Privacy Policy

Last updated 28 August 2026.

D20 (d20.lt) is operated by MB Ddvidešimt, a company registered in Lithuania (Reg. No. 307570358, VAT LT100019623115), address Parko g. 7, Alovės k. — the data controller for anything described here.

• Account details — name, delivery address, phone number, email, and username, collected when you register. Used to run your account, fulfil orders, and pay out consignment sales. Your password is never stored as plain text — only a one-way hash of it.
• Order & transaction history — what you've bought, sold, or consigned, store credit balance and adjustments, and shipping details for each order. Kept as the actual record of the transaction (and for our own accounting/tax obligations).
• Payment information — for instant store-credit top-ups, your payment itself is handled entirely by our payment provider, Paysera; we receive confirmation that a payment succeeded and its amount, never your card or bank login details. For bank transfers, we see the transfer arrive in our own business bank account, same as any other bank transfer.
• Content you add — your collection/wishlist entries, marketplace listings, messages to other members, and anything else you type into the site.
• Basic technical logs — our hosting provider keeps standard server access logs (like IP address and request time) briefly, for security and troubleshooting — not something we personally review or use for tracking.

We don't use cookies, and we don't run any third-party analytics or advertising trackers on the site. Your login session and shopping cart are kept in your browser's local storage, not a cookie — they never leave your device except when the site itself needs them to fulfil a request you made.

We don't sell your data. It's shared only with the services that actually need it to do their job:

• Paysera — processes instant store-credit top-ups.
• LP Express / Lietuvos Paštas — deliver your order, so they receive your delivery details (name, phone, and either a parcel-machine choice or a postal address).
• Our email provider — sends order confirmations and password-reset emails on our behalf.

Other marketplace members only ever see what you've chosen to make public (your username, and anything you've set to public on your profile) — never your phone number, address, or full name, unless you're actively completing a trade with them.

For as long as your account exists, plus however long we're legally required to keep transaction/invoice records for tax purposes afterward. You can delete your account at any time from your account settings — this removes your personal profile data; records we're legally required to retain (like issued invoices) are kept as required by law, no longer tied to an active account of yours.

Under GDPR, you can ask us to: give you a copy of your data, correct anything inaccurate, delete it (subject to what we're legally required to keep), restrict or object to certain processing, or receive your data in a portable format. Contact us below to exercise any of these. If you're not satisfied with our response, you can also complain to Lithuania's data protection authority, the State Data Protection Inspectorate.

We may update this policy as the site changes — the "last updated" date above will move when we do.

Email: info@d20.lt
Phone: +370 684 64774

This page is a plain-language summary, not a substitute for legal advice. See also our Terms of Service.