Privacy policy

Privacy Policy

1. General Provisions

1. This Privacy Policy describes how SIA Cietais rieksts, Reg. No. 44103005498, Valmieras iela 12a, Matīši, Valmieras nov., LV-4210 (hereinafter referred to as the "Data Controller") collects, processes, and stores personal data obtained from its customers and visitors of the website cietaisrieksts.lv (hereinafter referred to as the "Data Subject" or "You").
2. Personal data refers to any information relating to an identified or identifiable natural person—i.e., the Data Subject. Processing means any operation performed on personal data, such as collection, recording, alteration, use, viewing, deletion, or destruction.
3. The Data Controller adheres to the data processing principles set forth in applicable legislation and can confirm that personal data is processed in accordance with current laws.

2. Collection, Processing, and Storage of Personal Data

1. The Data Controller collects, processes, and stores personally identifiable information primarily through the e-commerce website and email.
2. By visiting and using the services provided in the online store, You agree that any submitted information will be used and managed in accordance with the purposes outlined in this Privacy Policy.
3. The Data Subject is responsible for ensuring that the provided personal data is accurate, correct, and complete. Knowingly providing false information is considered a violation of our Privacy Policy. The Data Subject must promptly notify the Data Controller of any changes to their submitted personal data.
4. The Data Controller is not liable for any losses incurred by the Data Subject or third parties due to the submission of false personal data.

3. Processing of Customer Personal Data

The Data Controller may process the following personal data:

1. Name, surname
2. Date of birth
3. Contact information (email address and/or phone number)
4. Transaction data (purchased goods, delivery address, price, payment information, etc.)
5. Any other information provided while using the website’s services, purchasing goods, or contacting us.

In addition to the above, the Data Controller reserves the right to verify the accuracy of submitted data using publicly available registries.

The legal basis for processing personal data is defined under Article 6(1)(a), (b), (c), and (f) of the General Data Protection Regulation (GDPR):

1. The Data Subject has given consent for processing their personal data for one or more specific purposes.
2. Processing is necessary for the performance of a contract with the Data Subject or to take steps at their request before entering into a contract.
3. Processing is necessary to comply with a legal obligation applicable to the Data Controller.
4. Processing is necessary for the legitimate interests of the Data Controller or a third party, except where overridden by the Data Subject’s fundamental rights and freedoms, especially if the Data Subject is a child.

The Data Controller stores and processes the Data Subject’s personal data as long as at least one of the following criteria applies:

1. The personal data is necessary for the purposes for which it was collected.
2. The Data Controller and/or Data Subject may pursue legitimate interests, such as submitting objections or filing legal claims.
3. There is a legal obligation to retain data (e.g., under the Accounting Law).
4. The Data Subject’s consent for processing remains valid, provided no other legal basis exists.

Once these conditions no longer apply, the retention period ends, and all relevant personal data is permanently deleted from computer systems and electronic/paper records or anonymized.

To fulfill obligations to You, the Data Controller may transfer Your personal data to cooperation partners and data processors (e.g., accountants, courier services). Data processors act as personal data controllers. Payment processing is handled by makecommerce.lv, so our company transfers necessary personal data to Maksekeskus AS, the platform owner.

Upon request, we may disclose Your personal data to state and law-enforcement authorities to protect our legal interests, including preparing, submitting, and defending legal claims.

When processing and storing personal data, the Data Controller implements organizational and technical measures to protect against accidental or unlawful destruction, alteration, disclosure, or any other illegal processing.

4. Data Subject Rights

Under the GDPR and Latvian law, You have the right to:

1. Access Your personal data, receive information about its processing, and request a copy in electronic format (data portability).
2. Request correction of inaccurate or incomplete personal data.
3. Request deletion of Your personal data ("right to be forgotten"), unless legal obligations require retention.
4. Withdraw previously given consent for data processing.
5. Restrict processing—request a temporary halt to all processing of Your personal data.
6. Lodge a complaint with the Data State Inspectorate.

Requests to exercise these rights can be submitted in person at Valmieras iela 12a, Matīši, Valmieras nov., LV-4210, or via email to info@cietaisrieksts.lv.

5. Final Provisions

1. This Privacy Policy is drafted in accordance with:
   • Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR)
   • Applicable laws of the Republic of Latvia and the European Union
2. The Data Controller reserves the right to amend or supplement this Privacy Policy at any time without prior notice. Changes take effect upon publication on cietaisrieksts.lv.