Privacy Policy

Last updated: 15 September 2026. Version 2.0.

This Privacy Policy explains how Le Microbiome MB collects, uses, shares and protects personal data when you visit lemicrobiome.com (the “Website”), create an account, place an order, contact us or subscribe to our communications.
We process personal data in accordance with Regulation (EU) 2016/679 (the “GDPR”) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.
Please read it together with our Cookie Policy and Terms & Conditions.

1. Data controller

The controller responsible for your personal data is:

Le Microbiome MB
Company code: 307682631
Registered office: Medeinės g. 7, Lentvaris, LT-25136 Trakų r., Lithuania
E-mail for privacy matters: care@lemicrobiome.com

We are not required to appoint a Data Protection Officer.
Any question or request concerning your personal data may be sent to the e-mail address above.

2. What personal data we collect, why, and on what legal basis

We collect only the data we need for the purposes below. Where a legal basis is “contract”, providing the data is necessary to conclude and perform your order; without it we cannot sell to you.

2.1. Orders and customer service

Data: name and surname, delivery and billing address, e-mail address, telephone number, order contents, order history, payment status and payment reference (never your full card number), delivery tracking data, and the content of any correspondence with us.
Purposes: to conclude and perform the sales contract, deliver Products, issue invoices, handle returns, withdrawals, complaints and guarantee claims, and answer your questions.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)); compliance with legal obligations in the fields of accounting, tax and consumer protection (Art. 6(1)(c)); our legitimate interest in defending legal claims (Art. 6(1)(f)).

2.2. User account

Data: name, e-mail address, password (stored in hashed form), saved addresses, order history, account activity.
Purposes: to provide the “My account” area, let you track orders and reorder, and keep your account secure. When you log in, cookies are set to keep you signed in and remember your screen preferences; if you request a password reset, the IP address from which the request was made is included in the reset e-mail as a security measure.
Legal basis: performance of a contract (Art. 6(1)(b)); our legitimate interest in Website security (Art. 6(1)(f)).

2.3. Payments

Payments are executed by our licensed payment service providers, Paysera LT, UAB (bank transfer and bank-link payments) and Stripe Payments Europe, Ltd. (card payments). When you pay, your payment details are entered directly into the provider’s secure environment; we receive only confirmation of payment, the amount, the last four digits of a card where applicable, and a transaction reference.
Each provider processes your data as an independent controller for the purpose of executing the payment and preventing fraud, under its own privacy policy (paysera.com and stripe.com/privacy).
Legal basis: performance of a contract (Art. 6(1)(b)); legal obligations relating to payment services and anti-money-laundering (Art. 6(1)(c)).

2.4. Delivery

To deliver your order we pass your name, delivery address, telephone number and e-mail address to the carrier you select at checkout (currently AB Lietuvos paštas / LP Express). The carrier uses these to deliver the parcel and to send you locker codes and delivery notifications.
Legal basis: performance of a contract (Art. 6(1)(b)).

2.5. Newsletter and marketing e-mails

Data: e-mail address, name (optional), the date and source of your subscription, and statistics on whether our e-mails are opened and which links are clicked.
Purposes: to send you news, offers and information about our Products.
Legal basis: your consent (Art. 6(1)(a)), given when you tick the newsletter box. Where you are an existing customer, we may send you information about our own similar Products on the basis of our legitimate interest (Art. 6(1)(f)) in accordance with Article 81 of the Law on Electronic Communications of the Republic of Lithuania; you were given the opportunity to object when your data were collected. You can unsubscribe at any time through the link in every e-mail or by writing to care@lemicrobiome.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

2.6. Website operation, security and analytics

Data: IP address, browser type and version, operating system, device type, referring page, pages visited, date and time of access, and cookie identifiers.
Purposes: to display the Website correctly, keep it secure (including detecting and blocking attacks and fraudulent orders), remember your language and currency selection, your cart contents, the products you have recently viewed and your cookie choices, and — only with your consent — measure how the Website is used so that we can improve it.
Legal basis: our legitimate interest in operating a secure and functional Website (Art. 6(1)(f)) for strictly necessary processing; your consent (Art. 6(1)(a)) for analytics cookies. Details of each cookie and how to withdraw consent are in our Cookie Policy.
Caching: to load pages faster, the Website stores temporary copies of its pages on our own server (LiteSpeed Cache). Cached copies never contain your personal account, cart or checkout data, are not shared with any third party, and expire automatically.

