Privacy policy
Last updated: April 16, 2025
1. General provisions
1.1 This Privacy Policy explains how the brand ESPdecor (Beāte Laua), registration no. 04059013104, located at Tallinas iela 83, Rīga (hereinafter also referred to as the “Data Controller”) collects, processes, and stores personal data obtained from its clients and visitors to the website www.espdecor.lv (hereinafter referred to as the “Data Subject” or “You”).
1.2 Personal data means any information relating to an identified or identifiable natural person (Data Subject). Processing means any operation performed on personal data, such as collection, recording, transformation, use, viewing, deletion, or destruction.
1.3 The Data Controller complies with legal data processing principles and ensures that personal data are processed in accordance with applicable laws.
2. Collection, processing, and storage of personal data
2.1 The Data Controller mainly collects, processes, and stores personally identifiable information through the online store website and email.
2.2 By visiting and using services on the online store, you agree that any provided information will be used and managed according to this Privacy Policy.
2.3 The Data Subject is responsible for the accuracy, correctness, and completeness of the personal data submitted. Providing false information knowingly is considered a violation of this Privacy Policy. The Data Subject must promptly notify the Data Controller of any changes to submitted data.
2.4 The Data Controller is not responsible for any losses caused to the Data Subject or third parties resulting from false personal data submission.
3. Processing of client personal data
3.1 The Data Controller may process the following personal data:
3.1.1 Full name
3.1.2 Date of birth
3.1.3 Contact information (email and/or phone number)
3.1.4 Transaction data (purchased items, delivery address, price, payment info, etc.)
3.1.5 Any other information provided during purchase or communication with us.
3.2 The Data Controller may verify the accuracy of submitted data through publicly available registries.
3.3 The legal basis for processing personal data is Article 6(1)(a), (b), (c), and (f) of the General Data Protection Regulation (GDPR):
a) The Data Subject has given consent for one or more specific purposes;
b) Processing is necessary for performance of a contract or pre-contractual measures;
c) Processing is necessary for compliance with a legal obligation of the Controller;
f) Processing is necessary for the legitimate interests of the Controller or third party, unless overridden by the rights and freedoms of the Data Subject, especially if the Data Subject is a child.
3.4 The Data Controller stores and processes personal data as long as one of the following applies:
3.4.1 Personal data are needed for the purposes for which they were collected;
3.4.2 The Data Controller or Data Subject can exercise their legitimate interests under law (e.g., lodging objections or legal claims);
3.4.3 There is a legal obligation to retain data (e.g., accounting law);
3.4.4 The Data Subject has given consent for processing, if no other legal basis applies.
Once these conditions cease, the personal data storage period ends and data is irreversibly deleted or anonymized.
3.5 To fulfill obligations to you, the Data Controller may share personal data with partners or data processors acting on its behalf (e.g., accountants, couriers). Payment processing is handled by the payment platform makecommerce.lv, and data needed for payments is shared with its owner, Maksekeskus AS. Upon request, data may also be shared with state or law enforcement agencies to protect legal interests.
3.6 The Data Controller applies organizational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure, or other illegal processing.
4. Data Subject Rights
4.1 In accordance with the General Data Protection Regulation (GDPR) and Latvian law, you have the right to:
4.1.1 Access your personal data, receive information about its processing, request a copy of your personal data in electronic form, and the right to data portability (transfer to another controller);
4.1.2 Request correction of inaccurate, incorrect, or incomplete personal data;
4.1.3 Request deletion of your personal data (“right to be forgotten”), except where the law requires data retention;
4.1.4 Withdraw your previously given consent to personal data processing;
4.1.5 Restrict the processing of your data — the right to request that we temporarily stop processing your personal data;
4.1.6 File a complaint with the Data State Inspectorate (Data Protection Authority).
You can submit requests to exercise your rights by filling out a form in person at Tallinas iela 83, Rīga, or by sending your request electronically to our customer support at info.espdecor@gmail.com.
5. Final Provisions
5.1 This Privacy Policy is developed in accordance with the European Parliament and Council Regulation (EU) 2016/679 (April 27, 2016) on the protection of natural persons with regard to the processing of personal data and free movement of such data (General Data Protection Regulation), as well as the applicable laws of the Republic of Latvia and the European Union.
5.2 The Data Controller reserves the right to make changes or amendments to this Privacy Policy at any time without prior notice. Changes take effect upon publication on the website http://www.espdecor.lv/.