Privacy Policy

Last updated: 1 October 2026

This Privacy Policy explains how personal data is processed when you visit cosmo-tech.eu, contact us or buy equipment from us. We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR") and the laws of the Republic of Lithuania.

1. Who is responsible for your data

The data controller is:

UAB "Trelis", trading as COSMO TECH
Company code: 304435177
VAT code: LT100011882412
Registered office: Darželio g. 5-118, LT-11209 Vilnius, Lithuania
Showroom: Juozapavičiaus g. 9A, LT-09311 Vilnius, Lithuania
Email: info@cosmo-tech.eu
Phone: +370 638 64182

We have not appointed a Data Protection Officer, as this is not required for our activities. For any question about your personal data, write to info@cosmo-tech.eu.

2. What data we process

Enquiry data — your name, phone number, email, company or clinic name, country, the equipment you are interested in and the content of your message, when you fill in a form on the website.
Messenger communications — your phone number or username, profile name and message content, when you contact us through WhatsApp or Telegram.
Customer and contract data — company details, contact persons, billing and delivery addresses, order history, payment information, warranty and service records.
Website usage data — IP address, device and browser type, pages viewed, referring website, clicks and other interactions, approximate location. Analytics and advertising data is collected only with your consent (see our Cookie Policy).
Technical data — server logs and security data generated when the website is loaded.

We do not ask for and do not wish to receive special categories of personal data (such as health data) through the website or messengers.

3. Why we process your data and on what legal basis

Purpose	Legal basis (GDPR)
Answering your enquiry, preparing a quote, consulting on equipment	Art. 6(1)(b) — steps taken at your request before entering into a contract; where you act on behalf of a company, Art. 6(1)(f) — our legitimate interest in communicating with business customers
Concluding and performing the sales contract: delivery, installation, training, warranty and service	Art. 6(1)(b) — performance of a contract; Art. 6(1)(f) for contact persons of business customers
Invoicing, accounting and tax obligations	Art. 6(1)(c) — legal obligation under Lithuanian accounting and tax law
Website analytics and measuring advertising performance (Google tag)	Art. 6(1)(a) — your consent, which you can withdraw at any time
Sending information about similar equipment to existing customers	Art. 6(1)(f) — legitimate interest, in line with Article 69 of the Lithuanian Law on Electronic Communications; you can opt out at any time. Other marketing messages are sent only with your consent (Art. 6(1)(a))
Website security, preventing abuse, establishing and defending legal claims	Art. 6(1)(f) — legitimate interest

Providing data in a form is voluntary, but without contact details we cannot answer your enquiry. Data required for a contract and invoices is needed to conclude and perform the contract.

4. Who receives your data

We share data only to the extent needed for the purposes above:

Tilda Publishing — website platform that hosts the site and receives form submissions.
Google Ireland Limited — analytics and advertising measurement (Google tag), only with your consent.
WhatsApp Ireland Limited and Telegram — if you choose to contact us through these messengers. Their own privacy policies apply to your use of these services.
Hostinger — domain name registration and related services.
Carriers and logistics companies — to deliver equipment.
Accounting, IT and legal service providers, banks and payment providers.
Manufacturers and service engineers — where necessary to handle a warranty or service case.
Public authorities — where required by law.

Service providers acting on our behalf process data under data processing agreements and only on our instructions.

5. Transfers outside the European Economic Area

Some recipients may process data outside the EEA:

Google may transfer data to the United States. Google LLC is certified under the EU–US Data Privacy Framework, which the European Commission recognises as providing an adequate level of protection.
Tilda Publishing and Telegram may process data in countries for which there is no adequacy decision of the European Commission, which may include the Russian Federation and the United Arab Emirates.

Where there is no adequacy decision, we transfer data on the basis of the Standard Contractual Clauses adopted by the European Commission or, where these cannot be used, only where an exception under Article 49 GDPR applies — in particular where the transfer is necessary to answer your enquiry or perform a contract at your request. You can request more information about these safeguards at info@cosmo-tech.eu.

6. How long we keep your data

Enquiries that did not lead to a contract — 24 months from our last contact.
Contracts, invoices and accounting documents — 10 years, as required by Lithuanian accounting law.
Warranty and service records — for the warranty period and the applicable limitation period for claims.
Analytics data — up to 14 months; cookies — as described in the Cookie Policy.
Marketing contacts — until you opt out or withdraw consent.

After these periods the data is deleted or anonymised.

7. Your rights

Under the GDPR you have the right to:

access your personal data and receive a copy;
have inaccurate data corrected;
have your data erased, where there is no longer a basis for processing;
restrict processing;
receive your data in a portable format;
object to processing based on legitimate interest, and to direct marketing at any time;
withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise these rights, write to info@cosmo-tech.eu. We reply within one month. We may ask you to confirm your identity.

You also have the right to lodge a complaint with the supervisory authority — the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos g. 17, LT-10312 Vilnius, ada@ada.lt, vdai.lrv.lt — or with the authority in your country of residence.

8. Automated decisions

We do not make decisions that produce legal or similarly significant effects based solely on automated processing, including profiling.

9. Minors

The website is intended for professionals and businesses. We do not knowingly collect personal data of persons under 18.

10. Security

We use technical and organisational measures to protect personal data against loss, unauthorised access and misuse, including encrypted (HTTPS) connections and restricted access to customer data.

11. Changes to this policy

We may update this Privacy Policy. The current version is always available on this page, with the date of the last update shown at the top.