Privacy policy - Elanus Parts

Last updated: 5 September 2026

This Privacy Policy explains how UAB Elanus, trading as Elanus Parts ("Elanus Parts", "we", "us" or "our"), collects and uses personal data when you browse www.elanusparts.com, create an account, contact us, subscribe to marketing communications or purchase products.

1. Data controller and contact details

The data controller is:

Legal entity: UAB Elanus
Trading name: Elanus Parts
Company code: 303223851
VAT code: LT100012990914
Registered office: Laisvės pr. 91-68, Vilnius, Lithuania
Business and returns address: Raudondvario pl. 164, LT-47173 Kaunas, Lithuania
Email: info@elanusparts.com
Telephone: +370 620 15921

2. Personal data we collect

2.1 Information you provide

name, email address, telephone number and account credentials;
billing and delivery address, country, company and VAT details where applicable;
order contents, product preferences, returns, warranty and customer-service communications;
information entered in contact, compatibility request or other website forms;
newsletter subscription and marketing preferences;
payment method selection. Card and PayPal credentials are provided directly to the payment provider and are not stored by us.

2.2 Information collected automatically

IP address, browser, device, operating system, language, approximate location and technical identifiers;
session, security, cart, account, language and currency information;
pages visited, traffic source, timestamps and website interactions where Analytics consent is given;
advertising identifiers, campaign information, product and cart interactions, checkout activity and conversion events where Marketing consent is given;
anti-abuse signals and reCAPTCHA response tokens when protected forms are used;
server, security and diagnostic logs.

2.3 Information received from third parties

We may receive payment status and transaction identifiers from payment providers, delivery status from carriers, campaign or affiliate identifiers from advertising partners, and fraud or security signals from service providers.

3. Why we use personal data and our legal bases

On smaller screens, swipe sideways to view all columns.

Purpose	Data	Legal basis
Create and manage an account, cart and customer session	Account, session, device and cart data	Steps requested before entering a contract; performance of a contract; legitimate interests in providing and securing the shop
Process and deliver orders, returns, refunds and warranties	Identity, contact, order, delivery, invoice and communication data	Performance of a contract and compliance with legal obligations
Process payments and prevent payment fraud	Order amount, payment method, transaction status and identifier, security signals	Performance of a contract, compliance with legal obligations and legitimate interests in preventing fraud
Respond to enquiries and provide product compatibility or customer support	Contact details, message content, photographs or other information you choose to send	Steps requested before entering a contract, performance of a contract, or legitimate interests in customer support
Maintain security, diagnose faults and protect legal claims	IP address, device, session, server and diagnostic logs	Legitimate interests in operating a secure and reliable service and establishing, exercising or defending legal claims
Protect the contact form against spam, automated submissions and abuse using Security Pro and Google reCAPTCHA	IP address, browser and device information, page interactions, security and risk signals, and a reCAPTCHA response token	Legitimate interests in protecting the website, communications and users against spam, fraud and abuse
Comply with accounting, tax, consumer-protection and other legal requirements	Order, payment, invoice, return and communication data	Compliance with legal obligations
Measure and improve website usage with Google Analytics 4	Cookie identifiers, device and browser data, approximate location, pages and interactions	Consent for Analytics storage and measurement; limited cookieless consent signals are described below
Measure advertising, show relevant advertising and create campaign audiences through Google and Meta	Advertising and cookie identifiers, campaign data, page views and conversion events	Marketing consent
Measure OpenAI advertising performance and attribute product views, cart additions, checkout starts and completed orders to eligible ads	OpenAI browser and attribution identifiers, event ID and timestamp, page URL, browser information, product identifiers and names, quantity, amount and currency, SHA-256 hashed email address, and country, city, region and postal code where available	Marketing consent
Attribute eligible orders to an Avelon affiliate referral	Avelon click ID, payment transaction ID, currency, promo codes, product ID, name, category, quantity, price and reference	Marketing consent
Display Google Maps, Google Merchant Reviews, Trustpilot content, embedded YouTube videos and the SecurityMetrics certification badge	IP address, browser, device, page and interaction information	Marketing consent
Send newsletters and promotional communications	Email address, subscription status and communication interactions where measured	Consent, or another basis specifically permitted by applicable direct-marketing law; you may opt out at any time

Where we rely on legitimate interests, we assess whether the processing is necessary and whether your interests or fundamental rights override our interests. You may object to processing based on legitimate interests as described below.

