Last updated: 3 September 2026

Previous version: 8 January 2026
This policy explains what personal data we collect, why, what our legal basis is, who we share it with, how long we keep it, and the rights you have. If you only want to know about cookies and tracking, see our Cookie Policy

.

1. Who we are

The controller of your personal data is:

Kūrinys sau, UAB, trading as Celsium Wellness
Company code 304375303
Gedimino pr. 20-20, LT-01103 Vilnius, Lithuania
Email: hello@celsiumwellness.com

“We”, “us” and “our” mean Kūrinys sau, UAB. This policy covers celsiumwellness.com and all its language versions, our email programme, and any form, quiz or checklist we publish.

We have not appointed a Data Protection Officer, because the nature and scale of what we do does not require one. Questions about your data go to the email address above and are answered by the people who run the business.

2. What we collect

2.1 Data you give us

• Email address, when you ask for a guide or checklist, subscribe, or contact us.
• Order and delivery details: name, billing and delivery address, phone number, and the contents of your order.
• The content of your messages, when you email us, use a contact or enquiry form, or reply to one of our emails.
• Country or region, where a form asks for it so we can send you rules that actually apply to you.

2.2 Data we collect automatically

• IP address, browser and device information, and approximate location derived from the IP address.
• Pages you view on our site, and when, including which links you click in our emails.
• How you use a page: where you click, how far you scroll and how you move through it, recorded as anonymised session recordings and heatmaps by Microsoft Clarity, with anything you type into a form masked. This runs only if you accept analytics cookies.
• Cookies and similar identifiers. What each one is and how long it lasts is in the Cookie Policy.
• Consent evidence. When you tick a consent box we record the time, your IP address, your browser user agent, which form you used and the wording it carried. We are required to be able to demonstrate your consent, and this is how we do it.

2.3 Data we ask you not to send us

We sell saunas and wellness rooms, and people sometimes tell us about a health condition when explaining what they need. Please do not send us health information. We do not ask for it, we do not need it to advise you, and we do not record it against your marketing profile. If you include it in a message anyway, we use it only to answer that message and we delete it on the retention schedule in section 8.

3. Why we use it, and our legal basis

We use a separate legal basis for each purpose, as set out below.

Purpose	Data used	Legal basis
Sending you a guide, checklist or other resource you asked for	Email address, consent evidence	Consent, Art 6(1)(a) GDPR
Marketing email: guides, planning and siting advice, product news and offers	Email address, country, engagement history	Consent, Art 6(1)(a) GDPR, and the ePrivacy rules as implemented in your country
Deciding which of our content to send you, based on what you click (see section 4)	Email and site engagement, country, interest tags	Consent, Art 6(1)(a) GDPR
Taking, fulfilling and delivering your order, and supporting you afterwards	Name, contact details, address, order contents	Performance of a contract, Art 6(1)(b) GDPR
Answering an enquiry that does not lead to an order	The message and your contact details	Legitimate interests, Art 6(1)(f): responding to someone who contacted us
Accounting, tax and statutory record keeping	Order and payment records	Legal obligation, Art 6(1)(c) GDPR
Analytics: understanding how the site is used so we can improve it	Cookies, IP address, pages viewed	Consent, given through the cookie banner
Session recordings and heatmaps, to see how pages are actually used and where they fail	Clicks, scrolling, mouse movement, pages viewed, device information	Consent, given through the cookie banner
Advertising and remarketing on Google and Meta	Cookies and advertising identifiers	Consent, given through the cookie banner
Protecting our forms from automated abuse	IP address, browser signals, reCAPTCHA score	Legitimate interests, Art 6(1)(f): keeping our systems and mailing list free of automated signups
Establishing, exercising or defending legal claims	Whatever is relevant to the claim	Legitimate interests, Art 6(1)(f)

Where we rely on legitimate interests we have considered whether our interest is outweighed by your rights, and concluded it is not. You can ask us for the reasoning behind any of those assessments, and you can object to processing based on legitimate interests at any time (section 9).

4. How we decide what to send you

We would rather send you one useful email than five irrelevant ones, so we pay attention to what you actually engage with.

What this means in practice. When you click a link in one of our emails, or visit certain pages on our site, we record that and use it to group you by the kind of thing you appear to be interested in, for example the practical side of planning and installation, design and materials, or the performance and recovery side. If you tell us your country, we use it so you get rules and delivery information that apply where you are. Nothing else is inferred, and no decision with a legal or similarly significant effect is ever made about you automatically.

This is profiling for direct marketing purposes, and you have an absolute right to object to it. No balancing test applies and we do not get to argue. Tell us and it stops, or unsubscribe and everything stops together. See section 9.

5. Marketing email, and how to stop it

We only send marketing email to people who asked for it. When you subscribe, we send you a confirmation email and you are not subscribed until you click the button in it. That step exists so that nobody can add your address but you.

Every marketing email we send carries a working unsubscribe link and identifies us as the sender. Unsubscribing takes one click, needs no login, and stops the whole programme including the profiling described in section 4. You can also email hello@celsiumwellness.com and ask us to stop.

