1. Data controller

This Privacy Policy explains how SIA [COMPANY NAME] processes and protects the personal data of customers and website visitors.

2. Personal data we process

Depending on the actions taken by the customer, we may process the following personal data:

• first and last name;
• phone number;
• email address;
• delivery address where delivery is required;
• information about the selected product;
• information about product dimensions, quantity, colour, finish and other order parameters;
• information about the order collection or delivery method;
• information required to prepare an invoice and identify a payment;
• the customer’s question or other information voluntarily provided in an enquiry or communication with us;
• technical information about a website visit, such as IP address, browser type, device information and website log data;
• information obtained through cookies in accordance with our Cookie Policy.

Please do not provide information in enquiry forms or communications with us that is not necessary to consider the matter or fulfil the order.

3. Purposes and legal basis for processing personal data

3.1. Handling an enquiry or question

Data is processed in order to:

• receive and review the customer’s enquiry;
• answer the customer’s questions;
• prepare an individual quotation;
• confirm the order parameters.

The legal basis for processing is taking steps at the customer’s request before entering into a contract, as well as our legitimate interest in providing customer service.

3.2. Placing and fulfilling an order

Data is processed in order to:

• place and confirm the order;
• agree the product parameters;
• manufacture or process the ordered product;
• arrange collection or delivery of the order;
• communicate with the customer about fulfilment of the order.

The legal basis for processing is entering into and performing a contract.

3.3. Preparing invoices and meeting accounting requirements

Data is processed to prepare invoices, identify payments, maintain accounting records and comply with obligations laid down by law.

The legal basis for processing is compliance with a legal obligation applicable to the controller.

3.4. Customer service and handling claims

Data may be processed in order to:

• review customer submissions and complaints;
• resolve issues concerning product quality;
• remedy manufacturing defects or non-conformities;
• protect the legal interests of the company and the customer.

The legal basis for processing is performance of a contract, compliance with legal obligations and our legitimate interests in protecting our rights and providing high-quality customer service.

3.5. Website operation and security

Technical data may be processed in order to:

• operate the website;
• resolve technical issues;
• protect the website against unauthorised access and misuse;
• maintain website security and operation logs.

The legal basis for processing is our legitimate interest in maintaining a secure and functional website.

3.6. Use of cookies

Strictly necessary cookies are used to operate the website and provide functions requested by the user.

Analytics, personalisation or marketing cookies, where used, are activated only after the user has given consent.

Further information is available in the Cookie Policy.

4. Sources of personal data

We obtain personal data primarily and directly from the customer:

• when the customer completes an enquiry form on the website;
• when the customer contacts us by email or phone;
• when order parameters are agreed;
• when an invoice is prepared and paid;
• when the customer submits a question, complaint or other request.

Technical data may be collected automatically when the customer visits the website.

5. Recipients of personal data

Personal data may be accessed only to the extent necessary to perform a specific task.

Data may be disclosed to:

• our authorised employees;
• accounting service providers;
• website maintenance, hosting and other information technology service providers;
• banks and payment service providers to the extent necessary to process payments;
• legal, accounting or other professional service providers where necessary;
• state and municipal authorities where required by law.

We do not disclose personal data to third parties for their own marketing purposes.

6. Transfers of personal data outside the European Economic Area

Some website or information technology service providers may process data outside the European Union or European Economic Area.

Where personal data is transferred outside the European Economic Area, we ensure that an appropriate legal transfer mechanism and suitable personal data safeguards are used.

7. Retention of personal data

Personal data is retained only for as long as necessary to achieve the relevant processing purpose or as required by law.

The retention period is determined with regard to:

• the duration of communications and enquiry handling;
• the time needed to prepare and fulfil an order;
• warranty and claims periods;
• periods specified by accounting and tax legislation;
• limitation periods for potential legal claims;
• the need to protect the legal interests of the company and the customer.

When personal data is no longer required, it is deleted or anonymised unless further retention is required by law.

8. Personal data security

We take appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• unlawful use;
• accidental loss;
• destruction;
• disclosure;
• alteration.

Access to personal data is granted only to persons who need it to perform their duties.

9. Data subject rights

The data subject has the right to:

• request information about the processing of their personal data;
• obtain access to their personal data;
• request correction of inaccurate or incomplete data;
• request deletion of data where provided for by law;
• request restriction of processing;
• object to processing based on our legitimate interests;
• receive their data in a structured, commonly used and machine-readable format where provided for by law;
• withdraw consent where the relevant processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact us:

Before fulfilling a request, we may need to verify the identity of the person making it.

10. Right to lodge a complaint

If a person believes that their personal data is being processed improperly, they have the right to lodge a complaint with the Data State Inspectorate of Latvia.

11. Requirement to provide personal data

For us to respond to an enquiry, prepare a quotation, place an order, issue an invoice or arrange delivery, the customer must provide the information necessary for the relevant purpose.

If the required data is not provided, we may be unable to prepare a quotation or place or fulfil an order.

12. Changes to this Privacy Policy

We may update this Privacy Policy periodically so that it reflects our actual personal data processing, website operation and legal requirements.

The current version of the Privacy Policy is always available on the website.