Last updated: 11 September 2026
Privacy policy
Who we are
krom is an online shop for burner and boiler spare parts. The controller of your personal data is the legal entity named on the legal notice. You can reach us at info@krom.parts.
What we collect and why
- Browsing the catalogue. Our server records the page requested, time, IP address, browser type and referring page in ordinary access logs. We use these to keep the site running, detect abuse and understand load. Logs are kept for 30 days.
- Language choice. A cookie remembers the language you picked, so we do not ask again. It holds no personal data.
- Placing an order. When ordering becomes available we will ask for your name, delivery address, e-mail, phone and company details if you buy as a business. We need these to perform the contract, deliver the goods, issue an invoice and meet tax and accounting obligations. Payment details are taken by the payment provider and never reach our server.
- Writing to us. If you e-mail or message us, we keep the correspondence for as long as needed to answer and, where it concerns an order, for the retention period of that order.
We do not use analytics trackers, advertising pixels or profiling. We do not sell or share personal data for marketing.
Legal bases
We are established in the European Union, so the General Data Protection Regulation (EU) 2016/679 covers everything described here, wherever you live. We rely on: performance of a contract (orders and enquiries); legal obligation (invoices, tax and accounting records); and legitimate interest (security logs, preventing fraud, keeping the site working). Where we ever need consent — for example for marketing — we will ask first and you can withdraw it at any time.
Who receives data
Our hosting provider (servers in the EU), the payment provider, and the carrier delivering your order — each only what they need for their part. A parcel going outside the European Union also means your name and address appear on the customs declaration. Where a recipient is outside the European Economic Area, transfers rely on an adequacy decision or on standard contractual clauses.
How long we keep it
- Server logs — 30 days.
- Order and invoice records — 10 years, as required by Lithuanian accounting and tax law.
- Correspondence without an order — until the matter is closed, then no longer than 12 months.
Your rights
You can ask for a copy of your data, have it corrected or erased, restrict or object to processing, receive it in a portable form, and withdraw consent where the processing rests on it. Write to us at the address above; we answer within one month.
If you are unhappy with the answer, you may complain to our supervisory authority — the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) in Vilnius, vdai.lrv.lt — or to the supervisory authority of the country where you live.
Cookies
Only strictly necessary cookies are used. They are listed on the cookie policy page.
Changes
If this policy changes, the new version appears here with the date above. Material changes that affect you will be announced on the site.