1. Data controller
SIA SPM ORTOTO
Reg. No. 40203618163
VAT No. LV40203618163
Baznīcas iela 13–19, LV-1010 Riga, Latvia
E-mail: [email protected]
Legal matters: [email protected]
Phone: +371 28017200 (Mon–Fri 9:00–17:00)
2. What data we process
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, e-mail, phone, delivery address or parcel locker | Order fulfilment and delivery | Performance of a contract | 10 years (accounting requirement) |
| Order and payment data | Accounting, taxes | Legal obligation | 10 years |
| Correspondence with customer service | Handling enquiries | Legitimate interest | 2 years |
| Reviews | Publication on the website | Consent | Until consent is withdrawn |
| Cookie and browsing data (IP address, device, behaviour on the website) | Website operation, statistics, measuring advertising effectiveness | Consent (except strictly necessary; Umami statistics – legitimate interest) | See Cookie policy |
| Session recordings (mouse movements, scrolling, clicks, page structure; no data you type) | Improving website usability | Consent | 12 months |
We do not see or store payment card details – they are handled by the payment service provider.
3. Who we share data with
To fulfil an order, data is shared only to the extent necessary:
- Stripe Payments Europe, Limited – payment processing
- SIA Swotzy – preparing shipments
- Carriers – parcel-locker and courier companies – delivery of goods
- Hostinger – website hosting (data centre in the European Union)
With your consent or, where stated, on the basis of legitimate interest, we use the following analytics and marketing services:
- Umami – self-hosted, cookie-free visitor statistics (legitimate interest; you can object in the privacy settings) and, with your consent, session recording (see section 5). Server in Germany (EU).
- Google Ireland Limited – Google Analytics, Google Tag Manager, Google Ads, YouTube
- Meta Platforms Ireland Limited – Meta Pixel (Facebook, Instagram)
- TikTok Technology Limited – TikTok Pixel
- Pinterest Europe Ltd. – Pinterest Tag
- Omnisend Ltd. – e-mail marketing and newsletters
Chat assistant – OpenAI Ireland Ltd. The website has an AI chat assistant. The messages you type in the chat window are sent to generate a reply (legitimate interest – answering your questions). OpenAI does not use them to train models and keeps them for up to 30 days for abuse monitoring. The chat history is stored in your browser so that it is not lost when you move between pages; you can delete it with the “Clear” button. Please do not enter personal or health data in the chat – the assistant does not need it.
Some of these service providers also process data outside the European Economic Area, mainly in the USA. Transfers are based on the EU–US Data Privacy Framework, standard contractual clauses or, where stated in the privacy settings, your explicit consent under Article 49(1)(a) GDPR. Detailed information on each service, its cookies and the countries where data is processed is available in the Cookie policy. We do not sell data or use it for third-party purposes.
4. Cookies and consent records
We manage the use of cookies and similar technologies with the consent management tool Real Cookie Banner, which runs on our own server – consent data is not passed on to third parties. On your first visit, a privacy settings window is shown where you can accept all services, continue without consent or choose individually. Strictly necessary services work regardless of consent.
As proof of consent, we store a pseudonymous visitor identifier (UUID), the time of consent, the service groups chosen and the version of the privacy settings in force at the time. The IP address is not stored. Consent records are kept for 120 months (legitimate interest – being able to prove consent). The cookie with the consent reference is valid on your device for 365 days.
You can change or withdraw your consent at any time: change privacy settings. You can view your consent history here: consent history.
5. Session recording
If you consent to statistics services, we use “Umami Session Replay” – a tool that records how you browse the website: mouse movements, scrolling, clicks and page structure. We use the recordings only to improve the usability of the website.
We do not record the checkout page, the order confirmation page or the account pages. Data typed into forms appears in recordings as asterisks – we cannot see what you typed.
Each recording is stored together with the country, region and city (derived from the IP address; the IP address itself is not stored), browser and device type and screen size. Recordings are kept for 12 months on a server in Germany (EU).
Legal basis – your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time: change privacy settings – recording stops immediately.
6. Your rights
You have the right to access your data, to request its rectification or erasure, to restrict processing, to object to processing, to receive your data in a structured format and to withdraw consent you have given.
Write to [email protected]. We reply within 30 days.
If you believe your data is being processed improperly, you have the right to lodge a complaint with the Data State Inspectorate of Latvia (dvi.gov.lv) or with the data protection authority of your country of residence.
7. Data security
The website uses an encrypted HTTPS connection. Only those employees and service providers who need access to data to perform their work have it.
8. Changes to this policy
We announce material changes on the website. The latest version is always published on this page.