4. Cookies, consent and Google Consent Mode

Our cookie banner offers separate Analytics and Marketing choices. Necessary technologies remain active. Your choice is stored in the first-party elanus_consent cookie for 180 days. You can change or withdraw your choice at any time through Cookie settings in the website footer. For details, see our Cookie Policy.

We use Google Consent Mode v2 in Advanced Mode. Before consent, Google storage signals are set to denied, so Google Analytics and advertising cookies must not be created. The Google tag may nevertheless send limited cookieless consent and measurement signals, which may include consent status, timestamp, page and device information and an IP address used for transmission. Google states that Analytics does not log or store IP addresses. Optional cookie-based Analytics and advertising processing is activated only after the relevant consent.

Embedded YouTube videos and the SecurityMetrics certification badge remain blocked unless Marketing consent is granted. Before consent, the website displays a local placeholder and does not load the relevant external iframe, script or image from those providers.

The OpenAI Ads Measurement Pixel is also blocked unless Marketing consent is granted. When Marketing consent is granted, the website may load the OpenAI Pixel and measure the events described below. If Marketing consent is refused or withdrawn, we do not send new OpenAI Ads measurement events, and the website attempts to remove the accessible __oppref first-party measurement cookie where technically possible.

The contact form is protected by Security Pro and Google reCAPTCHA. This security service is treated as a Necessary technology and is not controlled by the optional Analytics or Marketing choices. When the contact page or protected form is used, Google may receive technical and interaction information needed to assess whether the request is automated and may set the _GRECAPTCHA security cookie. The reCAPTCHA service is used for security and anti-abuse purposes, not by us for advertising.

5. OpenAI Ads measurement

With Marketing consent, we use the OpenAI Ads Measurement Pixel to measure a product page view (contents_viewed), a successful cart addition or quantity increase (items_added), the first start of checkout with a non-empty cart (checkout_started) and a completed order (order_created).

For a completed order, we may also send the same order_created event from our server through the OpenAI Ads Conversions API. The browser and server events use the same Pixel ID, event name and event identifier so that OpenAI can recognise them as the same conversion and avoid counting the order twice.

Depending on the event and the information available, OpenAI may receive an event identifier and timestamp, the event type, a page URL without its query string or fragment, browser user-agent information, the OpenAI-provided __oppref attribution identifier or __obref browser reference, product identifiers or references, product names, content type, quantity, order or event amount and currency. For completed-order matching, we may also provide the customer's normalised email address as a SHA-256 hash and the country, city, region and postal code from the order address. We do not send the raw email address through this integration.

OpenAI uses these signals to receive and match conversion events, attribute eligible activity to ads, report advertising performance and support advertising measurement. An event received by OpenAI is not necessarily attributed to an advertisement; attribution depends on the presence of an eligible advertising interaction and the applicable reporting rules.

6. Avelon affiliate tracking

When you arrive through an eligible Avelon affiliate link and have granted Marketing consent, we store an avln_cid attribution cookie for 30 days. For an eligible completed order, our server may send Avelon the click ID, payment transaction ID, currency, promotional codes and purchased product information. We do not include the customer's name, email address, telephone number or delivery address in the Avelon purchase payload.

If Marketing consent is refused or withdrawn, the Avelon attribution cookie is not created or is removed, and an order without the required consent is not reported through this integration.