Withdrawing your consent is as easy as giving it, and it does not affect anything we lawfully did before you withdrew.

6. Who else receives your data

We do not sell your personal data and we never will. We share it with the service providers below, who process it on our instructions under a written contract.

Who	What they do for us	Where they process
Omnisend (UAB Omnisend)	Sends our marketing email, stores our contact list and consent records, and records which of our emails and pages you engage with	EEA, with any transfer outside it covered by the safeguards in section 7
Google (Google Ireland Ltd and Google LLC)	Google Analytics, Google Ads including conversion measurement and remarketing, Google Tag Manager, reCAPTCHA on our forms, and YouTube where a video is embedded on a page	EU and USA
Microsoft (Microsoft Ireland Operations Ltd and Microsoft Corporation)	Microsoft Clarity: anonymised session recordings and heatmaps showing how pages are used	EU and USA
Meta (Meta Platforms Ireland Ltd)	Advertising and measurement through the Meta pixel	EU and USA
CookieYes (CookieYes Ltd)	Runs our cookie banner and records your cookie choices	UK and EEA
GTranslate (GTranslate Inc.)	Serves the translated language versions of this site. When you read a page in a language other than English, your request for that page passes through their servers	USA, under the safeguards in section 7
Bacloud (UAB Bacloud)	Hosts the website and its database	Lithuania
Payment providers: Stripe, PayPal, Montonio	Take and process payments, and prevent fraud at checkout. Bank transfer is also available. We never see or store your full card details	EU and USA
Shipping and logistics partners	Deliver your order	EU and the destination country
Our accountants and professional advisers	Accounting, tax and legal advice	EU

We may also disclose personal data where we are legally required to, for example to a public authority acting within its powers.

7. Transfers outside the EEA and the UK

Some of the providers above are established in, or process data in, the United States. Where personal data leaves the EEA or the UK we rely on one of the following safeguards:

• The EU-US Data Privacy Framework, and its UK extension, where the receiving company is certified under it. Google LLC, Meta Platforms, Inc. and Microsoft Corporation are certified.
• Standard Contractual Clauses approved by the European Commission, with the UK Addendum where UK data is involved, in every other case.

You can ask us for a copy of the safeguard relied on for any specific transfer by emailing hello@celsiumwellness.com.

8. How long we keep it

What	How long
Marketing contact record and engagement history	24 months from your last engagement with our emails or site, then deleted or anonymised. If you unsubscribe we stop immediately and delete on the same schedule
Consent evidence	For as long as we rely on the consent, and 3 years after it ends, so we can show the consent was valid if it is ever questioned
A suppression record of your email address, if you unsubscribe or ask for erasure	Kept indefinitely. This is the minimum needed to make sure we do not email you again by mistake, and it holds nothing but your address and the fact that you opted out
Order, invoice and payment records	For the period required by Lithuanian accounting and tax legislation
Enquiries and support correspondence that did not lead to an order	24 months from the last message
Website analytics data (Google Analytics)	No more than 14 months
Session recordings and heatmaps (Microsoft Clarity)	Recordings 30 days, heatmap data 13 months, as set by Microsoft
Cookie consent record	As stated in the Cookie Policy

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Rectification of anything inaccurate or incomplete.
• Erasure of your data, where one of the grounds in Art 17 applies.
• Restriction of processing in the circumstances set out in Art 18.
• Portability: receive the data you gave us in a machine-readable format, or have it sent to another controller.
• Object to processing based on our legitimate interests.
• Object to direct marketing, including the profiling described in section 4. This right is absolute, and we will stop as soon as you tell us.
• Withdraw your consent at any time, as easily as you gave it, without affecting the lawfulness of what we did before you withdrew it.

To exercise any of these, email hello@celsiumwellness.com. We answer within one month, and will tell you if we need longer because the request is complex. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to complain to a data protection supervisory authority. Ours is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, VDAI), vdai.lrv.lt. You may instead complain to the supervisory authority in the country where you live or work, for example the Data Protection Commission in Ireland or the Information Commissioner’s Office in the United Kingdom. We would rather you told us first so we can put it right, but you do not have to.

10. Is providing your data required?

Giving us your email address for marketing is entirely voluntary, and nothing stops you using the site if you do not. Order and delivery details are needed to perform the contract, so if you do not provide them we cannot fulfil an order.

11. Security

The site is served over HTTPS, access to our systems is limited to people who need it, and our providers are chosen partly on their security posture. No system is perfectly secure, and if a breach occurs that is likely to result in a high risk to your rights we will tell you and the supervisory authority as the GDPR requires.

12. Children

Our products and this site are intended for adults. We do not knowingly collect personal data from children. If you believe a child has given us their data, tell us and we will delete it.

13. Changes to this policy

We update this policy when what we do changes. The date at the top always tells you which version you are reading. Where a change materially affects how we use your data, we will tell subscribers by email rather than relying on you to re-read this page.

14. Contact us

Kūrinys sau, UAB, Gedimino pr. 20-20, LT-01103 Vilnius, Lithuania
hello@celsiumwellness.com