Privacy policy
1. DATA CONTROLLER
The controller of personal data is SIA "CraftCup", reg. nr. 40203012345, Brīvības iela 85-10, Rīga, LV-1001, email: privacy@craftcup.lv. We process personal data in accordance with EU Regulation 2016/679 (GDPR) and the Personal Data Processing Law of the Republic of Latvia.
2. WHAT DATA WE COLLECT
- When you place an order: first name, last name, email, phone, delivery address, chosen parcel locker/pickup point, order contents.
- When you register an account: name, email, password (encrypted), order history.
- When you pay: transaction data is processed by the payment provider (Paysera, MakeCommerce, Stripe); the shop does not receive or store bank card details.
- Technical data: IP address, browser and device type, cookies (see the Cookie policy for details), data on pages visited.
3. PURPOSES AND LEGAL BASES OF PROCESSING
| Purpose | Legal basis (GDPR) |
|---|---|
| Accepting, packing and delivering orders | Performance of a contract (Art. 6(1)(b)) |
| Issuing invoices, accounting, document retention | Legal obligation (Art. 6(1)(c)) |
| Responding to enquiries and complaints | Performance of a contract (Art. 6(1)(b)) |
| Sending offers and news (if subscribed) | Consent (Art. 6(1)(a)) |
| Analytics and improving the website | Legitimate interest (Art. 6(1)(f)) |
| Fraud prevention and security | Legitimate interest (Art. 6(1)(f)) |
4. RETENTION PERIODS
- Order data and invoices — as required by the accounting legislation of the Republic of Latvia (usually 5 years from the end of the reporting year).
- Account data — until the user deletes the account.
- Marketing lists — until consent is withdrawn (unsubscribe).
5. DATA RECIPIENTS
We share data only to the extent needed to fulfil your order, with the following categories of recipients:
- carriers: Omniva, DPD, Latvijas Pasts, SmartPost Itella (name, phone, address/parcel locker for delivery);
- payment providers: Paysera, MakeCommerce (Montonio), Stripe;
- hosting provider and email service providers (under contract, within the EEA);
- public authorities — only where required by law.
Data transfers outside the EEA (for example, to Stripe) are based on the EU Standard Contractual Clauses (SCC).
6. YOUR RIGHTS
You have the right to: access your data; request its rectification, erasure (the "right to be forgotten") or restriction of processing; receive your data in a machine-readable format (portability); object to processing based on legitimate interest; withdraw your consent to newsletters at any time.
Send your request to privacy@craftcup.lv. We reply within 1 month of receiving the request. If you believe your rights have been violated, you may lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv, info@dvi.gov.lv, Blu maņa iela 26 – 2, Rīga, LV-1011).
7. SECURITY
We apply organisational and technical safeguards: SSL encryption of traffic, role-based staff access, regular backups and data minimisation.
8. CHANGES TO THIS POLICY
The current version of this policy is always available on this page. We will announce significant changes on the site and/or by email. Last updated: 02.10.2026.
Demo text — to be reviewed by a lawyer before a real launch.