Privacy Policy
(GLOBAL)

In Short: This Policy explains how we handle your Personal data. It helps you understand what we do with your information and your privacy rights.

Welcome! This Privacy Policy (“Policy”) explains how Herbal Solutions ("Company", "we", "us", or "our") handles your Personal data (“Data”) when you:

• visit our sales websites (“Website”);
• purchase our products or services (“Goods” or “Service”);
• enter into a business relationship with us;
• or otherwise interact with us.

This Policy outlines what Data we collect, its purposes, how we use and share it, how long we retain it, your rights, and how we protect your Data. We are committed to process your Data lawfully, fairly, and transparently in accordance with:

• the General Data Protection Regulation (GDPR);
• the ePrivacy Directive 2002/58/EC;
• UK General Data Protection Regulation (UK GDPR);
• Australia’s Privacy Act 1988 and Australian Privacy Principles (APPs);
• and any other applicable data protection laws.

Unless stated otherwise, this Policy applies globally, except in the United States and Canada. Specific privacy rights and regional supplements (e.g. for United Kingdom, Australia, etc.) are provided in Regional Addenda at the end of this Policy.

If you do not agree with our practices, please refrain from using the Website, purchasing our Goods or Service or submitting your Data in any other way. This Policy is effective as of 5th of September 2025. We may update this Policy occasionally all updates take effect upon publication, so we encourage you to review it regularly to stay informed.

We are: Herbal Solutions, your Personal data Controller

Our company number is: 306729964

Our registered address: Ukmerges st. 126, LT-08100 Vilnius, Lithuania

Our support e-mail address: support@oldwaysremedies.com

We have appointed a Data Protection Officer (DPO) to oversee our data protection obligations. You can contact the DPO directly at: disputes@oldwaysremedies.com.

In Short: We mainly collect only the Data needed to provide our Goods or Services and operate our Website. This section explains why we collect it and how we use it.

We only collect the Data we truly need – and only use it for clear, lawful reasons e.g. to proceed your purchase, provide service, respond to your enquiries, ensure Website functionality, etc. You can find a full list of purposes, what Data we collect, how we use it and much more detailed information in subsections bellow.

Here are also few important things for you to know:

• Lawful basis: We will only process your Data if we have a lawful basis under applicable data protection laws. The lawful bases that we might rely on are normally - contract, consent, legal obligation or legitimate interest.
• Sensitive Data: We do not collect any sensitive Data (like your health, religious beliefs, or biometric data).
• Marketing: We only use your Data for marketing if you’ve clearly consented or if we have other legal basic.
• Automated tools and AI: We may use AI or other fully or semi-automated technologies to support service delivery (e.g., chatbots, ChatGPT, Gemini etc.), but we do not use automated decision-making that produces legal or similarly significant effects on you within the meaning of Art. 22 of GDPR.
• No sale of Data: We never sell your Data to anyone.
• Children’s data: This Website is not intended for children under the age of 18. We do not knowingly collect personal data from minors without appropriate consent. If we become aware that we have inadvertently received personal data from a child, we will delete such information promptly.

In Short: We get your Data directly from you, through your use of our Website, or from trusted third parties and public sources. This helps us operate our Services and stay in touch with you.

We might collect Data from the following source (-s):

• Directly from you: When you place an order, contact us for support or inquiries, fill out forms, surveys, or sign up for updates filling out forms, participate in contests or promotional campaigns.
• Automatically via technology: When you visit or interact with our Website or other online platforms, we automatically collect certain Data, including identifiers and information regarding your activity. We utilize cookies and similar technologies to enhance your experience, analyse usage patterns, and secure our platforms.
• From third parties, vendors, and service providers: When we receive services from third party providers – such as hosting platforms, software providers, or professional consultants, we are normally receiving all Data from them directly about you.
• From our affiliate and referral partners: If you follow a referral link, use a partner discount code, or join through an affiliate, we may receive information that might contain your Personal Data.
• From other Intra - Group companies (if applicable): Where necessary for internal administrative, service provision, or business development purposes, we may receive your Data from other entities within our corporate group.
• From publicly available sources (if applicable): Where appropriate and permitted by law, we may collect Personal data from public registers (e.g. company registries, professional association websites), official government databases, or social media profiles (e.g. LinkedIn), particularly in the context of business-to-business (B2B) communication, professional outreach or due diligence.

