When registering on the website www.e.sakret.lv (hereinafter - the Website), you entrust the limited liability company "SAKRET", registration number 40003622109, as the data controller of your personal data (hereinafter - "We" and/or "SAKRET"), and grant us the right to process it in accordance with this Privacy Policy and the terms of use of the Website (hereinafter - the Terms) in the scope, manner and for the purposes set forth therein.
It is important for us to protect everyone's right to privacy and ensure that personal data is processed in accordance with regulatory requirements. Therefore, we have prepared and published this Privacy Policy to provide every client, website visitor, and user with easy-to-understand information about the purpose of our processing of personal data, the legal basis for processing, the scope of processing, processing deadlines, protection measures, as well as the data subject's rights in connection with the processing of personal data.
Personal data is processed in accordance with the laws of the Republic of Latvia, the European Parliament and Council Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter - the Regulation), as well as other laws and regulations in the field of privacy and personal data processing.
1. What are personal data and what categories of personal data do we process and why?
Personal data is any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as the data subject's name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
1.1. Registration, management of your account and participation
We process your personal data to create your SAKRET account and manage your participation. In order for us to create your account and manage your participation, you must provide personal data necessary for the conclusion and performance of the contract. The fields that are mandatory to fill in during the registration process are marked with an asterisk (*).
Categories of personal data processed:
- Identification information (e.g. name, surname, username, etc.). Contact information (e.g. email, phone number, address, etc.).
- Authentication information (e.g. verification code, etc.).
- Purchase history (e.g. information about previously purchased goods and amounts, etc.).
- Order information (e.g. order ID, ordered goods, prices of goods, delivery method, etc.).
- Payment information (e.g. bank account number, payment card number, etc.).
- Delivery information (e.g. delivery date and time, delivery address, etc.).
- Customer preference data (e.g. language settings, consents).
- User-generated personal data (e.g. saved shopping list, etc.).
Legal basis
- To enter into and fulfill a contract with you.
- Consent - to store credit card information in the SAKRET account.
- Protection of our legitimate interests and fulfillment of legal obligations that arise and are applicable to us.
Data processing time
- See point - How long are personal data stored?
When registering on the website, you must accept the terms of use of the website (agree to the contract). Submitting your personal data is mandatory if you want to use SAKRET services as a registered user. By registering, you enter into a contract and confirm that the personal data provided by you is accurate and correct.
1.2. Processing of your purchase data
We process your personal data so that you can make purchases on the website (with or without creating a profile), make payments, and so that we can provide you with refunds according to the terms of the contract (if you return the purchased goods to us), prepare accounting justification documents (such as invoices, etc.), organize the delivery of ordered goods, as well as perform and/or provide other purchase-related activities/functions.
Categories of processed personal data
- Identification information (e.g. name, surname, etc.).
- Contact information (e.g. email, phone number, address, etc.).
- Order information (e.g. order ID, ordered products, product prices, delivery method, etc.).
- Delivery information (e.g. delivery date and time, delivery address, etc.).
- Payment information (e.g. bank account number, credit card number, etc.).
Legal basis
- Your concluded agreement (which you enter into with us or another relevant seller, and/or the created account) to fulfill the obligations of the agreement, as well as for the protection of our legitimate interests and the fulfillment of legal obligations that arise and are applicable to us.
Data processing time
- See point - How long are personal data stored?
1.3. Direct marketing
We process your personal data to send you SAKRET marketing offers and/or offers from other merchants, such as information about discounts, news, personalized offers (recommendations), etc. The information is sent to you through your chosen communication channel, such as email and/or website. To express your desire and consent to receive marketing offers, you will need to click on the appropriately marked fields when registering or making a payment without registration. If you do not want to receive marketing offers, you can withhold your consent, or if you have given your consent to receive marketing offers, you can unsubscribe from them or change your selected notification delivery methods (channels) at any time.
Categories of processed personal data
- Identification information (e.g. name, surname, etc.).
- Contact information (e.g. email, phone number, address, etc.).
- Purchase history (e.g. information about previously purchased goods and amounts, etc.).
- Customer preference data (e.g. consent, participation in loyalty programs (bonus system), etc.).
- User-generated personal data (e.g. saved shopping lists, etc.).
Data processing time
- While your consent is valid, you can withdraw it at any time by adjusting the corresponding settings in your SAKRET account or clicking on the opt-out link in the email, or by contacting us, see the section - How can you exercise your rights?
To achieve the aforementioned purposes, we use automated data analysis and decision-making, including profiling. We take into account the personal data provided by you and/or personal data generated by you (e.g., saved wish lists, etc.), as well as your purchase history.
1.4. Compliance with legal requirements
We process your personal data to comply with several legal requirements that apply to us, such as accounting requirements. We retain transaction information and documentation related to your order (e.g., order data, invoices, credit notes, return data, etc.) for the period required by law.
Categories of processed personal data
- Identification information (e.g. name, surname, username, etc.).
- Order information (e.g. order ID, ordered items, prices of items, delivery method, etc.).