2.7. Online advertising

With your consent we use advertising and measurement technologies from Google (Google Ads and Google Analytics 4, operated by Google Ireland Limited) and from OpenAI (the OpenAI advertising pixel used for advertisements shown in ChatGPT, operated by OpenAI Ireland Ltd).
These tools use cookies and similar identifiers to measure whether an advertisement led to a visit or a purchase, to show you our advertisements on other services, and to build audiences of visitors with similar interests.
Where you have consented, the OpenAI pixel and Google Ads may also receive a hashed (irreversibly encoded) version of the e-mail address you enter at checkout in order to attribute conversions more accurately.
Legal basis: your consent (Art. 6(1)(a)), given through our cookie banner. If you do not consent, these tools are not loaded. For Google services we use Google Consent Mode, which means that without your consent Google receives only aggregated, cookieless signals that cannot identify you.

2.8. Contact forms and correspondence

Data: the name, e-mail address and any other information you include in a message to us.
Purposes: to answer your enquiry and keep a record of our communication.
Legal basis: our legitimate interest in responding to enquiries (Art. 6(1)(f)); performance of a contract where the enquiry relates to an order (Art. 6(1)(b)).

2.9. Product reviews

If you submit a review, we publish the name you provide and the content of your review.
We only publish reviews from customers whose purchase we can verify. To display a profile picture next to your review, an anonymised hash of your e-mail address is sent to the Gravatar service operated by Automattic Inc. (privacy policy: automattic.com/privacy); if you have no Gravatar profile, a generic image is shown. Blog comments are not enabled on the Website.
Legal basis: your consent (Art. 6(1)(a)); our legitimate interest in ensuring reviews are genuine, as required by consumer law (Art. 6(1)(f)).

3. Health-related information

We do not ask for, and ask you not to send us, information about your health, medical conditions or medication.
Our Products are food supplements, not medicines, and we cannot give medical advice.
If you nevertheless include such information in a message to us, we will use it only to answer your enquiry and will delete it as soon as the enquiry is closed, on the basis of your explicit consent implied by sending it to us (Art. 9(2)(a)).

4. Who we share personal data with

We never sell personal data. We share it only with the following categories of recipients, and only to the extent necessary:

• Payment service providers — Paysera LT, UAB (Lithuania) and Stripe Payments Europe, Ltd. (Ireland), acting as independent controllers.
• Delivery carriers — AB Lietuvos paštas / LP Express (Lithuania) and any other carrier offered at checkout, acting as independent controllers for the delivery.
• Hosting and e-mail infrastructure — Hostinger International Ltd. (Cyprus, with servers in the EU), acting as our processor.
• Newsletter and e-mail marketing platform — the provider named in our Cookie Policy and consent banner, acting as our processor.
• Analytics and advertising providers — Google Ireland Limited and OpenAI Ireland Ltd, only with your consent, as described in Sections 2.6 and 2.7 and in our Cookie Policy.
• Accounting, legal and IT service providers who assist us in running the business and are bound by confidentiality and data-processing agreements.
• Public authorities — the State Tax Inspectorate, courts, the State Consumer Rights Protection Authority or other bodies where the law requires us to disclose data or where necessary to establish, exercise or defend legal claims.

All processors act on our documented instructions under data-processing agreements that comply with GDPR Article 28.

