Privacy policy

Last updated 2 November 2026

General

This privacy policy explains how the Bending Mind online shop at bendingmind.lt collects, uses and stores your personal data, why we do it, who may receive it and what rights you have.

The data controller is MB “FPM Group”, company code 305466001, VAT code LT100013887313, registered address J. Jasinskio g. 17-58, LT-01111 Vilnius, Lithuania. Email hello@bendingmind.lt.

We process personal data in line with the General Data Protection Regulation (GDPR, (EU) 2016/679), the Lithuanian Law on Legal Protection of Personal Data and the Law on Electronic Communications.

Definitions

Personal data – any information about a person who can be identified directly or indirectly (e.g. name, email address, delivery address).
Processing – any operation on personal data: collecting, storing, using, sharing, deleting, etc.
Processor – a company that processes personal data on our behalf and on our instructions (e.g. the shop platform).
We – MB “FPM Group”, which runs the Bending Mind brand.
You – a website visitor, customer, newsletter subscriber or anyone who writes to us.

Principles

We process personal data lawfully, fairly and transparently, only for clearly stated purposes and only as much as those purposes need. We keep data accurate and secure and don’t keep it longer than necessary. We never sell personal data.

What we collect and why

Fulfilling orders. Name, email address, phone number, delivery and billing address, items ordered, order total and payment status. We use them to accept, take payment for, pack and ship your order, keep you updated on delivery and handle returns. Legal basis: entering into and performing a contract (GDPR Art. 6(1)(b)). Kept for 10 years from the order, as required by Lithuanian accounting law.

Payments. Card details are handled directly by the payment provider on the checkout page. We never see or store full card details – we only receive the payment status.

Enquiries. Name, email address, subject and message when you write to us through the contact form, by email or on social media. We use them to answer your questions and handle complaints. Legal basis: our legitimate interest in replying (GDPR Art. 6(1)(f)), or performing the contract if it’s about an order. Kept for 2 years after our last exchange.

Newsletter and first-order discount. Email address and the website language you signed up in. We use them to send your discount code and news about new rituals and offers. Legal basis: your consent (GDPR Art. 6(1)(a)). Kept until you withdraw consent. You can unsubscribe at any time via the link at the bottom of every email or by writing to hello@bendingmind.lt.

Legal obligations. Data needed to issue invoices, calculate taxes, honour consumer rights and respond to authorities. Legal basis: legal obligation (GDPR Art. 6(1)(c)).

Running the website. Technical data (IP address, browser type, device, time of request) that the web server records automatically in its logs to display and protect the site. Legal basis: our legitimate interest in keeping the site working and secure. The logs are handled by our hosting provider and kept for a limited time, for security only.

Data required for a purchase is marked on the checkout page. Without it we can’t fulfil your order. Subscribing to the newsletter is optional.

Where we get data

You give us most data yourself – when you buy, subscribe or write to us. Delivery companies may tell us the status of your parcel. If you contact us on Instagram or Facebook, we see your public profile name and photo.

Who we share data with

We share data only as much as needed to provide the service, and only with trusted partners bound by data processing agreements:

Shopify International Ltd. (Ireland) – shop platform, checkout, order and customer management, order emails and newsletter.
Payment providers – Shopify Payments, powered by Stripe, and other methods chosen at checkout (Apple Pay, Google Pay).
Hostinger International Ltd. (Cyprus) – website hosting.
Delivery companies (couriers and parcel-locker networks) – name, address, phone number and email to deliver your parcel.
Our UK shipping partner – name, address, phone number and email, when an order ships from London.
Meta Platforms Ireland Ltd. – when you contact us on Instagram or Facebook. For page insights on these platforms, we are joint controllers with Meta.
Accounting service providers – to keep accounting records.
Public authorities – only where the law requires it.

Transfers outside the EU

Some partners (e.g. Shopify, Stripe and Meta) may process data outside the European Economic Area, usually in the USA. In that case data is transferred only with GDPR safeguards: the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses. Data for orders shipped to the UK is transferred on the basis of the European Commission’s adequacy decision for the United Kingdom.

Cookies and browser storage

We group cookies and similar technologies into three categories. Essential ones always run; analytics and marketing ones are switched on only with your consent. On your first visit we show a cookie banner, and you can change your choice at any time via “Cookie settings” at the bottom of the site. Fonts and images are served from our own server.

Essential (always on). We store only what’s strictly needed for the service you ask for in your browser (localStorage):

bm-cart-v2 – your cart, so items don’t disappear when the page reloads. Deleted automatically after 14 days or when you empty the cart.
bm-code – a note that you received the first-order discount code, so it’s applied at checkout. Kept until you clear browser data.
bm-consent – your cookie choice, so we don’t ask every time. Kept for 12 months.

This data stays on your device and isn’t sent to us.

Analytics (only with consent). Helps us understand which pages are visited and how the site is used, so we can improve it. Legal basis: your consent (GDPR Art. 6(1)(a)).

Marketing (only with consent). Lets us measure how ads perform and show more relevant ads on social media. Legal basis: your consent.

We don’t use any analytics or marketing tools yet. Before switching them on, we’ll list the specific tools here (e.g. Google Analytics or Meta Pixel), their cookies, retention periods and recipients.

At checkout, Shopify uses essential cookies for the cart, security and payment. See the Shopify cookie policy.

You can delete or block cookies and site data in your browser settings at any time, though the cart may then stop working. If you withdraw consent, we delete the analytics and marketing cookies.

Links to Instagram and Facebook are plain links: these platforms only receive your data if you open them.

Your rights

You have the right to:

know what data we hold about you and get a copy;
have inaccurate data corrected or incomplete data completed;
have your data erased (“right to be forgotten”) unless we’re legally required to keep it;
restrict processing;
object to processing based on legitimate interest;
receive the data you gave us in a structured format and move it to another controller;
withdraw consent at any time (this doesn’t affect processing done before withdrawal).

We don’t make decisions based solely on automated processing, including profiling.

Send requests to hello@bendingmind.lt. We reply within 1 month. Your first copy of the data is free. We may ask you to confirm your identity first.

If you think your data is being mishandled, you can complain to the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, vdai.lrv.lt) or the authority in your EU country of residence. Please write to us first, though – we’ll do our best to sort it out quickly.

Data security

We use organisational and technical measures to protect data against accidental or unlawful destruction, alteration, disclosure or other unlawful processing. The website and checkout run over encrypted HTTPS. Access to data is given only to those who need it for their work, and passwords are changed when circumstances change or a breach is suspected. If a data breach occurs, we’ll notify the State Data Protection Inspectorate and, where the law requires, you.

Children

Our shop is meant for adults. We don’t knowingly collect data from children under 14. If you believe a child has given us data, let us know and we’ll delete it.

Final provisions

We review this policy when the law or our business changes. We’ll announce significant changes on the website and email newsletter subscribers. The current version is always on this page.

Privacy questions: hello@bendingmind.lt.