Privacy policy
Last updated: [Date]
PRIVACY POLICY Draft for review before publication Last updated: 28 October 2026
-
ABOUT US AND THIS POLICY This Privacy Policy explains how your personal data is processed on the SHOPAHOLIC online store website, shopaholic.lv, when you visit the website, make a purchase or contact us.
The controller of your personal data is the legal owner of the store: Legal entity name or sole trader's full name: SIA SHOPAHOLIC
Registration number, if applicable: 40203507718
Registered or business address: Lielā iela 129, Mārupe, LV2167, Latvia
Email for personal data enquiries: info.shopaholicshop@gmail.com
Contact address: Lielā iela 129, Mārupe, LV2167, Latvia
The SHOPAHOLIC brand name does not replace the controller's legal name. Complete and verify the details above before publication.
We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Latvian laws. This Policy provides information about data processing; simply visiting the website does not constitute consent to all types of processing. -
WHAT DATA WE COLLECT Depending on the services you use, we process:
• Contact details — first name, last name, email address and telephone number;
• Order details — products purchased, quantities, prices, delivery and billing addresses, and selected delivery and payment methods;
• Payment details — payment status, amount, transaction identifier and information needed for refunds;
• Correspondence and requests — your questions, complaints, return requests and information you provide when contacting us;
• Technical data — IP address, browser and device information, access and security logs, and cookie data necessary for the operation of the website;
• Customer account data, if you create an account — contact details and order history associated with the account;
• Consents and preferences — for example, cookie preferences and, if you subscribe to newsletters, evidence of your consent to receive them. Payment card details and bank authentication credentials are processed by the relevant payment service provider. Do not send us your full card number, security code or online banking login details by email. We receive data directly from you, automatically when you use the website, and from Shopify and payment and delivery service providers, for example payment or delivery status information
- PURPOSES AND LEGAL BASES FOR PROCESSING Placing and fulfilling orders. We use data to accept orders, process payments, deliver products and send order-related notifications. Legal basis: taking steps to enter into and performing a contract (Article 6(1)(b) GDPR).
Customer service and returns. We answer questions, handle withdrawal requests and claims, and arrange returns and refunds. Depending on the request, the legal basis is performance of a contract, compliance with a legal obligation or our legitimate interest in responding appropriately to other correspondence.
Accounting and compliance with legal requirements. We retain transaction records and provide information required by law to competent authorities. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).
Website security and protection of legal rights. We use necessary technical and transaction data to prevent fraud, investigate incidents and protect legal claims. Legal basis: our legitimate interests in ensuring the security of the store and its customers and defending our rights (Article 6(1)(f) GDPR), taking your rights and interests into account.
Newsletters. If we offer newsletter subscriptions and you give separate consent, we use your contact details to send newsletters. Legal basis: consent (Article 6(1)(a) GDPR). You may withdraw consent through the unsubscribe link in a message or by contacting us. Unsubscribing does not stop notifications necessary to fulfil your order. Consent to newsletters is not a condition of purchase.
Optional cookies. If used, these are activated only after the relevant consent has been obtained.
If you do not provide data necessary to fulfil an order, we may be unable to accept or deliver it. Refusing to provide optional data or marketing consent does not, in itself, prevent you from shopping. - WHO MAY RECEIVE YOUR DATA We share only the data necessary for the relevant purpose with:
• Shopify — to provide the online store platform, hosting, order management and related technical functions;
• Selected payment service providers — to process, verify and refund payments; • Selected delivery service providers — to prepare and deliver shipments and send delivery notifications;
• Accounting, IT, email and other technical service providers — insofar as necessary to provide the relevant services;
• Professional advisers and competent authorities — where necessary to comply with legal obligations or protect legal rights.
Depending on the service, providers may act as our processors or as independent controllers. Processing by independent controllers is described in their own privacy policies. You may request information about the service providers involved in your order by contacting us. - SHOPIFY AND TRANSFERS OUTSIDE THE EEA
Our store operates on the Shopify platform. Due to the activities of Shopify and its service providers, personal data may also be processed outside the European Economic Area (EEA), including in Canada and the United States. Where data is transferred outside the EEA, the legal mechanism required for the relevant transfer is applied, such as a European Commission adequacy decision or Standard Contractual Clauses and, where necessary, supplementary safeguards. You may request information about specific transfers and copies of, or access to, the applicable safeguards from us. Shopify privacy information: https://www.shopify.com/legal/privacy Shopify information on international data transfers: https://help.shopify.com/en/manual/privacy-and-security/privacy/international-data-transfers -
COOKIES
Cookies are small files that a website stores on your device. Strictly necessary cookies support functions such as the shopping cart, sessions, security and your privacy preferences. We use them to operate the website and provide the functions you request.
Analytics, advertising and other optional cookies require prior consent. If such cookies are implemented, you must be able to reject them and later change your preferences or withdraw consent through the website's cookie settings. You can also delete or block cookies in your browser settings; blocking necessary cookies may interfere with shopping cart and checkout functionality.
General information about Shopify cookies: https://www.shopify.com/legal/cookies. This general page does not replace a cookie list specific to this store.
- DATA RETENTION
We retain data only for as long as necessary for the relevant purpose:
• Order and transaction data — for performance of the contract and subsequently for applicable accounting, tax and legal-claim retention periods;
• Customer correspondence and complaint data — until the matter is resolved and subsequently for as long as reasonably necessary to defend relevant claims; • Account data — while the account remains active; after closure, we retain only data that must be kept on another legal basis;
• Newsletter subscription data, where applicable — until consent is withdrawn or newsletters are discontinued; necessary evidence of consent and records of opting out may be retained to demonstrate compliance and honour unsubscribe requests;
• Security logs — for the period necessary to prevent and investigate incidents, taking the particular threat into account;
• Cookie data — for the periods specified in the relevant cookie list.
Retention periods depend on the relevant purpose, legal requirements and applicable limitation periods. Once the basis for retention no longer applies, we delete or irreversibly anonymise the data. - YOUR RIGHTS
Under the conditions set out in the GDPR, you have the right to access your personal data and obtain a copy, rectify inaccurate data, request erasure or restriction of processing, and receive portable data where the requirements for data portability are met.
You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interests. You may object to the use of your data for direct marketing at any time.
Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal. The right to erasure is not absolute: certain data may need to be retained due to legal obligations or legal claims.
To exercise your rights, email info.shopaholicshop@gmail.com. If we have reasonable doubts about your identity, we may request only the additional information necessary to verify it. We will respond without undue delay, normally within one month. In complex cases or where there are numerous requests, this period may be extended by a further two months; we will inform you of the extension and the reasons for it within the first month.
You have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija): https://www.dvi.gov.lv. You do not have to contact us first before lodging a complaint. - DATA SECURITY We apply technical and organisational measures appropriate to the risks of processing to reduce the risk of unauthorised access, loss or disclosure. Access to data is restricted according to job responsibilities. No information system can guarantee absolute security.
- CHANGES TO THIS POLICY We update this Policy when the store's operations, data processing or applicable requirements change. We publish the current version and its last updated date on this page. Where necessary, we separately inform you of material changes and obtain consent before new processing activities where consent is required.