5. International transfers

We store and process personal data within the European Economic Area (EEA). Some of our providers — in particular Google and OpenAI, and, for certain support functions, Stripe — have group companies in the United States and may transfer data there.
Such transfers take place only where the recipient is certified under the EU–US Data Privacy Framework or where we have concluded the European Commission’s Standard Contractual Clauses with the recipient and carried out a transfer-impact assessment.
You may request a copy of the relevant safeguards by writing to care@lemicrobiome.com.

6. How long we keep personal data

We keep personal data only for as long as necessary for the purpose for which it was collected, and thereafter for the period required by law or needed to defend legal claims:

• Order, invoice and payment records — 10 years from the end of the financial year in which the order was placed, as required by the Law on Financial Reporting by Undertakings and the Law on Tax Administration of the Republic of Lithuania.
• Guarantee, complaint and withdrawal correspondence — 3 years after the matter is closed, corresponding to the limitation period for consumer claims.
• User account — until you delete it or until 3 years of inactivity, after which we delete it; order records within the account are retained as above.
• Newsletter data — until you withdraw consent, or 3 years after your last interaction with our e-mails, whichever is earlier. Proof of your consent is kept for 1 year after withdrawal.
• General enquiries — 1 year after the last message.
• Server and security logs — up to 12 months.
• Cookie consent choices — stored only in a consent cookie on your own device for 12 months, after which we ask for your consent again; we do not keep a server-side log of individual choices.
• Cookies and analytics/advertising identifiers — the periods stated for each cookie in our Cookie Policy.

7. How we protect personal data

We apply technical and organisational measures appropriate to the risk, including TLS encryption of all traffic to the Website, encrypted storage of passwords, role-based access to order and customer data limited to our administrators and shop managers who need it to fulfil orders, process refunds and support you, two-factor authentication on administrative accounts, regular software updates and backups, and contractual confidentiality obligations for everyone who processes data on our behalf.
Payment card data never touch our systems. In the event of a personal-data breach that is likely to result in a high risk to you, we will notify you and the supervisory authority as required by GDPR Articles 33 and 34.

8. Your rights

Under the GDPR you have the right to:

• Access your personal data and receive a copy (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data where there is no longer a legal reason to keep it (Art. 17) — note that we must retain order and invoice records for the statutory period;
• Restrict processing in the circumstances set out in Art. 18;
• Data portability — receive the data you provided to us in a structured, machine-readable format (Art. 20);
• Object at any time to processing based on legitimate interests, and to direct marketing without any justification (Art. 21);
• Withdraw consent at any time where processing is based on consent, without affecting processing carried out before withdrawal (Art. 7(3));
• Not be subject to solely automated decisions producing legal or similarly significant effects (Art. 22). We do not make such decisions.

To exercise any right, e-mail care@lemicrobiome.com from the address linked to your order or account, or write to our registered office. We may ask you to confirm your identity where reasonably necessary.
We will respond within one month; this may be extended by two further months for complex requests, in which case we will tell you why.
Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

9. Complaints to the supervisory authority

If you believe that we have processed your personal data unlawfully, you have the right to lodge a complaint with the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania; tel. +370 5 271 2804; e-mail ada@ada.lt; website vdai.lrv.lt.
If you live in another EU Member State, you may instead complain to the supervisory authority of that State.
We would nevertheless appreciate the opportunity to address your concern first.

10. Children

The Website and our Products are intended for adults. We do not knowingly collect personal data from persons under 18.
If you believe a minor has provided us with personal data, please contact us and we will delete it.

11. Links to other websites

The Website may contain links to third-party websites, including the sites of our payment providers, carriers and social-media platforms. We are not responsible for their privacy practices.
Please review the privacy policy of any site you visit.

12. Changes to this Policy

We may update this Privacy Policy to reflect changes in our processing or in the law.
The current version, with its date and version number, is always available on this page. Where a change materially affects you — for example, a new purpose of processing — we will notify you by e-mail or by a notice on the Website before the change takes effect.

13. Contact

Le Microbiome MB
Medeinės g. 7, Lentvaris, LT-25136 Trakų r., Lithuania
E-mail: care@lemicrobiome.com