- Payment information (e.g. bank account number, credit/debit card number, etc.).
- Delivery information (e.g. delivery date and time, delivery address, etc.).
Legal basis
- Our legitimate interests.
Data processing time
- See point - How long are personal data stored?
1.5. Handling of requests, complaints, inquiries, and feedback
We process your personal data to respond to your requests, complaints, inquiries, and manage the feedback you provide.
Categories of processed personal data
- Identification information (e.g. name, surname, username, etc.).
- Contact information (e.g. email address, phone number, address, etc.).
- Information about the event (e.g. type of event, event description, etc.).
- Other documents and/or data submitted with the request (e.g. purchase invoice, receipt, delivery note data, product photographs, etc.).
Legal basis
- Processing is necessary to fulfill a legal obligation applicable to us (reviewing and responding to your requests).
- As well as our legitimate interests in evaluating your feedback as a customer to improve our operations and service quality to you, and for the protection of our legitimate interests.
Data processing time
- See point - How long are personal data stored?
1.6. Statistics and market research
We want the use of SAKRET website to be as easy and convenient as possible, our services to buyers (customers) to be relevant and useful, and customer experience to be as good as possible. We constantly work to ensure that our product range, suitable promotions, and discounts meet the needs of our customers, including yours. By conducting statistics and market research, as well as preparing the necessary reports for our business, we use non-personalized data, i.e., we do not process your name, contact information, and other information that individualizes you.
Categories of processed personal data
- Order information (e.g. ordered goods, product prices, delivery method, etc.).
Legal basis
- Processing is necessary to ensure compliance with our legitimate interests to improve and expand our services.
Datu apstrādes laiks
- As long as it is necessary for us to ensure our legitimate interests.
2. From which sources do we obtain and collect your personal data?
In most cases, we receive personal data directly from you when, for example, you create a SAKRET user account, place an order, communicate with us, use our platforms and tools.
3. Do we transfer customer personal data outside of the EU/EEA?
We do not transfer personal data to third countries (outside of the European Union and the European Economic Area).
4. How long do we keep your personal data?
Your personal data will be stored for as long as necessary to achieve the respective processing purposes, while complying with legal requirements, after which your personal data will be deleted unless a longer data retention period is provided for in legal acts.
Your personal data that you store in your SAKRET account will be kept for as long as the account is active or until you delete them from your SAKRET account.
Documentation related to your order (e.g., invoices, advance invoices, credit notes, return data, etc.) will be kept for at least 5 years, in compliance with the Accounting Law requirements. For example, credit card data saved in your account (if you have saved them) will be kept for as long as your account is active or until you withdraw your consent.
All personal data related to claims (requests) will be kept for no longer than two years from the date of receiving the claim (request). Personal data may be kept longer if the claim (request) has not yet been resolved or if legal proceedings are ongoing. In this situation, personal data will be kept until the claim (request) is resolved or 1 year after the end of the respective legal proceedings.
In the event of a legal requirement, data will be processed until the investigation, settlement, and enforcement of the legal claims are completed. If no violation is detected during the investigation, data will be kept for 1 (one) year after the investigation ends. If a violation is detected, data will be kept for 3 (three) years after the investigation ends or until the final execution of the court decision.
5. Who do we disclose your personal data to?
We may transfer your personal data to data recipients for processing - individuals who help us to perform and administer the provision of services, provide us with services related to the administration of your requests (orders), such as data center service providers, information system development and maintenance service providers, web development and maintenance service providers, delivery service providers, debt recovery service providers, related companies, etc. In any case, we only provide data processors with as much data as is necessary for the performance of a specific task or the provision of a specific service. Our contracted data processors may process your personal data only in accordance with our instructions and may not use them for other purposes or disclose them to other individuals. In addition, they must ensure the protection of your personal data in accordance with applicable laws and in accordance with our cooperation agreement.
We disclose your personal data to sellers from whom you purchase goods. In any case, we only provide your personal data to the extent necessary for the execution of a specific order. In this case, the seller processes your personal data as an independent data controller, so before purchasing goods and concluding a purchase-sale agreement with the seller, we invite you to familiarize yourself with the relevant privacy policy of the seller.
We disclose your personal data upon request by a state institution in connection with legal proceedings, a court order, or in connection with proceedings of state institutions.
6. What are your rights and how can you exercise them?
Data protection legislation provides you with many rights that you can freely exercise, and we provide you with the opportunity to exercise them. Information on your specific rights and how to exercise them is provided in this privacy policy. We ask you to read it carefully.
6.1. Right to access personal data we process
You have the right to receive information on whether we process your personal data, as well as the right to access our processed personal data and information about the purposes of data processing, categories of processed data, categories of data recipients, data processing period, data sources, automated decision-making, including profiling, as well as their significance and consequences for you.
If you are a registered user of the website, you can access our processed personal data in your user account at any time (e.g., check the information on your submitted personal data, update information, your consents, etc.).
You can also always contact us in the ways indicated in point 8 of this privacy policy.
