1. Personal data controller

This privacy policy explains how SIA “PROFITREE” processes and protects the personal data of customers and website visitors.

2. Personal data we process

Depending on the customer’s actions, we may process the following personal data:

• first name and surname;
• telephone number;
• email address;
• delivery address, if delivery is required;
• information about the selected product;
• information about the product’s dimensions, quantity, colour, finish and other order specifications;
• information about the collection or delivery method;
• information required to prepare an invoice and identify a payment;
• the customer’s question or other information voluntarily provided in an enquiry or correspondence with us;
• technical information about visits to the website, such as the IP address, browser type, device information and website activity logs;
• information collected through cookies in accordance with our cookie policy.

Please do not include information in enquiry forms or correspondence with us that is unnecessary for handling your enquiry or fulfilling your order.

3. Purposes and legal basis for processing personal data

3.1. Handling an enquiry or question

Data is processed to:

• receive and handle a customer’s enquiry;
• answer the customer’s questions;
• prepare a personalised offer;
• clarify order specifications.

The legal basis for processing is taking steps at the customer’s request before entering into a contract, as well as our legitimate interest in providing customer service.

3.2. Placing and fulfilling an order

Data is processed to:

• place and confirm an order;
• agree on product specifications;
• manufacture or process the ordered product;
• arrange collection or delivery;
• contact the customer about fulfilment of the order.

The legal basis for processing is entering into and performing a contract.

3.3. Preparing invoices and meeting accounting requirements

Data is processed to prepare invoices, identify payments, maintain accounting records and fulfil statutory obligations.

The legal basis for processing is compliance with a legal obligation applicable to the controller.

3.4. Customer service and handling claims

Data may be processed to:

• handle customer requests and complaints;
• resolve product quality issues;
• remedy manufacturing defects or non-conformities;
• protect the legal interests of the company and the customer.

The legal basis for processing is the performance of a contract, compliance with legal obligations and our legitimate interests in protecting our rights and providing quality customer service.

3.5. Ensuring website operation and security

Technical data may be processed to:

• keep the website operating;
• resolve technical problems;
• protect the website against unauthorised access and misuse;
• maintain website security and activity logs.

The legal basis for processing is our legitimate interest in maintaining a secure and functional website.

3.6. Use of cookies

Strictly necessary cookies are used to ensure the website operates and to provide functions requested by the user.

Analytics, personalisation or marketing cookies, if used, are activated only after the user has given consent.

Further information is available in the cookie policy.

4. Sources of personal data

We obtain personal data mainly directly from the customer:

• when the customer completes an enquiry form on the website;
• when the customer contacts us by email or telephone;
• when order specifications are agreed;
• when an invoice is prepared and paid;
• when the customer submits a question, complaint or other request.

Technical data may be collected automatically when the customer visits the website.

5. Recipients of personal data

Personal data may be accessed only to the extent necessary to carry out the relevant task.

Data may be shared with:

• our authorised employees;
• accounting service providers;
• website maintenance, hosting and other information technology service providers;
• banks and payment service providers, to the extent necessary to process payments;
• legal, accounting or other professional service providers, where necessary;
• state and local government authorities in cases prescribed by law.

We do not share personal data with third parties for their own marketing purposes.

6. Transfers of personal data outside the European Economic Area

Some website or information technology service providers may process data outside the European Union or the European Economic Area.

Where personal data is transferred outside the European Economic Area, we ensure that an appropriate legal mechanism for the transfer and suitable safeguards for personal data are in place.

7. Retention of personal data

Personal data is retained only for as long as necessary to achieve the relevant purpose of processing or as required by law.

The retention period is determined by taking into account:

• the duration of correspondence and enquiry handling;
• the time required to prepare and fulfil the order;
• the warranty and claims period;
• the periods prescribed by accounting and tax legislation;
• the limitation periods for potential legal claims;
• the need to protect the legal interests of the company and the customer.

When personal data is no longer required, it is deleted or anonymised, unless further retention is required by law.

8. Security of personal data

We implement appropriate technical and organisational measures to protect personal data against:

• unauthorised access;
• unlawful use;
• accidental loss;
• destruction;
• disclosure;
• alteration.

Access to personal data is granted only to those who need it to perform their duties.

9. Your rights

You have the right to:

• request information about the processing of your personal data;
• access your personal data;
• request the correction of inaccurate or incomplete data;
• request deletion of data in the cases provided for by law;
• request restriction of processing;
• object to processing based on our legitimate interests;
• receive your data in a structured, commonly used and machine-readable format in the cases provided for by law;
• withdraw consent where the relevant processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, please contact us:

Before fulfilling a request, we may need to verify the identity of the person making it.

10. Right to lodge a complaint

If you believe that your personal data is being processed improperly, you have the right to lodge a complaint with the Data State Inspectorate.

11. Requirement to provide personal data

To enable us to respond to an enquiry, prepare an offer, place an order, issue an invoice or arrange delivery, the customer must provide the information required for the relevant purpose.

If the required data is not provided, we may be unable to prepare an offer or place or fulfil an order.

12. Changes to this privacy policy

We may update this privacy policy periodically to reflect our actual personal data processing, website operation and legal requirements.

The current version of the privacy policy is always available on the website.