Last updated: 31 October 2026

Privacy policy

Who we are

krom.parts is an online shop for burner and boiler spare parts. The controller of your personal data is the legal entity named on the legal notice. You can reach us at info@krom.parts.

What we collect and why

Browsing the catalogue. Our server records the page requested, time, IP address, browser type and referring page in ordinary access logs. We use these to keep the site running, detect abuse and understand load. Logs are kept for 30 days.
Prices for your country. To show prices with or without VAT for your country, we look up the country of your IP address in a database kept on our own server — IP Geolocation by DB-IP (CC BY 4.0). The address is not sent anywhere and the country is not stored.
Language choice. A cookie remembers the language you picked, so we do not ask again. It holds no personal data.
Placing an order. When you order, we ask for your name, delivery address, e-mail, phone and company details if you buy as a business. We need these to perform the contract, deliver the goods, issue an invoice and meet tax and accounting obligations. Card details are entered on the payment provider's page and never reach our server.
Using the assistant. What you type into the parts assistant is sent to Anthropic, PBC (USA) so that its model can understand what part you are looking for. Under its commercial terms Anthropic does not use these texts to train its models. We keep the wording of a request, without any link to you, so that the same question is answered without asking the model again; the conversation itself stays in your session and disappears with it. Please do not type personal data into the assistant. You can use the catalogue and search without it.
Writing to us. If you e-mail or message us, we keep the correspondence for as long as needed to answer and, where it concerns an order, for the retention period of that order.

We do not use analytics trackers, advertising pixels or profiling. We do not sell or share personal data for marketing.

Legal bases

We are established in the European Union, so the General Data Protection Regulation (EU) 2016/679 covers everything described here, wherever you live. We rely on: performance of a contract (orders and enquiries); legal obligation (invoices, tax and accounting records); and legitimate interest (security logs, preventing fraud, keeping the site working). Where we ever need consent — for example for marketing — we will ask first and you can withdraw it at any time.

Who receives data

Our hosting provider (servers in the EU), the payment provider, and the carrier delivering your order — each only what they need for their part. A parcel going outside the European Union also means your name and address appear on the customs declaration. Where a recipient is outside the European Economic Area, transfers rely on an adequacy decision or on standard contractual clauses.

Paysera LT, UAB. For a card payment: your name, e-mail and the amount to pay. Card details are received only by Paysera.
Anthropic, PBC. For the parts assistant: the text of your messages to it, without your name or contact details.
Delivery service. SendParcel and the carriers it hands the parcel to: your name, address, phone and e-mail, to deliver the parcel and send you delivery notifications.

How long we keep it

Server logs — 30 days.
Order and invoice records — 10 years, as required by Lithuanian accounting and tax law.
Correspondence without an order — until the matter is closed, then no longer than 12 months.

Your rights

You can ask for a copy of your data, have it corrected or erased, restrict or object to processing, receive it in a portable form, and withdraw consent where the processing rests on it. Write to us at the address above; we answer within one month.

How to delete your account — in the app, on the site or by e-mail — is described on the page Deleting your account.

If you are unhappy with the answer, you may complain to our supervisory authority — the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) in Vilnius, vdai.lrv.lt — or to the supervisory authority of the country where you live.