6.2. Right to rectify personal data
If the data you provided during registration has changed or you see that our processed information about you is inaccurate or incorrect, you have the right to request to change, specify or correct this information by contacting us in the ways indicated in point 8 of this privacy policy. You can also independently update your data (information) in your website account.
6.3. Right to withdraw consent
In cases where we process your data with your consent, you have the right to withdraw your consent to the processing of personal data at any time. You can withdraw your consent by contacting us in the ways indicated in point 8 of this privacy policy or by independently changing the consent conditions in your website account.
Withdrawal of consent does not affect the lawfulness of processing based on consent before withdrawal.
6.4. Right to lodge a complaint
If you believe that we are processing your personal data in violation of data processing/protection legislation requirements, we first ask you to contact us directly. In any case, you have the right to lodge a complaint with the supervisory authority, particularly in the member state where you have your habitual residence, workplace, or the alleged infringement took place, if you believe that the processing of your personal data violates the Regulation.
The supervisory authority for data protection in Latvia is the Data State Inspectorate www.dvi.gov.lv.
6.5. Right to erasure (right to be forgotten)
Subject to certain conditions provided for in certain data processing legislation, you have the right to request that we erase your personal data (for example, if the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, you withdraw your consent and there is no other legal basis for processing, the personal data was processed unlawfully, etc.). However, this does not apply to cases where the law requires us to retain personal data. You can delete some information yourself in your account on our website or by submitting a written request (application) in the ways specified in point 8 of this privacy policy.
6.6. Right to restrict processing
Subject to certain conditions provided for in certain data processing legislation (for example, if you dispute the accuracy of the personal data, the personal data is processed unlawfully, but you do not want it to be deleted, the personal data is no longer necessary for our processing purposes, but you request them in connection with raising, enforcing or defending a legal claim, etc.), you have the right to restrict the processing of your personal data.
If you want to exercise the rights set out in this section, please submit a written request in the ways specified in point 8 of this privacy policy.
6.7. Right to data portability
You have the right to receive or transmit your personal data to another data controller ("data portability"). This right applies only to data that you have provided to us on the basis of your consent or a contract and if processing is carried out automatically. If you want to exercise the rights set out in this section, please submit a written request in the ways specified in point 8 of this privacy policy.
7. How do we handle your requests?
To protect our customers' personal data from unlawful disclosure, when we receive your request (demand) for providing your personal data or any other implementation of your rights, we need to verify your identity. For this purpose, we may ask you to provide your currently registered data on our website (such as email address or phone number) and then compare whether the information you provided matches the registered user data. If the verification process is unsuccessful (for example, the information you provided does not match the information on your registered account), we will not be able to provide the requested information or fulfill your request.
After successfully completing the aforementioned verification process and receiving your request (demand) for the implementation of any of your rights, we commit to providing you with the requested information as soon as possible, but no later than one month from the date of receiving your request (demand). Considering the complexity and number of requests, we reserve the right to extend the one-month period for up to two more months, informing you of the reasons for such extension by the end of the first month.
We will refuse to satisfy your request (demand) with a motivated response if the circumstances specified by the law are identified and if we cannot provide you with the requested information, we will inform you about it in writing.
8. How can you exercise your rights?
If you wish to exercise your rights stated in this privacy policy, you can submit your requests in one of the following ways:
- by signing and sending a securely electronically signed document to the email address info@sakret.lv (in this case, the electronically signed document must also include the desired method of receiving the response);
- by sending a written request to the legal address of SIA "SAKRET": Ritvari, Rumbula, Stopiņi parish, Ropaži district, LV-2121 (in such cases, the response will be provided only in a registered letter);
- by submitting an application from your user account on our website.
9. Cookies
We use cookies (a small information file that is sent to your computer or other device, such as a mobile phone, when you visit our website and is stored in your web browser) with the purpose of storing data to recognize you as a user of our services when you visit our website. Cookies help us to ensure the operation and functionality of our website, provide you with services, collect analytical and statistical information about browsing our website, and carry out marketing activities.
More information about cookies and their use is provided in the Cookie Policy: https://e.sakret.lv/cookie-policy.
10. How we ensure the security of your personal data?
To protect your personal data from unauthorized access, unlawful processing or disclosure, accidental loss, alteration, or destruction, we take appropriate measures to comply with applicable legal requirements. These measures include technical measures, such as appropriate selection and configuration of computer systems, ensuring security of relevant connections, protection of data and files, as well as organizational measures, such as access restrictions to these systems and files.
11. Changes to the Privacy Policy
The Privacy Policy may be updated or adopted in a new version from time to time. The current version of the Privacy Policy is always available on the website. When making changes to the Privacy Policy, we will inform you of the adoption of the new version, indicating the current date of the Privacy Policy in the document and making it available on the website.
12. How to contact us?
If you have any questions or uncertainties related to this Privacy Policy or personal data processing, please contact us using the contact information provided below.
SIA "SAKRET", Ritvari, Rumbula, Stopiņu pagasts, Ropažu novads, LV-2121.
- phone: +371 67803650
- e-mail: info@sakret.lv
