Privacy policy

Last updated: 14 August 2026

1. Controller

The controller of personal data relating to MCCM customers and website visitors is MB “Dermacode”, company registration number 307667138, VAT number LT100020345516, registered at Mindaugo g. 14B-104, LT-03225 Vilnius, Lithuania. Email: info@mccm.lt.

2. Personal data we process

Depending on how you use the store, we may process:

name, email address and telephone number;
delivery and billing address and selected parcel locker;
order contents, order number, return history and customer-service history;
payment method, payment status and limited transaction information; MCCM does not receive complete card details;
customer account and login information;
correspondence, chat messages and enquiries;
reviews and information connected with submitting them;
newsletter, marketing and cookie-consent choices;
IP address, device, browser, website-usage, security and cookie information;
information about interactions with the store, Shopify and enabled applications.

3. Sources

We obtain data directly from you when you order, create an account, contact us, submit a review or choose marketing; automatically from your device when you use the website; and from Shopify, payment providers, delivery services, review services, marketing services and other active integrations.

4. Purposes and legal bases

We process data:

to accept and fulfil orders, administer payments, deliver goods, manage returns and provide customer service — performance of a contract;
for invoicing, accounting, tax, consumer-protection and other legal obligations — compliance with legal obligations;
to prevent fraud, abuse and security incidents — legitimate interests and, where applicable, legal obligations;
to operate and improve the store, its performance and customer experience — legitimate interests or consent, depending on the technology;
for newsletters and direct marketing — consent or another basis permitted by applicable law;
for personalisation, analytics and advertising — consent where required.

5. Recipients and service providers

We disclose data only to the extent needed for the relevant service:

Shopify — ecommerce platform, hosting, checkout, accounts, security, analytics and Enhanced Services;
Shopify Payments — payment processing;
Shopify Inbox — customer chat;
Parcely.app — delivery and parcel-locker selection;
Omniva, DPD, Venipak and LP Express — delivery;
Judge.me — product reviews and related analytics;
Omnisend — newsletters, marketing consent management and marketing analytics;
professional advisers or public authorities where necessary to comply with a legal obligation or establish, exercise or defend a legal claim.

A provider may act as a processor, independent controller or joint controller depending on the service and applicable contractual terms.

6. Shopify Network Intelligence

Shopify Network Intelligence is enabled. Shopify may use information about interactions with MCCM, Shopify and other Shopify merchants to provide Enhanced Services, including security, fraud prevention, analytics, personalisation and, where the necessary consent exists, advertising.

Further information is available in the Shopify Consumer Privacy Policy and privacy portal.

7. Cookies and tracking technologies

Shopify’s automated cookie-consent banner is enabled for visitors in Lithuania.

The store uses:

essential Shopify cookies required for the store, cart, checkout, security and language selection;
functional cookies and similar technologies needed for enabled website functions;
analytics technologies associated with Shopify and Judge.me;
marketing and analytics technologies associated with Omnisend;
Shopify Network Intelligence technologies where permitted by your choices and applicable law.

Where consent is required, non-essential analytics, personalisation or marketing technologies are used in accordance with your cookie choice. You can change or withdraw consent at any time through the Cookie preferences control in the website footer.

8. International transfers

Some service providers may process data outside the European Economic Area. Where this occurs, safeguards recognised by applicable law are used, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

Shopify currently identifies the store’s primary data-hosting location as the European Union. This does not mean that every processing activity carried out by every provider occurs only within the EU.

9. Retention

We retain data only for as long as necessary to fulfil orders and contractual obligations; comply with accounting, tax and other legal obligations; administer claims, guarantees and disputes; ensure security and prevent fraud; or until consent is withdrawn where processing is based on consent, unless another legal basis requires continued retention.

The period depends on the data category, applicable legal obligations and limitation periods.

10. Your rights

Where applicable, you have the right to access your personal data, correct inaccurate data, request erasure, restrict processing, object to processing based on legitimate interests, receive portable data, withdraw consent at any time without affecting processing carried out before withdrawal, and lodge a complaint with a supervisory authority.

Send requests to info@mccm.lt. We may request information reasonably necessary to verify your identity.

The Lithuanian supervisory authority is:

State Data Protection Inspectorate
L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
https://vdai.lrv.lt/

11. Security

We use reasonable organisational and technical safeguards. No electronic transmission or storage method can guarantee absolute security.

12. Changes

We may update this Policy when the store’s operations, providers or applicable law change. The latest version and its revision date will be published on this page.