Privacy policy

Effective date: 4 November 2026

1. Who is responsible and how to contact us

VintageThing is a brand operated by Gabrielius Ramanauskas trading as HipBos, a UK sole-trader business, with orders and returns handled personally by the owner in Lithuania. We are responsible as a controller for the personal information we use to run this store, subject to the separate roles of service providers described below.

Contact: ask@vintagething.com.

Business correspondence: 62 Sandling Lane, Maidstone, ME14 2EA, United Kingdom.

Our goods-returns address is Ramuvos g. 18, Alytus, 62441, Lithuania. The owner handles order fulfilment and returns in Lithuania. Both addresses relate to the same named sole trader.

2. Information we use

Depending on how you interact with the store, information can include:

  • Contact and delivery information, such as name, email and delivery/billing address.
  • Order details, items purchased or returned, transaction references, delivery status and customer-service communications.
  • Account information, where you choose to use an account, and communications or marketing preferences.
  • Technical information, such as IP address, device/browser information, pages viewed and interactions, subject to the relevant consent and privacy settings.

Information can come from you, from your use of the store, and from providers involved in payment, delivery, security and store operations. Payment providers process payment details according to their own roles and policies. This notice does not promise that all payment data is held directly by us or is deleted immediately when a purchase finishes.

3. Purposes and legal grounds

We identify the appropriate legal ground for each purpose rather than treating all processing as consent:

  • Orders, delivery, returns and requested support: steps before entering a contract or performing it; legal obligations where applicable.
  • Accounting, tax and other required records: compliance with legal obligations.
  • Security, fraud prevention, legal claims and proportionate administration: legitimate interests where applicable, balanced against your rights; legal obligations may also apply.
  • Optional analytics, personalisation and advertising technologies: consent where required, and the applicable permissions for the feature concerned.
  • Marketing messages: consent where required, or another legally available basis only where its conditions are met. You can stop marketing messages using the unsubscribe facility or by contacting us. Transactional order communications are separate.

Where information is necessary to fulfil an order or meet a legal requirement, we may be unable to complete that transaction without it. We will not use consent withdrawal to remove rights you have over a purchase.

4. Shopify and service providers

Orders and returns are handled personally by Gabrielius Ramanauskas; we do not use a separate fulfilment company or staff for that work. We use Shopify to operate the store and Sellbrite for sales-channel and order management. The payment provider selected at checkout processes the information needed for payment. Information shared with a provider should be limited to what is needed for the service and lawful purpose concerned. We may also disclose information when legally required or necessary to establish or defend legal rights.

We send parcels through Lietuvos paštas / LP EXPRESS. We provide the recipient’s name and delivery address, together with contact and parcel information needed for the chosen delivery service or customs requirements. The postal provider may use delivery partners and customs authorities where necessary for the route. Its privacy information explains its own processing. This delivery use is distinct from optional analytics or marketing.

Our store uses Shopify. Shopify processes information about visits and purchases to operate its platform and services. Shopify Network Intelligence is currently enabled. Shopify can use information from interactions with our store, other merchants and Shopify to provide enhanced services, including improvements, personalisation and advertising-related services, subject to applicable choices and law. Other merchants do not gain access to our customer records merely because this feature is enabled.

Read Shopify’s Consumer Privacy Policy and use the Shopify privacy portal for information about its processing and available rights, including relevant consent-withdrawal or objection choices. Shopify may act in a different legal role for its own services; our responsibility for our own processing continues.

Google Analytics is connected to measure store browsing and shopping interactions, subject to applicable consent settings. Google’s privacy information explains its processing.

5. Cookies and similar storage

The store uses technologies needed for functions such as the cart, checkout and security. Optional analytics and marketing technologies are subject to the choices and permissions that apply in your region. Cookie-banner controls let you accept, decline or manage relevant categories where offered. You can reopen available choices using the store’s Cookie preferences control. Browser controls provide additional options but do not replace the store’s consent controls.

After you select a display currency, the display-currency feature remembers it in your tab’s session storage so you can continue browsing in that currency. It does not create a new persistent local-storage currency preference, or save a default preference before you choose one. Reference rates are cached in session storage for up to 24 hours while valid. Session information normally ends with the tab or browsing session; browser restoration can preserve a session. You can clear it using your browser’s storage controls.