In Short: Yes, but only when necessary and with strong safeguards—always ensuring your privacy is protected.

Yes - but only when necessary, and with your privacy in mind.

We may share limited Data with trusted third parties to provide our services, meet legal obligations, or support business daily operations. Whenever we do, we ensure that your Data is protected and handled responsibly. For this reason, parties who process Data on our behalf, they act as Data Processors and are contractually bound by Data Processing Agreements (DPAs). These agreements ensure they follow our instructions, apply appropriate safeguards, and do not use your Data for their own purposes. We may share your Data with:

• Service Providers (Data Processors): We engage with various service providers to support our business functions (e.g. IT support, hosting, payments, analytics, customer service, marketing, auditing, legal services, etc.). Service providers process Data strictly on our behalf and under our documented instructions.
• Intra - Group Companies (Data Processors or Joint Controllers): We may share your Data with other entities within our corporate group for internal administrative purposes, centralized services, or to provide integrated services.
• Public authorities and other Data Controllers: In certain circumstances, your Data may be shared with third parties who act as independent Data Controllers who determine their own purposes and means of processing. Such as public authorities, law enforcements, courts, insurers, fraud prevention services agencies, independent service providers etc.
• Other corporates or auditors: In the context of a potential or actual merger, acquisition, asset sale, or restructuring, we may disclose limited Data to potential investors, buyers, or their auditors, and advisors.
• To other third parties with your consent: Where legally required, we will only share your Data with third parties if you have explicitly given us your informed, freely given consent.

In Short: We keep your Data only as long as needed for legal, contractual, or service-related purposes—then we delete or anonymize it securely.

We keep your Data only for as long as necessary to:

• fulfil the purposes for which it was collected,
• provide you with our Goods or Services,
• comply with legal, regulatory, or contractual obligations, or
• resolve disputes or enforce our agreements.

Detailed retention periods for each Data processing purpose are set out in Section 3 of this Policy. Once the applicable retention period has expired, we will either safely delete your Data or irreversibly anonymize it within a reasonable timeframe, in line with best industry practices and legal requirements.

In Short: We use strong technical and organizational measures to keep your Data safe and work continuously to prevent unauthorized access and protect your privacy.

We are committed to protecting your Data and take the security of your information seriously. We apply a combination of technical and organisational measures to prevent unauthorised access, accidental loss, misuse, alteration, or disclosure of Personal data. Our security safeguard practices are based on core data protection principles and include, but are not limited to:

• Collecting Data only for specified and lawful purposes,
• Processing Data fairly and transparently,
• Retaining Data only as long as necessary,
• Limiting access to Data strictly to authorised employees,
• Sharing Data with third parties only when legally justified,
• Providing regular data protection training to our employees,
• Conducting internal and/or external IT security audits,
• Using encryption for sensitive data,
• Performing regular Data backups and activity logging,
• Continuously improving processes to ensure Data security,
• Regularly monitor our systems for potential threats or breaches.

While we apply strong security measures, no system is entirely risk-free - especially during internet transmission. To help protect your Data, please stay vigilant online and always use a strong, unique password, keep it confidential, secure your devices, be cautious when sharing information online especially via strange links. Security incidents resulting from user actions (e.g. credential sharing or phishing) may fall outside our control.

In Short: Yes, sometimes - but only when necessary and always with strong legal safeguards to keep your data protected.

Yes - but only when necessary, and always with strong protection in place.

