• Privacy policy

Privacy policy

Privacy Policy

1. General Provisions

1.1. This Privacy Policy describes how Kongress SIA, registration No. 50003887151, legal address: Dammes 32, Office 10, Riga, LV-1069 (hereinafter also referred to as the “data controller”), collects, processes, and stores personal data obtained from customers and visitors of the online store alvibalt.eu (hereinafter referred to as the “data subject” or “you”).

1.2. Personal data means any information relating to an identified or identifiable natural person (data subject). Processing means any operation performed on personal data, such as collection, recording, alteration, use, viewing, deletion, or destruction.

1.3. The data controller complies with the principles of data processing established by applicable legislation and confirms that personal data is processed in accordance with current legal requirements.

2. Collection, Processing, and Storage of Personal Data

2.1. The data controller collects, processes, and stores personal data primarily through the website of the online store and via email.

2.2. By visiting and using the services provided in the online store, you agree that all provided information will be used and processed for the purposes set out in this Privacy Policy.

2.3. The data subject is responsible for ensuring that the personal data provided is correct, accurate, and complete. Providing knowingly false information is considered a violation of this Privacy Policy. The data subject must immediately inform the data controller of any changes to the provided personal data.

2.4. The data controller is not liable for any damages incurred by the data subject or third parties if they result from the provision of incorrect personal data.

3. Processing of Customers’ Personal Data

3.1. The data controller may process the following personal data:

3.1.1. First name, last name;
3.1.2. Date of birth;
3.1.3. Contact information (email address and/or phone number);
3.1.4. Transaction data (purchased goods, delivery address, price, payment information, etc.);
3.1.5. Any other information provided when purchasing goods or services or contacting us.

3.2. In addition, the data controller has the right to verify the accuracy of the provided data using public registers.

3.3. The legal basis for processing personal data is Article 6(1)(a), (b), (c), and (f) of the General Data Protection Regulation (GDPR):

(a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps prior to entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the controller is subject;
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

3.4. Personal data is stored and processed as long as at least one of the following conditions applies:

3.4.1. The data is necessary for the purposes for which it was collected;
3.4.2. The data controller and/or the data subject can exercise legitimate interests;
3.4.3. There is a legal obligation to retain the data (e.g., accounting laws);
3.4.4. The data subject’s consent remains valid.

After the expiration of these conditions, the personal data is permanently deleted or anonymised.

3.5. In order to fulfil obligations towards you, the data controller may transfer your personal data to partners and data processors (e.g., accountants, courier services, etc.).

Payment processing is carried out via makecommerce.lv, therefore necessary data is transferred to Maksekeskus AS.

Upon request, data may be transferred to state authorities or law enforcement institutions to protect legitimate interests.

3.6. The data controller applies appropriate organisational and technical security measures to protect personal data from accidental or unlawful destruction, alteration, disclosure, or other unlawful processing.

4. Rights of the Data Subject

4.1. In accordance with the GDPR and applicable legislation, you have the right to:

4.1.1. access your personal data and obtain a copy of it;
4.1.2. request correction of inaccurate data;
4.1.3. request deletion of personal data (“right to be forgotten”);
4.1.4. withdraw your consent at any time;
4.1.5. restrict the processing of your data;
4.1.6. lodge a complaint with the Data State Inspectorate.

Requests may be submitted in person at Dammes 32, Office 10, Riga or via email: [email protected].

5. Final Provisions

5.1. This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), as well as applicable legislation of the Republic of Latvia and the European Union.

5.2. The data controller reserves the right to amend or supplement this Privacy Policy at any time. Changes shall take effect upon publication on the website: https://alvibalt.eu/