7. Recipients and service providers

We disclose personal data only where necessary for the purposes described in this policy. Recipients may include:

hosting, website maintenance, security, email and other IT service providers;
payment providers, including PayPal and Braintree, and other payment methods selected at checkout;
banks, card networks and fraud-prevention providers involved in a transaction;
postal, courier, fulfilment and customs providers needed to deliver an order;
accounting, legal, audit and professional advisers;
public authorities where disclosure is required by law;
Google Ireland Limited for Analytics, advertising consent signals, Google Merchant Reviews, Google Maps, embedded YouTube videos and Google reCAPTCHA contact-form protection;
Meta Platforms Ireland Limited for Meta Pixel advertising measurement;
OpenAI for consent-based Ads Measurement Pixel and Conversions API measurement, conversion matching and advertising attribution;
Trustpilot A/S for the Trustpilot widget and review-related services;
SecurityMetrics, Inc. for the consent-controlled payment security certification badge;
Avelon for consent-based affiliate attribution and sale reporting;
newsletter management and email-delivery providers used for subscribed communications.

Payment providers process payment credentials under their own privacy notices. We receive information needed to confirm and administer the transaction, but we do not store full payment-card credentials.

8. International transfers

Some service providers or their group companies may process personal data outside Lithuania or the European Economic Area. Where Chapter V of the GDPR applies, we use or require an applicable transfer safeguard, such as an adequacy decision, the European Commission's Standard Contractual Clauses, approved binding corporate rules or another lawful transfer mechanism. You may contact us for information about the safeguards relevant to a particular provider.

Provider information:

9. Data retention

We retain personal data only for as long as necessary for the relevant purpose, including legal, accounting, tax, warranty, fraud-prevention and dispute requirements. Our principal retention periods are:

orders, invoices, payments and accounting records: for the statutory accounting and tax retention period, generally 10 years, or longer where required for an active dispute;
customer account: while the account remains active and until deletion is requested, except for data that must be retained for legal or contractual purposes;
customer-service and compatibility enquiries: normally up to 3 years after the matter is closed, unless linked to an order, warranty or dispute requiring longer retention;
newsletter subscription: until consent is withdrawn or the subscription is otherwise terminated; limited suppression information may be retained to respect the opt-out;
security and diagnostic logs: normally up to 30 days, unless needed to investigate an incident or protect legal claims;
Avelon attribution cookie: 30 days;
Avelon diagnostic log: 30 days under the configured module retention setting;
consent preference cookie: 180 days;
Google Analytics user-level and event-level data: up to 14 months under the configured Analytics retention setting;
OpenAI Ads measurement identifiers and event data: according to OpenAI's applicable retention controls and privacy notice; OpenAI cookie durations may be controlled by the provider and the browser;
other provider data: according to the provider's applicable retention controls and privacy notice.

When data is no longer required, we delete or anonymise it, unless continued retention is required or permitted by law.

10. Security

We use appropriate technical and organisational measures designed to protect personal data, including HTTPS encryption, access controls, security updates, restricted administration access and protected secrets. No internet transmission or storage system can be guaranteed to be completely secure.

11. Your rights

Subject to the conditions and exceptions in applicable law, you may:

request access to your personal data;
request correction of inaccurate or incomplete data;
request erasure of data;
request restriction of processing;
object to processing based on legitimate interests and to direct marketing at any time;
receive data you provided in a structured, commonly used and machine-readable format, and request portability where applicable;
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
lodge a complaint with a competent supervisory authority.

To exercise your rights, email info@elanusparts.com. We may request information needed to verify your identity. We normally respond within one month, subject to extensions allowed by law.

12. Supervisory authority

You may lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), L. Sapiegos str. 17, LT-10312 Vilnius, Lithuania, or through vdai.lrv.lt. If you live in another EEA country, you may also contact your local data-protection authority.

13. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you. Advertising providers may create audiences or profiles after Marketing consent, but Elanus Parts does not use that profiling to make legal or similarly significant decisions about customers.

14. Changes to this Privacy Policy

We may update this Privacy Policy when our processing, providers or legal obligations change. The current version and update date will be published on this page. Where required, we will provide an additional notice or request new consent.

15. Contact us

For privacy questions or requests, contact UAB Elanus at info@elanusparts.com, by telephone at +370 620 15921, or by post at Raudondvario pl. 164, LT-47173 Kaunas, Lithuania.