I. DEFINITIONS:

1. Seller – state enterprise of the Republic of Lithuania „Registrų centras", private legal entity MB „VP Baltic" registered at the Vilnius branch of the Register of Legal Entities, legal entity code 306205417, VAT payer code LT100015589019, business address Parko g. 16, Matiškė, Trakų raj.

2. MB "VP Baltic" – the company operating the online store at gama.ee.

3. Buyer – 1) a legally capable natural person, i.e. a person who has reached the age of majority whose legal capacity has not been restricted by court order; 2) a minor between the ages of fourteen and eighteen who has the consent of parents or guardians, except in cases of emancipation; 3) a legal entity; 4) duly authorised representatives of all the above-mentioned persons.

4. Seller's Partner – a legal entity: 1) selling goods or providing services on gama.ee, as well as a legal entity engaged to fulfil the Buyer's order; 2) with whom joint promotions or projects are carried out in the gama.ee online store, on the internet pages of such legal entity, or in any media where the gama.ee and such legal entity's promotion or project will be described or published.

5. Account – the result of the Buyer's registration on gama.ee, which creates an account storing their personal data and order history.

6. gama.ee accounts – the gama.ee accounts on Facebook, Twitter, LinkedIn and other social networks providing information about gama.ee and the Services offered, as well as sharing content published by Buyers.

7. Services – all services provided by gama.ee to the Buyer.

8. Cookie – a small file sent to a device when any person visits gama.ee. This term covers not only cookies but also the use of similar tools.

9. Password – a unique combination of letters and numbers created by the Buyer and known only to them, entered for the first time when registering on gama.ee, and subsequently to log into the Account.

10. Browser – a programme for displaying web pages on the internet or on a personal computer.

11. Personal data – any information relating to a natural person – the data subject – whose identity is known or can be directly or indirectly established using data such as a personal identification number, one or more characteristics specific to the physical, physiological, psychological, economic, cultural or social identity of that person.

12. Personal data controller – gama.ee.

13. Privacy Policy – this document, which sets out the main rules for the collection, accumulation, processing and storage of personal data when using gama.ee.

14. Administrator – the person responsible for the marketing of gama.ee.

15. IP address – a unique number assigned to each computer connected to the internet, known as an Internet Protocol (IP) address. Since these numbers are usually assigned by country blocks, an IP address can often be used to identify the country in which the computer connects to the internet.

16. Rules – the approved and valid "Rules for the Purchase and Sale of Goods in the gama.ee Online Store".

17. Direct marketing – an activity aimed at offering goods or services to individuals by post, telephone or other direct means and/or soliciting their opinion on the goods or services offered.

II. GENERAL PROVISIONS

18. The gama.ee Privacy Policy sets out the main rules for the collection, accumulation and processing of the Buyer's personal data when using the Services offered by gama.ee.

19. The Privacy Policy is intended to protect and defend the personal data of gama.ee Buyers from unlawful use. The Privacy Policy also applies to gama.ee Accounts.

20. The Buyer is considered to have read and familiarised themselves with this Privacy Policy when they express consent to the processing of their personal data.

The Privacy Policy can be accessed and printed at any time on gama.ee. Buyers will always be informed of any future changes and/or additions to the Privacy Policy by publishing the new version of the Privacy Policy on gama.ee and providing Buyers with the technical ability to read and confirm the new version of the Privacy Policy upon their first connection to gama.ee after the new version is published.

22. Buyers should note that gama.ee contains links to websites of other persons, companies or organisations, and that the Seller is not responsible for the content of such websites and/or the privacy policy methods they use. Therefore, before providing personal information, the Buyer should familiarise themselves with the rules, Privacy Policy and other documents of the relevant website.

23. The Buyer may make purchases on gama.ee both with and without registration. An unregistered Buyer is required to provide the following personal data: name, surname, phone number, email address, delivery address. The Buyer is responsible for providing their personal data.

24. Persons wishing to register on gama.ee must provide their email address and a chosen password. An Account is created during registration. In the Account, the Buyer enters their own data – name, surname, gender, date of birth, phone number, email address – and is therefore solely responsible for the accuracy of this data. The Buyer is assigned a User ID. The Buyer may at any time:

24.1. edit and/or supplement personal data in the Account. The Buyer is responsible for the accuracy of edited and/or supplemented data;

24.2. contact gama.ee at the email address info@gama.ee regarding the deletion of the Account.

25. gama.ee requires the Buyer to provide a personal identification number only when the Buyer orders goods from gama.ee or Seller's partners on an instalment basis, as well as when purchasing additional services requiring the provision of a personal identification number (e.g. goods insurance, extension of product warranty).

III. PROCEDURE FOR STORING AND USING PERSONAL DATA

26. The Buyer agrees that their name, surname, email address, phone number and IP address may be processed by gama.ee for business analysis purposes. Accordingly, gama.ee grants the Buyer the right, when registering on gama.ee or placing an order, to express their consent or objection to the processing of their name, surname, email address, phone number and IP address also for direct marketing purposes.