We mainly store and process your Data within the European Economic Area (EEA), and there may be times when some of your Data is transferred to trusted partners or service providers located in countries outside the EEA - for example, for cloud hosting, technical support, or specialist services. Where applicable, such recipients are listed in Section 3 of this Policy.

Whenever we send your Data outside the EEA, we make sure that it remains protected, and your privacy rights are respected. We never transfer your Data lightly — we always assess the risks and take appropriate steps to keep your Data safe, wherever it goes. Where Data is transferred outside the EEA:

• We check whether the country has an “adequacy decision” from the European Commission, which means it provides a level of data protection similar to the EU;
• Where no adequacy decision exists, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. These are legally binding agreements requiring the recipient to uphold EU-level privacy and security standards EU Standard Contractual Clauses;
• Before using SCCs, we conduct a Data Transfer Impact Assessment, as required by the Schrems II decision and EDPB guidance, to evaluate whether additional safeguards are necessary in the recipient country;
• Where needed, we may also apply supplementary technical or contractual safeguards, such as encryption, access controls, and audit rights.

If you would like more details about these transfers, you can contact us using the details provided in Section 11 of this Policy.

In Short: Yes, but we don’t make important decisions about you using only AI. We may use smart tools to support our services, but all important decisions involve real people, not just programs.

Yes. We may use certain Artificial Intelligence (AI) - based tools and fully or semi-automated systems - for example, in customer support or during phone calls - to enhance the speed and accuracy of our Services.

However, we do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you, within the meaning of Art. 22(1) GDPR. Specifically:

• Any recommendations, responses, or information generated by AI tools are provided for informational purposes only and are subject to review and validation by our human staff;
• We do not use algorithms or automated systems to make decisions about you that produce legal effects (e.g., denial of a service), without meaningful human involvement;
• You have the right to request human intervention and express your point of view if you believe any decision or response has been generated through automated means that significantly affects you, and to obtain an explanation and review of such decision by a human staff.

In Short: You have rights over your Personal data, including access, correction, deletion, objection, and more. This section outlines how you can exercise them and what to expect.

If we process your Data as set out in this Policy, or you believe we may be doing so, you have the following rights as a Data Subject. These rights apply regardless of whether we process your Data as a client, supplier, contractor, or professional contact:

• Right to Be Informed – You have the right to clear, transparent information about how we collect and use your Data. This detailed Policy aims to provide that (Art. 12-13 GDPR);
• Right of Access – You can ask us whether we process your Data and request a copy of the Data we hold about you (Art. 15 GDPR);
• Right to Rectification – If your Data is inaccurate or incomplete, you can ask us to correct or update it (Art. 16 GDPR);
• Right to Erasure (“Right to Be Forgotten”) – You can request that we delete your Data if it it is no longer necessary for the purposes collected, you withdraw your consent (where processing was based on consent), you object and there are no overriding legitimate grounds, or the Data was unlawfully processed. Note: This right is subject to limitations. For example, we may retain certain Data if required for legal compliance, dispute resolution, or contractual purposes (Art. 17 GDPR);
• Right to Restrict Processing – You may request that we temporarily limit the processing of your Data in situations such as contesting the accuracy of the Data, or objecting to processing while we assess our legal grounds (Art. 18 GDPR);
• Right to Data Portability – Where processing is based on your consent or a contract and carried out by automated means, you can request a copy of your Data in a structured, commonly used, machine-readable format, and ask us to transfer it to another provider (Art. 20 GDPR);
• Right to Object – You can object to processing based on our legitimate interests or for direct marketing purposes. We will stop such processing unless we demonstrate compelling legitimate grounds (Art. 21 GDPR);
• Right to Withdraw Consent – Where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing that took place before your withdrawal (Art. 7(3) GDPR);
• Right to Lodge a Complaint – If you’re unhappy with how we handle your Data, please contact us first - we’ll do our best to resolve the issue. However, you may also lodge a complaint with the Lithuanian State Data Protection Inspectorate (https://vdai.lrv.lt/lt/) or the supervisory authority in your country of residence or place of work.

