses. Contact us for information about the safeguards relevant to your data.
How long we keep data
Order and invoice data are retained for the period required by Lithuanian accounting and tax law, generally 10 years, unless a longer period is necessary for a legal claim. Account data are kept while the account is active and then deleted or limited, except records that must be kept by law. Enquiry and support correspondence is kept only as long as needed to resolve the matter and any related claim. Security logs and temporary checkout/session data are kept for the shortest operational period supported by the relevant system and then deleted or anonymised. Where consent is the basis, data are kept until you withdraw consent or the stated purpose ends, subject to records needed to demonstrate compliance.
Cookies and similar technologies
WordPress, WooCommerce and the cache/security system use essential cookies or local storage to remember the cart, checkout session, login and security preferences. These are necessary for the service. Stripe may use payment-security technologies when its checkout component is used.
With your consent, we use Google Analytics 4 to understand visits and shopping activity, including product views, cart actions and completed purchases. Analytics may receive a transaction ID, product identifiers and order value. We do not intentionally send names, email addresses, phone numbers or payment-card numbers to Analytics. Statistics cookies are optional and remain off until you accept them. You can reject them or change your choice later using the floating privacy settings button. We do not use Google Analytics for personalised advertising. See Google’s Privacy Policy for more about Google’s processing.
Browser settings can block cookies, but doing so may prevent cart or checkout functions from working.
Details of cookies managed through our consent tool:
Your rights
Subject to the conditions in the GDPR, you may request access to your data, correction, erasure, restriction, portability and objection to processing based on legitimate interests. You may withdraw consent without affecting processing already carried out. We normally respond within one month. To exercise your rights, write to info@obdpoint.com; we may need to verify your identity before disclosing account or order details. You may lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI) or another competent supervisory authority in the EEA.
Security and changes
We use access controls, encrypted connections and appropriate organisational measures to protect data. No online service can guarantee absolute security. We will update this notice when our processing changes materially and show the current effective date on this page.
Effective date: 12 October 2026.