PRIVACY POLICY

artishok.lv

Last updated: April 2026

1. Introduction and Identity of the Data Controller

This Privacy Policy explains how SIA “ARTPLAY” (“we”, “us”, or “our”) collects, uses, stores, and discloses personal data when you visit or make a purchase from https://artishok.lv (the “Site”), or when you otherwise interact with us (collectively, the “Services”).

This Policy is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and applicable Latvian data protection legislation.

Data Controller: SIA “ARTPLAY”

Registration Number: 40103907804

Website: https://artishok.lv

Email: info@artishok.lv

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with these terms, please do not use our Services.

2. Personal Data We Collect

Depending on how you interact with our Site, we may collect the following categories of personal data:

2.1 Data You Provide Directly

Basic contact details: full name, email address, phone number, postal address.
Order and transaction information: billing address, shipping address, payment confirmation reference.
Account credentials: username, hashed password, security questions.
Shopping behaviour: products viewed, items added to cart or wishlist.
Customer support communications: messages and enquiries you send to us.

2.2 Device and Technical Information

When you visit the Site, we automatically collect certain technical data, including:

IP address and approximate geographic location.
Browser type and version.
Operating system and device type.
Pages visited, referral URLs, and on-site navigation patterns (Usage Data).
Date and time of access.

This technical data is collected via cookies and similar tracking technologies as described in Section 8 below.

3. Legal Basis for Processing

We process your personal data only where a valid legal basis exists under Article 6 GDPR:

a) Contractual Necessity (Art. 6(1)(b) GDPR): Processing is necessary to perform a contract with you, including processing orders, arranging delivery, managing returns, and sending transactional notifications.

b) Consent (Art. 6(1)(a) GDPR): Where you have freely given, specific, informed, and unambiguous consent, for example, for receiving marketing communications by email or SMS, and for the placement of non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

c) Legitimate Interests (Art. 6(1)(f) GDPR): We may process certain data where it is in our legitimate interests to do so and where those interests are not overridden by your rights — for example, for website analytics to improve user experience, fraud prevention, and security monitoring.

d) Legal Obligation (Art. 6(1)(c) GDPR): Where processing is required to comply with applicable law, including Latvian tax and accounting legislation (e.g., the Law on Accounting, the Value Added Tax Law).

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

Processing and fulfilling your orders, including payment processing and delivery coordination.
Creating and managing your customer account.
Sending order confirmations, shipping updates, and other service-related notifications.
Responding to your enquiries and providing customer support.
Sending marketing and promotional communications, where you have provided consent.
Conducting website analytics to understand how visitors interact with the Site and to improve it.
Detecting, investigating, and preventing fraudulent transactions, security incidents, or unlawful activity.
Complying with legal obligations under applicable EU and Latvian law.
Enforcing our Terms and Conditions and protecting the rights and safety of our users.

5. Sharing Personal Information

We do not sell your personal data. We may disclose your personal data to the following categories of recipients, strictly for the purposes described in this Policy:

Payment service providers: to securely process your payment transactions. These providers act as independent data controllers for payment processing and are subject to their own privacy obligations under applicable law and PCI-DSS standards.
Logistics and delivery partners: to fulfil and ship your orders. These partners receive only the data necessary to complete delivery (name, address, phone number).
IT infrastructure and hosting providers: companies that support the technical operation of our Site and services (e.g., cloud hosting, data storage).
Analytics providers: third parties that help us understand how our Site is used, subject to appropriate data processing agreements.
Legal and regulatory authorities: where required to comply with a legal obligation, court order, or to protect our legal rights.
Business successors: in the context of a merger, acquisition, or sale of assets, subject to confidentiality obligations.

All third-party processors with whom we share personal data are bound by data processing agreements under Article 28 GDPR, ensuring they process your data only on our instructions and in accordance with applicable data protection law.

6. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law.

Order and transaction data: retained for a minimum of five (5) years as required under Latvian accounting and tax legislation (Law on Accounting, Value Added Tax Law).
Customer account data: retained for as long as your account is active, plus a reasonable period thereafter in case of disputes or legal claims.
Marketing data: retained until you withdraw consent or opt out.
Website usage and analytics data: retained in aggregated or anonymised form for up to 26 months.
Customer support records: retained for up to three (3) years from the date of the last interaction.

When personal data is no longer required, we will securely delete or anonymise it in accordance with our internal data retention procedures.

