Privacy

Controller

The controller of the personal data described in this policy is:

UAB Candless
Company code 306766457
Šilutės pl. 35G-36, LT-94105 Klaipėda, Lithuania

Processing of personal data

Enquiries and correspondence

Data: name, email address and the content of the message, including any personal details the sender chooses to share. Purpose: replying to the enquiry and agreeing the configuration of a Work through Guidance. Legal basis: steps taken at the request of the data subject before entering into a contract (Article 6(1)(b) GDPR). Retention: one year after the last message, if no order follows. The correspondence is not disclosed to anyone other than the processors listed below.

Orders

Data: name, address, email address, phone number, the agreed configuration, invoices and payment details. This data is required; without it, the Work cannot be made or delivered. Legal basis: performance of the contract (Article 6(1)(b) GDPR) and, for invoices and accounting records, a legal obligation (Article 6(1)(c) GDPR). Retention: 10 years, including the correspondence in which the configuration was agreed — the period required for accounting records and the general limitation period for contractual claims under Lithuanian law.

Where a Work is delivered to another person, the buyer provides that person’s name and address and, where needed for delivery, their phone number or email address. Purpose: delivery. Legal basis: legitimate interest in delivering as the buyer requests (Article 6(1)(f) GDPR). Retention: with the order records. Recipients have the same rights as buyers.

The registry

Each completed Work is entered in the public registry under the Player’s ID — an identifier chosen by the buyer and engraved on the Work — with the year of creation, the name of the Blank and an image identifying the object. All Works under one ID are shown together on the Player’s profile. The registry contains no contact details, and no names unless a buyer uses their own name as the ID. The link between an ID and its holder is kept separately, is accessible only to UAB Candless and is used solely to confirm the authenticity and history of the Work. Images used elsewhere — on the website, social media and in advertising — never show the buyer’s name or other personal data; where they show the Player’s ID, this is based on the legitimate interest in presenting the Works (Article 6(1)(f) GDPR), and an objection may be made at any time. A Player’s ID may also appear in other entries as the first author of a form realised again.

Legal basis: creating the entry, including its image, forms part of the contract (Article 6(1)(b) GDPR); keeping it is based on the legitimate interest in maintaining a record of provenance (Article 6(1)(f) GDPR). Retention: for as long as the registry is maintained; the link between an ID and its holder, for as long as the corresponding entry exists. If the Seller’s business is transferred, the registry, together with the link between IDs and their holders, may be transferred to its successor. An objection or a request for erasure may be made under Articles 17 and 21 GDPR. Where it is upheld, the entry itself is kept, but the link between the Player’s ID and the identity of its holder is deleted from internal records; where the Player’s ID is the holder’s own name, it is replaced with a neutral reference in the registry, including in other entries where it appears. The same link also appears in invoices, which are kept for the statutory accounting period and used only for accounting; once that period ends, the entry becomes anonymous. Where an objection is not upheld, the reasons are given in reply. Requests are made to hello@candless.art, identifying the Player’s ID and the Work where possible; copies in backups may remain for a limited time where technically necessary.

Website visits

Data: IP address, browser type and time of access, recorded by the hosting provider. Purpose: operation and security of the website. Legal basis: legitimate interest (Article 6(1)(f) GDPR). Retention: up to 7 days, after which the hosting provider deletes them automatically.

Subject to consent given in the cookie banner (Article 6(1)(a) GDPR):

Google Analytics, Google Ireland Limited — website usage statistics;
Meta Pixel, Meta Platforms Ireland Limited — measurement of advertising.

These services are not loaded before consent is given. Consent may be changed or withdrawn at any time through the cookie settings, available on every page of the website, and is recorded with Complianz on the website; withdrawal does not affect processing carried out before it. Individual cookies are listed in the Cookie Policy (https://candless.art/cookie-policy).

Meta and Instagram

For data collected through Meta Pixel and for interactions with the Instagram accounts candless.subject and candless.object, UAB Candless and Meta Platforms Ireland Limited are joint controllers. Meta is responsible for its further processing and for handling requests concerning the data it processes; the arrangement is available on Meta’s website (https://www.facebook.com/legal/controller_addendum), and Meta’s privacy policy on the Instagram website (https://help.instagram.com/519522125107875).

Recipients and transfers

Personal data is disclosed only as needed for the purposes above, to: Hostinger International Limited (hosting), Google Ireland Limited and Meta Platforms Ireland Limited (analytics and advertising, subject to consent), DHL Express or another courier (delivery), Revolut Bank UAB (payments) and the accountant (bookkeeping, under a data processing agreement). Personal data is not sold and is disclosed to others only where required by law. Google and Meta may transfer data to the United States under the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses. For delivery outside the European Economic Area, the recipient’s delivery details are transferred to the destination country as necessary to perform the contract (Article 49(1)(b) GDPR) or, where the Work is a gift, a contract concluded in the recipient’s interest (Article 49(1)(c) GDPR).

Rights of the data subject

The data subject may request access to their data, its rectification or erasure, restriction of processing and data portability, may object to processing and may withdraw consent at any time. Requests are sent to hello@candless.art and answered within one month. UAB Candless may ask the requester to confirm their identity, for example by writing from the email address used for the order or by giving the invoice number. No automated decision-making or profiling is carried out. Complaints may be lodged with the State Data Protection Inspectorate of Lithuania (https://vdai.lrv.lt) or with the supervisory authority of the country of residence (list of authorities: https://www.edpb.europa.eu/about-edpb/our-members_en).

Other

Works are sold only to persons aged 18 and over; personal data of anyone younger, if discovered, is deleted without delay unless the law requires otherwise. This policy was last updated on 1 October 2026.