Privacy policy
Last updated: 2026-07-05
EDONUM, a private limited company, cares about the protection and privacy of your personal data. This privacy policy explains what personal data we collect, the purposes for which we use it, the legal grounds for processing it, how long we retain it, whom we may share it with and what rights you have.
This privacy policy applies to the website dnr.lt, the services provided on it, online sales, enquiries, orders, communication with customers and the social media accounts we manage.
By using the website, submitting an enquiry, ordering a service or providing data for DNA testing, you confirm that you have read this privacy policy.
1. Data controller
The controller of your personal data is:
Private limited company EDONUM
Company code: 302300106
Address: Demokratų g. 53, Kaunas, Lithuania
Email:
If you have questions about this privacy policy or the processing of personal data, or wish to exercise your rights, please contact us by email:
2. What personal data do we collect?
Depending on how you use the website and our services, we may process different categories of personal data.
2.1. Website visits and technical data
When you visit the website dnr.lt, technical data may be collected automatically:
- IP address;
- browser type and version;
- device type;
- operating system information;
- date and time of the visit;
- pages visited;
- referral source;
- website operation, security and error logs.
This data is needed to ensure that the website functions properly and securely, to identify technical errors, protect the website against unauthorised access and improve the user experience.
2.2. Enquiry and communication data
When you contact us by email, telephone, contact form, social media or other channels, we may process:
- first and last name;
- email address;
- telephone number;
- message content;
- questions, documents or other information you provide;
- communication history;
- responses and customer service information.
If your message includes information about DNA testing, biological relationships, health, family circumstances or other sensitive information, we may also process that information to the extent necessary to respond to your enquiry or provide the service.
2.3. Order and purchase data
When you order a DNA test, product or service on the website, we may process:
- first and last name;
- email address;
- telephone number;
- delivery address;
- billing details;
- information about the service or product ordered;
- order number;
- payment status;
- payment amount;
- payment identifier;
- delivery information;
- data in invoices, orders and other accounting documents.
We do not store payment card details or online banking login credentials. Payments are processed by payment service providers under their own security and privacy rules.
2.4. Data required for DNA testing
To provide the DNA testing service, depending on the type of test selected, we may process:
- first and last names of the people participating in the test;
- contact details of the people participating in the test;
- date of birth or age of the people participating in the test, where necessary for the specific test;
- information about the stated or tested biological relationship;
- information about the test being ordered;
- sample identification number;
- sample type;
- information about sample collection and receipt;
- technical information required for the testing process;
- genetic test data;
- DNA test result;
- test report;
- consents, forms and other documents required for the test.
DNA samples, genetic data and DNA test results are highly sensitive data. We process them only to the extent necessary to perform the specific DNA test, provide the result, ensure quality, comply with legal requirements, resolve disputes and protect our legitimate interests.
We do not use genetic data for advertising, creating marketing profiles, customer segmentation or other purposes unrelated to providing the DNA testing service.
2.5. Data concerning minors
When a minor participates in a DNA test, their data may be processed only where there is a lawful basis and the person providing the data is entitled to act on the minor's behalf or has obtained the necessary consents.
By ordering a test and providing another person's data, including a minor's data, you confirm that you are entitled to provide that data and order the relevant service.
If you are unsure whether you are entitled to provide another person's or a minor's data, contact us before ordering a test.
2.6. Direct marketing data
If you agree to receive news, offers or other marketing content, we may process:
- first name;
- email address;
- telephone number;
- date consent was obtained;
- date consent was withdrawn;
- history of newsletters or notifications sent.
If you are our customer, we may send information about similar services where permitted by law, but every message will provide a way to opt out of such communication.
3. Why do we process your personal data?
We process your personal data for the following purposes:
- to provide access to the website and ensure it functions;
- to respond to your enquiries;
- to receive and manage orders;
- to provide the DNA testing service;
- to prepare, process and manage the samples required for DNA testing;
- to share information necessary for the test with laboratory partners;
- to provide the DNA test result or report;
- to send a test kit, documents, result or other information;
- to manage payments;
- to issue invoices and fulfil accounting obligations;
- to comply with legal requirements;
- to ensure service quality, security and traceability;
- to handle complaints, resolve disputes and defend our rights;
- to carry out direct marketing where we have your consent or another lawful basis;
- to protect the website, systems and data against unauthorised access.
4. What legal bases do we use to process data?
We process your personal data on the following legal bases:
4.1. Performance of a contract or steps prior to entering into a contract
We process data on this basis when:
- you submit an enquiry about a service;
- you order a DNA test or another service;
- you purchase a product;
- you request a consultation;
- we fulfil an order;
- we manage delivery, payment or the provision of results.