27. If after purchasing goods and/or services the Buyer does not wish the personal data specified in point 26 to be used for direct marketing or business analysis purposes, the Buyer must log into their Account on gama.ee and, in the Account window, uncheck the box next to the statement "News by email" and/or "News SMS/Viber", and click the "Update" link. In all cases the Buyer may also write an email to info@gama.ee or call the general gama.ee customer consultation phone +370 601 55255 and indicate that they do not wish to receive emails and/or SMS/Viber messages. The sending of emails and/or SMS/Viber messages is stopped only for the email addresses and/or phone numbers clearly listed by the Buyer.

28. The Seller confirms that the personal data provided by the Buyer will be processed solely for the purpose of properly providing the services of the gama.ee online store to Buyers (including the right to participate in promotions and projects). The Seller also confirms that the personal data provided by the Buyer will be processed for the purposes of the Seller's business analysis and direct marketing, if the Buyer grants and does not withdraw such consent. The retention period for personal data used for direct marketing purposes is set at three calendar years from the moment such data is provided.

29. The Seller undertakes not to disclose the Buyer's personal data to third parties, except in the following cases:

29.1. if the Buyer has consented to the disclosure of personal data;

29.2. when fulfilling an order or providing other services – to the Seller's partners providing goods delivery or other services ordered by the Buyer;

29.3. for direct marketing purposes – to the Seller's partners, subject to the condition set out in point 29.1 of the Privacy Policy and upon gama.ee ensuring written commitments by the Seller's partners to comply with the provisions of the Law of the Republic of Lithuania on Legal Protection of Personal Data;

29.4. to law enforcement authorities in accordance with the procedure established by the legislation of the Republic of Lithuania;

29.5. if necessary to prevent or investigate criminal acts.

30. The Buyer has the following rights:

30.1. upon submitting a written request to the Seller, to familiarise themselves with the personal data held by the Seller. Information is provided to the Buyer at the email address they have specified;

30.2. upon submitting a written request to the Seller, to receive information on the sources and types of personal data collected, the purposes for which they are processed, and the data recipients to whom they have been provided within at least the last 1 (one) year. Information is provided to the Buyer at the email address they have specified;

30.3. upon submitting a written request to the Seller at email address info@gama.ee, phone +370 601 55255, to demand deletion of the Account or suspension of personal data processing activities when personal data is being processed in violation of the provisions of the Law on Legal Protection of Personal Data and other laws, except in cases provided for in the Privacy Policy;

30.4. disagreeing with the Privacy Policy, to object to the processing of their personal data. In such a case, the Buyer will not be able to purchase goods and/or services in the gama.ee online store;

30.5. both by expressing their objection immediately and by submitting a subsequent notice in the manner provided for in point 27 of the Privacy Policy, to object to the processing of their personal data for direct marketing purposes.

31. When collecting goods, the identity document presented to the Seller, an employee of the joint-stock company Lietuvos paštas, a courier service employee or a goods collection centre employee for inspection, and the Buyer's data contained therein, are used solely for proper identification of the person.

32. By agreeing to this Privacy Policy, the Buyer agrees that their personal data will be used to fulfil their order, regardless of whether they order goods and/or services from gama.ee as the seller or from Partners as defined in point 4 of the Privacy Policy, including agreeing that their personal data will be transferred to the Seller's partners as defined in point 4 of the Privacy Policy, and also processed by the Seller or its appointed data processor for the purposes of order fulfilment business analysis.

33. The Buyer's personal data is transferred to the member states of the European Union or to other foreign countries under the same conditions and in the same manner as to entities located in the Republic of Lithuania, and only for the purposes set out in this Privacy Policy.

34. The Seller retains personal data for as long as the person uses the services of gama.ee, except in cases specified in this Privacy Policy. After the deletion of the Account, in order to fulfil the requirements set out in point 38 of the Privacy Policy, the Buyer's personal data may be stored on the personal data controller's server for up to six months, except in the cases specified in point 38 of the Privacy Policy and lawful requirements of law enforcement authorities to retain them.

35. Through internal organisational and technical measures, the Seller ensures that personal data provided by the Buyer on gama.ee is protected against any unlawful actions: unlawful alteration, disclosure or destruction of personal data, identity theft, fraud, and that the level of personal data protection meets the requirements of the legislation of the Republic of Lithuania.

36. Personal data is protected against loss, unauthorised use and alteration. All Buyer passwords are encrypted; only persons authorised by the personal data controller may access servers related to personal data, and only through a secure certificate additionally protected by a password. All gama.ee pages requiring the entry of personal data are operated via the https:// protocol.

37. The Buyer undertakes and must keep their gama.ee password, username and other data secure. The Buyer undertakes and must not disclose personal data about themselves or about third parties to any other third parties if such third party personal data became accessible to them, and must immediately inform the Seller of any visible violations.