The feature requests reference rates from the external Frankfurter service when conversion is needed. A normal network request discloses connection information such as an IP address to that service. The request deliberately omits credentials and a referrer, and does not include your order or account details. It does not alter EUR checkout charges.

The exact technologies and durations can change with Shopify, payment and app configurations. Contact us for information about the technologies used for a particular feature.

6. International processing

Information can be processed in the UK, EEA and other countries used by Shopify and relevant service providers. The current Shopify hosting-location setting for this store lists the United States; Shopify can also use other regions for its operations. Hosting or support outside your country can involve different data-protection laws.

Shopify describes its transfer arrangements in its international-transfer information and Data Processing Addendum. These include the relevant Canadian adequacy arrangement for certain Shopify transfers and contractual safeguards, including standard contractual clauses, for relevant group and subprocessor transfers. Sellbrite’s Data Processing Addendum describes its processing and international-transfer provisions, including standard contractual clauses where applicable. Google publishes its data-processing and transfer terms, including applicable contractual safeguards. These provider documents describe their arrangements; they do not mean that every transfer uses the same mechanism. Contact us for information about the arrangements that apply and how to obtain relevant details.

For international postal delivery, relevant delivery and customs information may need to reach the destination country, including destinations outside the EEA. Lietuvos paštas describes international postal processing in its customer privacy notice. Not every provider or transfer necessarily uses the same arrangement. Contact us for information about the providers involved in your interaction with the store.

7. How long information is kept

We retain information for the purpose for which it is needed and applicable record-keeping requirements, rather than promising immediate deletion after a purchase:

  • Accounting and tax records: for the applicable statutory period. For UK self-employment records, the ordinary minimum is at least five years after the 31 January filing deadline for the relevant tax year, with adjustments where a different rule or legal hold applies.
  • Order and support records: while needed for fulfilment, returns, complaints, relevant product remedies and legal claims, taking account of the nature of the record and applicable limitation periods.
  • Marketing preferences: while relevant to lawful marketing, including a limited suppression record where needed to respect an opt-out.
  • Google Analytics: the current property settings specify 2 months for the event-data retention control and 14 months for the user-data retention control. These controls apply to the user/event-level data covered by them, rather than all Google records or standard aggregated reports. Where new-activity resets apply, retention of a user identifier can be extended by further activity. Google’s retention explanation describes these limits.
  • Other advertising or service-provider data: according to the settings and provider arrangements for those services, taking account of the purpose, consent choices and applicable retention requirements.

When information is no longer needed, it should be deleted or anonymised, subject to legal and technical requirements. Provider backup and deletion processes can operate on their own documented schedules. Contact us about the criteria for a particular record.

8. Your rights and choices

Depending on the applicable law and circumstances, rights can include access, correction, erasure, restriction, portability and objection. You can withdraw consent for processing based on consent, without affecting the lawfulness of earlier processing. You have a right to object to direct marketing. Rights are subject to their legal conditions; for example, some records must be retained to meet a legal obligation.

Contact ask@vintagething.com to exercise a right or ask a privacy question. We may need proportionate information to verify that a request is genuine. We will respond within the time required by applicable law.

You may complain to the UK Information Commissioner’s Office, the Lithuanian State Data Protection Inspectorate, or another competent supervisory authority, including where you live or work, as applicable. You can contact us first, but that is not a condition of your right to complain.

9. Security, children and links

We use appropriate organisational and technical safeguards for the information we control. No website or transmission method can be guaranteed completely secure. We do not claim a specific encryption implementation unless it is verified for the service concerned.

This store is intended for ordinary retail shopping and is not directed at children. Contact us if you believe a child has supplied information that requires attention. The notice does not treat merely visiting the website as a parent’s consent.

Links to other services have their own privacy information. That does not remove our responsibility for disclosures or processing for which we remain responsible.

10. Changes

The notice will show its effective date. Material changes will be brought to attention appropriately, including where a new use requires information or consent before it starts. Updating this page is not a substitute for obtaining a consent that is required.