4.2. Your consent
We process data based on consent when:
- you agree to receive direct marketing messages;
- you consent to non-essential cookies;
- you give explicit consent to the processing of special categories of data, including genetic data, where such consent is required to provide the DNA testing service;
- you give other separate consent for a specific data processing purpose.
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
4.3. Legal obligation
We process data on this basis when we are required to:
- retain accounting documents;
- comply with tax requirements;
- respond to public authorities;
- fulfil other duties imposed by law.
4.4. Legitimate interest
We may process data based on legitimate interest in order to:
- ensure the security of the website and information systems;
- protect our rights and legitimate interests;
- prevent fraud or misuse;
- handle complaints;
- resolve disputes;
- improve website performance;
- maintain a communication history;
- demonstrate that services were provided;
- manage debt or payment matters.
5. Special categories of personal data
As we provide DNA testing services, in certain cases we process special categories of personal data, including genetic data.
Such data may only be processed where there is an appropriate legal basis and where this is necessary for a specific purpose.
We process special categories of data based on:
- your explicit consent;
- the need to establish, exercise or defend legal claims;
- other grounds provided by law, where applicable to the particular case.
Special categories of data are processed with stricter confidentiality, access restriction and security measures.
6. Who may we share your data with?
We may share your personal data only to the extent necessary to achieve a specific purpose.
Data may be shared with:
- laboratories and laboratory partners performing DNA tests;
- laboratory partners in the European Economic Area;
- laboratory partners in the United States where necessary to provide the DNA testing service ordered;
- providers of sample, parcel or document delivery services;
- payment service providers;
- online shop, website, server and IT maintenance service providers;
- email, SMS, newsletter or communication service providers;
- accounting service providers;
- legal service providers;
- audit or consultancy service providers;
- public authorities where required by law;
- courts, bailiffs, lawyers or other bodies where necessary to defend our rights.
We share with all service providers only the data necessary for them to perform their functions.
Where possible, we share with laboratory partners only the information necessary for the test, such as the sample code, order identifier or another technical identifier, rather than unnecessary personal data.
7. Is data transferred outside the European Economic Area?
Yes, in certain cases your personal data may be transferred outside the European Economic Area, including to the United States.
Such transfers may be necessary where DNA testing involves laboratory partners, service providers, IT, communication, payment, analytics or other partners located outside the European Economic Area.
Only data necessary to provide a specific service, perform a test, prepare results, ensure quality, meet legal requirements or protect our rights is transferred outside the European Economic Area.
When transferring data outside the European Economic Area, we apply the safeguards provided for by law. Depending on the service provider or laboratory partner, transfers may be based on:
- a European Commission adequacy decision;
- the EU–US Data Privacy Framework, if the US service provider or laboratory partner is certified under this mechanism;
- standard contractual clauses approved by the European Commission;
- additional technical and organisational safeguards;
- another lawful transfer basis provided for by the GDPR, where applicable.
To minimise the amount of data transferred, where possible we share with laboratory partners only the information necessary for the test, such as a sample code or another identifier, rather than unnecessary customer personal data.
8. Principles for handling DNA samples and genetic data
Samples and genetic data required for DNA testing are processed in accordance with the principles of confidentiality, data minimisation and purpose limitation.
This means that:
- we collect only the data necessary for the specific test;
- we use samples and test data only to perform the DNA test ordered;
- we do not use genetic data for marketing;
- we do not sell genetic data to third parties;
- we do not use genetic data for research without a separate lawful basis or separate consent, where such consent would be required;
- we share with laboratory partners only the information necessary to perform the test;
- we restrict access to sensitive data to those who need it to provide the service.
9. How long do we retain your data?
We retain personal data no longer than necessary for the purposes for which it was collected, or for as long as required by law.
Indicative retention periods:
- website technical logs and security records — up to 90 days, unless longer retention is needed to investigate a security incident;
- enquiry and communication data — up to 2 years after the last communication, unless longer retention is needed to handle a complaint, dispute or legal claim;
- order and purchase data — as long as necessary to perform the contract and meet legal requirements;
- accounting documents, invoices and payment documents — for the periods set by law;
- DNA test administration data — as long as necessary to provide the testing service, deliver results, carry out quality control, handle complaints, prevent disputes and meet legal requirements;
- DNA test results and reports — as long as necessary to provide the service, deliver results, protect legitimate interests and meet legal requirements;
- consents — for as long as consent remains valid and additionally for as long as necessary to demonstrate that consent was given;
- direct marketing data — until consent is withdrawn or messages are declined.
DNA sample retention periods may depend on the specific test, the laboratory partner’s procedures and the terms of service. When samples are no longer needed for the test, they are destroyed or handled in accordance with applicable laboratory procedures and legal requirements.
