Effective from 2026-10-18

1. Who is responsible for your data

The data controller is Gabrielytė, UAB, company code 304689371, VAT code LT100011648016, registered address T. Ševčenkos g. 16A, 03111 Vilnius, Vilniaus m. sav. ("Pokito", "we", "us").

Restaurant address: T. Ševčenkos g. 16A, 03111 Vilnius, Vilniaus m. sav.. Phone +370 676 97929, email info@pokito.lt. Please use this email address for all questions about your personal data.

This policy explains what personal data we collect when you visit pokito.lt, place an order or contact us, why we use it and what rights you have under the General Data Protection Regulation (GDPR).

2. What data we collect

• Order data: your name, phone number, email address, the dishes you order, the pickup time you choose, your comments, the order total and its status.
• Account data (if you create an account): name, email, phone, password (stored only in encrypted form) and your order history.
• Technical data: your IP address and browser details, which are recorded with each order to prevent fraud, and server logs.
• Correspondence: your emails and calls when you contact us about an order or a complaint.

We do not collect payment card details: you pay at the restaurant when you collect your order (by card or in cash).

3. Why we use your data and on what legal basis

• To accept, prepare and hand over your order, and to send you emails about its status (confirmed, ready, rejected or cancelled) – performance of a contract (Art. 6(1)(b) GDPR).
• To manage your account – performance of a contract (Art. 6(1)(b) GDPR).
• For accounting and tax purposes – legal obligation (Art. 6(1)(c) GDPR).
• To handle complaints, prevent fraud and misuse, and keep the website secure – legitimate interest (Art. 6(1)(f) GDPR).
• To show the Google Maps map – your consent (Art. 6(1)(a) GDPR), see section 6.

We do not send marketing newsletters, we do not sell your data and we do not use it for automated decision-making or profiling.

4. How long we keep your data

• Orders that were started but never placed are deleted automatically after 24 hours.
• Data of placed orders and the related accounting records are kept as long as Lithuanian law requires (up to 10 years for accounting documents).
• Account data is kept while your account is active. We will delete your account on request; order data we are legally required to keep is retained until that period ends.
• Correspondence and complaints – up to 1 year after the matter is resolved.
• Server logs – no longer than 3 months.

5. Who receives your data

Only our staff who need your data to fulfil your order can see it. Your data is also processed by our service providers, who act on our instructions:

• Website hosting and email provider (Bluehost, Newfold Digital Inc.) – the website, its database and our emails are stored on their servers.
• Accounting service provider – only the data needed for accounting.

Some providers may process data outside the European Economic Area (for example in the USA). In that case data is transferred only with the safeguards required by the GDPR – a European Commission adequacy decision (such as the EU–U.S. Data Privacy Framework) or standard contractual clauses.

We share data with public authorities only when the law requires it.

6. Cookies and third-party content

Necessary cookies (the website cannot work without them, so no consent is needed):

• session and security cookies – for your cart, placing an order and signing in (they last until you close your browser or a few hours);
• pk_lang – your chosen language (1 year);
• pk_consent – your cookie choice (6 months).

The Google Maps map on the start page is loaded only with your consent ("Accept all" or "Show map"). Google Ireland Limited then receives your IP address and may set its own cookies under the Google Privacy Policy.

Fonts and icons are loaded from Google Fonts and cdnjs (Cloudflare), so these providers see your IP address; they do not set cookies.

We do not use analytics or advertising cookies. You can change your choice at any time with "Cookie settings" at the bottom of the website.

7. Your rights

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased ("right to be forgotten") when it is no longer needed or there is no legal basis to keep it;
• restrict the processing of your data;
• object to processing based on legitimate interest;
• receive your data in a structured, machine-readable format (data portability);
• withdraw your consent at any time (this does not affect processing carried out before you withdrew it).

Send your request to info@pokito.lt. We will reply within 1 month. We may need to confirm your identity.

If you believe your data is being processed unlawfully, you can lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, 10312 Vilnius, vdai.lrv.lt, ada@ada.lt). Please contact us first – we will do our best to help.

8. Data security

The website uses an encrypted HTTPS connection, passwords are stored only in encrypted form, and only authorised staff with personal logins can access orders.

9. Children

Alcoholic drinks are sold only to people aged 20 or over, energy drinks only to people aged 18 or over. We do not knowingly collect data from children under 14 without the consent of a parent or guardian.

10. Changes to this policy

We may update this policy. The current version is always published on this page, with its effective date at the top.