7. Your Rights as a Data Subject (GDPR)

Under the GDPR, you have the following rights with respect to your personal data. You may exercise any of these rights by contacting us at info@artishok.lv. We will respond within one (1) calendar month of receiving your request.

a) Right of Access (Art. 15 GDPR): You have the right to obtain confirmation of whether we process personal data about you and, if so, to request a copy of that data.

b) Right to Rectification (Art. 16 GDPR): You have the right to request the correction of inaccurate personal data we hold about you, or to have incomplete data completed.

c) Right to Erasure / ‘Right to be Forgotten’ (Art. 17 GDPR): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies.

d) Right to Restriction of Processing (Art. 18 GDPR): You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while a dispute is being resolved.

e) Right to Data Portability (Art. 20 GDPR): Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.

f) Right to Object (Art. 21 GDPR): You have the right to object at any time to processing of your personal data based on legitimate interests (Art. 6(1)(f)), including profiling. You also have an absolute right to object to processing for direct marketing purposes at any time.

g) Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

h) Right not to be Subject to Automated Decision-Making (Art. 22 GDPR): You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects.

i) Right to Lodge a Complaint: If you believe we are not handling your personal data in accordance with applicable law, you have the right to lodge a complaint with the competent supervisory authority:

Data State Inspectorate of Latvia (Datu valsts inspekcija)

Address: Elijas iela 17, Rīga, LV-1050, Latvia

Website: www.dvi.gov.lv

Email: info@dvi.gov.lv

Phone: +371 67223131

8. Cookies and Tracking Technologies

8.1 What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow the website to recognise your device and remember certain information about your preferences or past actions. Similar technologies include web beacons, pixels, and local storage.

8.2 Categories of Cookies We Use

Strictly Necessary Cookies: These cookies are essential for the Site to function and cannot be disabled. They are set in response to actions you take, such as setting privacy preferences, logging in, or completing a purchase. No consent is required for these cookies.

Performance and Analytics Cookies: These cookies collect information about how visitors use the Site, such as which pages are visited most often and whether error messages are received. This data is used in aggregated, anonymised form to improve Site performance. Placement of these cookies requires your consent.

Functionality Cookies: These cookies allow the Site to remember choices you make (such as language or shopping cart contents) and provide enhanced, personalised features. Consent is required.

Marketing and Targeting Cookies: These cookies may be used to deliver advertisements that are relevant to you and your interests. They also help limit the number of times you see an advertisement. Placement requires your explicit consent.

8.3 Managing and Withdrawing Consent

When you first visit the Site, you will be presented with a Cookie Consent Banner that allows you to accept or reject non-essential cookies by category. You may change or withdraw your cookie preferences at any time by clicking the “Cookie Settings” link in the footer of the Site.

You may also manage cookies through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when a cookie is set. Please note that disabling certain cookies may affect the functionality of the Site.

For guidance on managing cookies in popular browsers:

Google Chrome: Settings > Privacy and Security > Cookies
Mozilla Firefox: Options > Privacy & Security > Cookies and Site Data
Apple Safari: Preferences > Privacy
Microsoft Edge: Settings > Cookies and Site Permissions

9. Children’s Data

Our Services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us immediately at info@artishok.lv and we will take steps to delete such information.

10. Security of Your Personal Data

We implement appropriate technical and organisational measures to protect your personal data against accidental loss, destruction, alteration, unauthorised disclosure, or access, in accordance with Article 32 GDPR. These measures include encrypted data transmission (TLS/SSL), access controls, and regular security reviews.

While we take all reasonable precautions, no method of transmission over the internet is completely secure. We cannot guarantee absolute security of data transmitted to or from our Site.

11. Third-Party Websites and Links

Our Site may contain links to third-party websites. This Privacy Policy applies solely to our Site and Services. We are not responsible for the privacy practices of third-party websites and encourage you to review their respective privacy policies before providing any personal data.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or regulatory guidance. When we make material changes, we will update the “Last updated” date at the top of this document and, where appropriate, notify you by email or a prominent notice on the Site.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

13. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

SIA “ARTPLAY”

Registration No.: 40103907804

Website: https://artishok.lv

Email: info@artishok.lv

Address: Rīga, Kuldīgas iela 13A – 38, LV-1007

We will do our best to address your request promptly and in any event within one (1) calendar month, as required under Article 12 GDPR.