After the retention period expires, data is deleted, destroyed or anonymised if it is no longer needed for lawful purposes.
10. How do we protect your data?
We implement organisational and technical measures to protect your personal data against unauthorised access, loss, alteration, disclosure or destruction.
Measures used may include:
- restricted access to data;
- protection of administrator accounts;
- password protection;
- HTTPS connections;
- server and website security maintenance;
- website and system updates;
- data backups;
- confidentiality commitments by employees and service providers;
- restricting access to sensitive data to those who need it to perform their work;
- data minimisation by sharing only necessary information with laboratory partners;
- monitoring of technical security incidents.
Despite these measures, no transmission of data over the internet can be considered completely secure. Please therefore do not provide unnecessary personal data in contact forms or emails if it is not needed for your enquiry or the provision of the service.
11. Cookies
We use cookies and similar technologies on the website.
Cookies are small text files stored on your device that help the website function properly, remember preferences, protect the website, analyse visits or perform other functions.
We use the following types of cookies:
11.1. Essential cookies
These cookies are required for the website to function properly. They enable core functions such as the shopping cart, ordering process, secure session, login or saving cookie preferences.
Essential cookies are used without separate consent because the website could not function properly without them.
11.2. Functional cookies
These cookies help remember your choices, such as language, settings or other website preferences.
Functional cookies that are not essential for the website to operate are used only with your consent.
11.3. Analytics cookies
These cookies help us understand how visitors use the website, which pages are visited most often, whether errors occur and how the user experience can be improved.
Analytics cookies are used only with your consent if they are not essential for the website to operate.
11.4. Marketing cookies
These cookies may be used to measure advertising effectiveness, for remarketing or to display relevant offers.
Marketing cookies are used only with your consent.
11.5. Managing cookies
When you first visit the website, you may be shown a cookie preference window. You can accept all cookies, reject non-essential cookies or select individual cookie categories.
You can change your choice at any time using the website’s cookie settings tool or your browser settings.
If you disable cookies in your browser, some website functions may not work properly.
12. Social media
We may manage accounts on social media, such as Facebook, Instagram or other channels.
When you interact with us on social media, for example by sending messages, commenting, liking or sharing content, the social network operator may also process your personal data under its own privacy policy.
We process only the social media data necessary to reply to your messages, manage accounts, communicate with visitors and protect our rights.
13. Direct marketing
We send direct marketing messages only when:
- we have your consent;
- or the law permits us to send existing customers information about similar services we offer, with a clear opportunity to opt out.
Every marketing message includes a way to opt out. You can also contact us at any time by email at
We do not use DNA test results, genetic data or other sensitive test information for direct marketing.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
14. Automated decision-making and profiling
We do not make decisions based solely on automated data processing that produce legal or similarly significant effects for you.
We do not use your genetic data for automated profiling, advertising profiles or other purposes unrelated to the provision of the DNA testing service.
15. Your rights
You have the following rights:
- the right to access your personal data;
- the right to receive information about how your data is processed;
- the right to request correction of inaccurate or incomplete data;
- the right to request erasure of data where there is a legal basis;
- the right to restrict data processing;
- the right to object to processing based on legitimate interest;
- the right to data portability, where applicable;
- the right to withdraw consent at any time where processing is based on consent;
- the right to lodge a complaint with a supervisory authority.
To exercise your rights, contact us by email:
After receiving a request, we may ask you to verify your identity to protect your data against unauthorised disclosure.
We respond to requests within the time limits set by law. In certain cases, the exercise of your rights may be subject to statutory conditions, restrictions and exceptions, for example where we must retain data by law or where it is needed to establish, exercise or defend legal claims.
16. Complaints
If you believe your personal data is being processed improperly, please first contact us by email:
We will try to investigate the situation and find an appropriate solution.
You also have the right to lodge a complaint with the State Data Protection Inspectorate.
State Data Protection Inspectorate
Website: vdai.lrv.lt
17. Providing another person’s data
If you provide another person’s data rather than your own, including data of a DNA test participant, you confirm that you have the right to provide it and that the person has been informed about the processing of their data where required by law.
If you provide a minor’s data, you confirm that you have the right to act on the minor’s behalf or another lawful basis to provide that data.
We may request additional information or documents if there are reasonable doubts about the right to provide another person’s data or order a particular service.
18. Changes to the Privacy Policy
We may update this Privacy Policy periodically when legislation, our services, website functionality, service providers, laboratory partners or data processing practices change.
The latest version of the Privacy Policy is always published on the website dnr.lt. The new version takes effect on the date it is published on the website, unless stated otherwise.