Privacy policy
Last updated: 5 October 2026
1. Who is responsible for your data
The controller of your personal data is MB Slipton, company code 307574221, Kaukysos g. 18-411, LT-11342 Vilnius, Lithuania, email hello@takealora.com. We sell ALORA through the online store on this website. For any privacy question or request, write to hello@takealora.com.
2. The waitlist (our current pre-launch phase)
ALORA is not on sale yet. If you press an order or checkout button now, no payment is taken and no order is placed; instead, we invite you to join the waitlist.
- What we collect: your email address, and a few technical details saved with it: the date you joined, the store language, the product option you looked at, the page you joined from and the campaign that brought you to us (for example, the ad's campaign name).
- Why: to tell you when the first batch is ready, to send you the offer for waitlist members and our news, and to understand which pages and campaigns work.
- Legal basis: your consent (GDPR art. 6(1)(a)), given when you submit the form.
- Where it is stored: in our store platform, Shopify (see section 4).
- How long: until the launch plus 6 months, or until you unsubscribe or ask us to delete it, whichever comes first. If we cancel the launch, we delete the waitlist.
- Opting out: use the unsubscribe link in any email, or write to hello@takealora.com. Joining the waitlist costs nothing and does not oblige you to buy.
3. What we collect, why, on what legal basis and for how long
| Purpose | Data | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Orders: taking payment, shipping, order emails, returns and the guarantee | Name, delivery and billing address, email, phone, order contents, amount, payment status (not your full card number), delivery events | Contract, art. 6(1)(b); legal obligation for accounting records, art. 6(1)(c) | Accounting documents: as long as Lithuanian accounting and tax law requires. Other order data: 3 years after your last order |
| Subscriptions: renewing, reminding you before each charge, letting you skip or cancel | The above, plus your subscription schedule and a payment token held by the payment provider | Contract, art. 6(1)(b) | While the subscription is active, then 3 years after it ends (accounting records as above) |
| Waitlist (see section 2) | Email, language, sign-up date, product option, page and campaign | Consent, art. 6(1)(a) | Until the launch plus 6 months, or until you unsubscribe |
| Marketing emails (news and offers) | Email, name if given, language, which emails you opened or clicked, purchase history | Consent, art. 6(1)(a). The consent box at checkout is never pre-ticked. | Until you unsubscribe. After that, we keep your email on a suppression list so you are not emailed again (legitimate interest, art. 6(1)(f)) |
| Analytics and advertising cookies and pixels (Shopify analytics, Meta Pixel) | Device and browser data, pages viewed, add-to-cart, checkout and sign-up events, cookie IDs | Consent, art. 6(1)(a), given in our cookie banner. Marketing pixels do not run until you accept, and "Decline" is as easy as "Accept". | Cookie lifetimes are shown in the cookie settings; event data according to each provider's retention periods |
| Customer service | Your messages, order details, photos you send | Contract, art. 6(1)(b), and our legitimate interest in answering you, art. 6(1)(f) | 3 years after your last message |
| Fraud prevention and security | Order and device data checked by Shopify's fraud tools | Legitimate interest, art. 6(1)(f) | As long as needed for the order and for any legal claims |
| Legal claims and obligations | Data relevant to a dispute, withdrawal or complaint | Legal obligation, art. 6(1)(c); legitimate interest, art. 6(1)(f) | Until the limitation period for the claim ends |
We don't ask for information about your health, and we don't need it. If you tell us something about your health in a message, we use it only to answer you.
4. Who receives your data
We use service providers that process data on our behalf under a data processing agreement, and a few that act as independent controllers.
| Recipient | What for | Location |
|---|---|---|
| Shopify International Limited (processor) | Store platform, checkout, order and waitlist data, hosting | Ireland; sub-processors including in Canada and the USA |
| Payment service providers (for example, Shopify Payments and its payment partners, or PayPal if you choose it) | Processing your payment. The available payment methods are shown at checkout. | EU; some providers also outside the EU |
| Email service provider (Klaviyo, Inc., processor), if we use it to send our emails | Order-related emails, waitlist and marketing emails, sign-up forms | USA (EU-U.S. Data Privacy Framework and Standard Contractual Clauses) |
| Meta Platforms Ireland Limited | Measuring our ads and showing them to the right people, only with your consent. Meta is a joint controller with us for the collection and transmission of pixel data, and an independent controller after that. | Ireland; transfers to the USA |
| Our fulfilment partner ShipAway (processor) | Storing, packing and shipping orders | Lithuania |
| Carriers (for example, LP Express and Omniva) | Delivering your parcel and sending you pickup codes | EU |
| Subscription management software provider (processor) | Managing subscriptions and the customer portal | EU or countries with adequate safeguards |
| Our accountant | Bookkeeping | Lithuania |
| Authorities and courts | When the law requires it | Lithuania / EU |
We never sell your personal data.
5. Transfers outside the EU/EEA
Some providers (for example, Klaviyo and some of Shopify's sub-processors) process data in the USA or Canada. For these transfers we rely on the European Commission's adequacy decisions (the EU-U.S. Data Privacy Framework for certified US companies; Canada) or on Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
6. Your rights
You have the right to access your data, to have it corrected or erased, to restrict its processing, and to data portability. You can object to processing based on our legitimate interest, and you can object to direct marketing at any time. Where we rely on consent, you can withdraw it at any time, as easily as you gave it: use the unsubscribe link in every email, or the cookie settings link on this website. Withdrawing consent doesn't affect processing carried out before you withdrew it.
Write to hello@takealora.com. We answer within one month. For complex requests we may extend this by two more months, and we will tell you why. We may ask you to confirm your identity.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Shopify's fraud tools may flag an order for us to review manually.
7. Complaints
You can lodge a complaint with the Lithuanian supervisory authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, +370 5 271 2804, vdai.lrv.lt, or with the supervisory authority in the EU country where you live or work. We'd appreciate the chance to put things right first: hello@takealora.com.
8. Cookies
We use strictly necessary cookies to run the store and the cart. Analytics and marketing cookies and pixels are used only if you accept them in the cookie banner. You can change your choice at any time through the cookie settings on this website. The cookie settings also show which cookies we use.
9. Age
Our products are for adults. We don't knowingly collect data from anyone under 18.
10. Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change materially affects how we use data you have already given us, we will tell you by email.