Please note: Your rights are not absolute. In some cases, the exercise of your rights may be restricted under applicable data protection laws - for example, where fulfilling your request would adversely affect the rights and freedoms of others, or where we are legally required to retain certain Personal data (e.g. for compliance, legal claims, or regulatory purposes).

If you have any general questions about this Policy, how we process Data, complaint or if you wish to exercise any of your Data Subject rights, you can contact us by email at: disputes@oldwaysremedies.com.

To help us process your request efficiently, please:

• clearly express your question or complaint,
• specify which Data Subject right you wish to exercise (if applicable),
• provide enough information to identify you (we may ask for proof of identity or proceed identity verification process), and
• include any relevant details that will help us respond quickly.

You may also authorize someone to act on your behalf. If so, please ensure your authorized person provides us with written and signed permission confirming they are allowed to act for you. We may deny a request if sufficient proof of authorization is not provided.

We aim to respond without undue delay and within one month of receiving your request. If your request is particularly complex or involves multiple issues, we may extend this period by an additional month – in which case, we will inform you in advance and explain the reason for the delay.

This Addendum supplements our Global Privacy Policy and applies where your Personal Data is subject to the laws of the country or region in which you reside, or where our processing activities are specifically targeted. These regional terms complement the Global Privacy Policy and override it only where required by applicable local law.

🇬🇧 UNITED KINGDOM (UK)

If you a UK resident or our processing relates to UK individuals, the processing of your Personal Data is subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Your Rights under UK Data Protection Law:

• Right to be informed (Article 13–14 UK GDPR) – to receive clear information about how we collect and use your Personal Data;
• Right of access (Article 15 UK GDPR) – to request a copy of the Personal Data we hold about you;
• Right to rectification (Article 16 UK GDPR) – to have inaccurate or incomplete Personal Data corrected;
• Right to erasure (Article 17 UK GDPR) – to request deletion of your Personal Data in certain circumstances;
• Right to restriction of processing (Article 18 UK GDPR) – to limit how we use your Data in specific situations;
• Right to data portability (Article 20 UK GDPR) – to receive your Personal Data in a structured, commonly used, machine-readable format;
• Right to object (Article 21 UK GDPR) – to object to processing based on our legitimate interests or for direct marketing;
• Right not to be subject to solely automated decision-making, including profiling (Article 22 UK GDPR) – where such decisions have legal or similarly significant effects.

International Data Transfers from the UK:

If we transfer your Personal Data outside the UK (e.g., to the EEA, the United States, or other countries), we ensure that adequate safeguards are in place, such as:

• An adequacy regulation issued by the UK Government; or
• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses (SCCs), along with appropriate technical and contractual safeguards.

Supervisory Authority:

If you have concerns about how we handle your Personal Data, you may lodge a complaint with the UK’s supervisory authority: Information Commissioner’s Office (ICO), website: https://ico.org.uk.

🇦🇺 AUSTRALIA

If you are Australia resident or our processing relates to Australian individuals, the processing of your Personal Data is subject to the the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Your Rights under Australian Privacy Law:

• Right to access (APP 12) – to request a copy of the personal information we hold about you;
• Right to correction (APP 13) – to request correction if your personal information is inaccurate, incomplete, or out of date;
• Right to lodge a complaint – if you believe we have breached your privacy under the APPs, you may submit a formal complaint.

Overseas Transfers (Cross-Border Disclosures):

We may disclose your personal information to recipients located outside Australia (e.g., in the EU, US, or other countries). Before doing so, we take reasonable steps to ensure that overseas recipients do not breach the APPs. These steps may include:

• Entering into binding contractual agreements;
• Conducting privacy and security due diligence;
• Ensuring technical safeguards such as encryption and access control.

Supervisory Authority:

If you are not satisfied with our response to a privacy concern, you may contact: Office of the Australian Information Commissioner (OAIC), website: https://www.oaic.gov.au

Phone: 1300 363 992.

THE END OF POLICY