38. The Buyer agrees in advance that the Seller has the right to store their personal data on the server for as long as is necessary given the specifics of gama.ee's activities, if the data provided by the Buyer was (i) used in carrying out an unlawful act, or (ii) there was suspicion of identity theft or another violation that was or will be investigated by the relevant law enforcement authorities, (iii) if the Seller has received complaints relating to the relevant Buyer, or if the Seller has detected violations of the Rules committed by the relevant Buyer, or (iv) for other legitimate purposes of retaining personal data. Such data is destroyed upon receipt of lawful instructions from law enforcement or other authorised bodies.

39. Any request or instruction related to the processing of personal data must be submitted by the Buyer to the Seller in writing in one of the following ways: 1) by delivering such request or instruction to the Seller directly at Parko g. 16, Matiškė, 25100, Trakų raj., 2) by sending such request or instruction to the email address info@gama.ee from the Buyer's email address specified in point 26 of the Privacy Policy. Upon receiving such a request or instruction from the Buyer, the Seller shall provide the Buyer with a response no later than within 30 (thirty) calendar days and carry out the actions specified in the request or refuse to do so. At the Buyer's request, the response must be provided in writing.

40. When administering gama.ee and diagnosing possible faults, the Administrator may use Buyers' IP addresses.

IV. CORRECTION, SUPPLEMENTATION AND DELETION OF PERSONAL DATA

41. The Buyer grants gama.ee the right to collect, manage, process and store the Buyer's personal data to the extent and for the purposes set out in the Privacy Policy and other gama.ee documents.

42. The granting or withdrawal of consent to collect, manage, process and store the Buyer's personal data applies only prospectively. Upon receiving such notification from the Buyer by email or by other means provided for in the Privacy Policy, gama.ee shall immediately cease processing the Buyer's personal data and delete their Account. However, this does not mean that gama.ee must delete from the server/destroy personal data if it has a legitimate basis for retaining them, particularly when necessary to ensure national security and defence, public order, prevention, investigation, detection or prosecution of crimes, protection of important state economic or financial interests, and protection of the rights and freedoms of other persons.

43. The Buyer has the right to access their personal data by presenting gama.ee with an identity document (to confirm identity, a Lithuanian Republic citizen's passport, Lithuanian Republic passport, identity card or driving licence must be presented). To find out what personal data gama.ee has collected or received and from what sources, for what purposes it is processed, to what recipients it has been and is provided, or whether all the Buyer's personal data is complete and accurate, the Buyer must contact gama.ee in advance at the email address specified in this Privacy Policy. Upon receiving such a query from the Buyer, gama.ee shall respond as to whether personal data relating to the Buyer is being processed and provide the requested data no later than within 30 (thirty) calendar days from the date of receipt of the Buyer's inquiry. Under this provision, data is provided free of charge once per calendar year.

44. If, upon reviewing their personal data, the Buyer determines that personal data has been collected or received from unlawful sources, or that personal data is being processed for purposes other than those for which it was provided, the Buyer has the right to contact gama.ee by email requesting suspension of the processing of such personal data. A Buyer who uses gama.ee without registration and receives a response from gama.ee in which they notice inaccuracies or errors in their personal data has the right to request that their personal data be corrected and updated as soon as possible, but no later than within 5 (five) business days. A Buyer who uses gama.ee after registration corrects personal data themselves by logging into their Account. gama.ee has the right to correct, supplement, delete personal data or suspend personal data processing activities only after identifying the Buyer who has applied.

45. If gama.ee doubts the accuracy of the personal data provided by the Buyer, it may suspend the processing of this Buyer's personal data, verify and clarify the data. Such personal data is used solely to verify its accuracy.

46. To exercise the above-mentioned rights, the Buyer may contact gama.ee at the email address info@gama.ee.

V. COLLECTION AND STORAGE OF PERSONAL DATA

47. In order to provide the Buyer with full services of the gama.ee online store, Cookies may be recorded on the Buyer's computer (device). The Seller uses the recorded information to recognise the Buyer as a previous visitor of the gama.ee online store, to save information about items added to the Buyer's shopping cart, and to collect visit statistics for the gama.ee online store. The Buyer has the ability to view what information (Cookies) the Seller or its Partners record and may delete some or all recorded Cookies. By confirming the Privacy Policy, the Buyer agrees that the Cookies provided for in this Privacy Policy may be recorded on their computer (device). The Buyer may revoke this consent at any time by changing their internet browser settings, but in such a case certain functions of the gama.ee online store may not work for them. The Buyer must personally inquire about the Cookies used by the Seller's Partners.

Cookies are intended for transmitting information over an electronic communications network. Using browser settings, you can delete or block all or some of these Cookies, but in such a case some functions of the gama.ee website may not work.

The second type of Cookies is intended to collect information for calculating visitor numbers (collecting statistical information), providing content matching Buyers' interests and saving browsing history. gama.ee does not use this type of Cookies, but draws Buyers' attention to the fact that some gama.ee Partners may use this type of Cookies. Therefore, a Buyer who suspects that this type of Cookies is being used without their consent should contact the specific gama.ee Partner.

VI. FINAL PROVISIONS

49. This Privacy Policy comes into force on 2 January 2026. Any changes to the Privacy Policy will be communicated in the manner provided for in point 20 of this Privacy Policy.