Privacy Policy
1. Data controller
This Privacy Policy explains how SIA “VALTER” processes personal data in connection with the use of the online store www.valter.lv, orders and customer service.
Controller: SIA “VALTER”
Registration No.: 40203418034
Registered address: “Vējiņi”, Baldones pagasts, Ķekavas
novads, LV-2125, Latvia
Store and correspondence address: Ģertrūdes iela 64, Rīga
Email for personal data enquiries: info@valter.lv
Telephone: +371 26155703
Personal data processing is governed by the General Data Protection Regulation (EU) 2016/679 (GDPR) and other applicable laws. This policy also covers personal data of company representatives and other contacts identified in an order.
2. Data we process and their sources
Depending on the service used and your actions, processing may include:
- Identity and contact details: name, surname, email address, telephone number and company representative contact details.
- Order and delivery details: selected goods, quantity, price, order number, billing details, delivery address or selected collection point and recipient contact details.
- Payment details: payment method, amount, status and transaction identifier, and payer or bank account details where necessary to identify a payment or provide a refund.
- Customer account data, if you create an account: registration details, saved addresses, account settings and order history.
- Communications and after-sales information: enquiries, complaints, withdrawal notices, returns, repair and warranty information, and related correspondence.
- Technical data: IP address, access time, browser and device information, system events and cookie data according to the functions used and your choices.
- Consent and preference records: newsletter subscriptions, opt-outs and cookie choices, where the relevant functions are used.
We receive data from you, your device and payment and delivery providers concerning payment or delivery performance. If another person places an order on your behalf or names you as the recipient, we receive your name and the contact details required for delivery from that person.
Please provide only the information needed for the relevant enquiry or order and do not send payment card security codes or online banking passwords.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Accepting orders, order-related communications, arranging payment, delivery and refunds | Entering into and performing a contract — Article 6(1)(b) GDPR. |
| Pre-purchase advice you request and providing a customer account if you create one | Steps at your request before entering into a contract or performance of a contract — Article 6(1)(b) GDPR. |
| Accounting, tax compliance and handling consumer complaints and statutory claims | Compliance with legal obligations — Article 6(1)(c) GDPR. |
| Communicating with company representatives and recipients designated by another customer | Legitimate interests in fulfilling the order and communicating with the relevant person — Article 6(1)(f) GDPR. |
| General enquiries, system security, fraud prevention and protection of legal claims | Legitimate interests in providing customer service and protecting systems, customers and the company's rights — Article 6(1)(f) GDPR. |
| Newsletters and promotional messages where you subscribe | Your consent — Article 6(1)(a) GDPR. |
| Optional analytics and marketing technologies, if used | Your prior consent — Article 6(1)(a) GDPR and applicable cookie requirements. |
Before processing based on legitimate interests, we assess its necessity and proportionality against your rights and interests.
Processing necessary to fulfil an order or comply with legal obligations does not rely on marketing consent. Reading this policy or making a purchase does not in itself constitute consent to marketing.
4. Whether providing data is mandatory
Mandatory checkout details are necessary to enter into and perform the contract or comply with legal obligations. Without them, we may be unable to accept an order, issue an invoice, deliver goods or communicate about fulfilment.
Providing optional information, subscribing to newsletters and consenting to optional cookies are voluntary. Refusing marketing or optional cookies does not prevent you from making a purchase.
5. Who may receive your data
We disclose only the data necessary for the relevant purpose. Depending on the selected service, recipients may include:
- payment service providers and banks for payments and refunds;
- delivery management platforms, couriers and parcel locker operators for order delivery;
- website maintenance, hosting, IT support and email service providers;
- accounting providers, legal advisers and auditors where necessary for their tasks;
- repair centres, manufacturers or suppliers where disclosure is necessary for a particular repair or warranty claim;
- newsletter, analytics or marketing providers where the relevant service has been implemented and the required consent obtained;
- public authorities and other authorised parties where disclosure is required by law or necessary for the protection of legal claims.
Providers processing data on our behalf act under our instructions and data protection agreements. Some recipients, such as banks, may act as independent controllers; their processing is also subject to their own privacy notices.
6. Transfers outside the European Economic Area
If using a selected service involves transferring personal data outside the European Economic Area, such transfers are permitted only with a lawful basis and safeguards under the GDPR. Depending on the recipient and country, these may include a European Commission adequacy decision or standard contractual clauses together with necessary supplementary measures.
You may request information about specific recipients, destination countries and safeguards, including a copy of the safeguards or information on where to access them, at info@valter.lv. Where a transfer relates to an optional tool, the relevant information must also be provided before that tool is activated.
7. How long we retain data
We retain data only as long as necessary for the relevant purpose. Retention is determined using the following criteria:
- Order data: until the order and related obligations have been fulfilled; afterwards, we retain only the data required for mandatory record-keeping or addressing potential claims within applicable limitation periods.
- Invoices and other accounting records: for the statutory retention period applicable to the type of document.
- Account data: while the account is used and required to provide its services; after account deletion, we separately retain data subject to legal retention obligations or a justified need to protect legal claims.
- Correspondence, returns and repair records: until the matter is resolved and thereafter only as necessary to demonstrate fulfilment of obligations and protect legal claims, taking account of warranty and limitation periods.
- Marketing data: until consent is withdrawn or the relevant mailing activity ends. Minimal opt-out information and evidence of consent may be retained to respect your choice and demonstrate the lawfulness of earlier processing.
- Security logs: as long as necessary to detect and investigate security events; records connected with an identified incident may be retained until it and related claims are resolved.
- Cookie data: according to the duration stated for each cookie and the relevant tool's data retention settings.
After the applicable period, data are deleted or irreversibly anonymised. Where a dispute is ongoing or a legal retention obligation applies, relevant data are retained until that need ends.
8. Cookies and similar technologies
Cookies are small files stored on your device by a website. Similar technologies may be used to store or access information.
Strictly necessary cookies support website functions you request, such as sessions, the shopping basket and secure checkout. Consent is not required insofar as they are genuinely necessary to provide the relevant service.
Optional analytics, personalisation and marketing cookies, if used, may be activated only after you consent. You may refuse or later withdraw consent through the website's cookie settings; withdrawing consent must be as easy as giving it. Continuing to browse does not constitute consent.
Before you make a consent choice, information must be available about cookie names, providers, purposes and durations, as well as relevant data recipients and any transfers outside the European Economic Area.
You can also manage cookies through your browser settings. Blocking strictly necessary cookies may affect the shopping basket, login or other requested functions.
9. Newsletters and promotional messages
If you subscribe, we use the contact details you provide for the messages you have consented to receive. You may withdraw consent at any time using the unsubscribe option in the relevant email or by contacting info@valter.lv.
Unsubscribing from marketing does not affect necessary communications about orders, payments, delivery or complaints. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.
10. Your rights
Subject to the conditions of the GDPR, you have the right to:
- receive information about processing and access your personal data;
- have inaccurate data corrected and incomplete data completed;
- request erasure or restriction of processing where the relevant legal conditions are met;
- receive data you have provided in a structured, commonly used, machine-readable format and request transfer to another controller where processing is automated and based on consent or a contract;
- object, on grounds relating to your particular situation, to processing based on legitimate interests;
- object at any time to direct marketing, including related profiling;
- withdraw consent where processing is based on consent;
- lodge a complaint with a supervisory authority.
The right to erasure is not absolute: data may need to be retained to comply with legal obligations or protect legal claims.
Send requests to info@valter.lv. Where we have reasonable doubts about your identity, we may request only the additional information necessary to verify it. We inform you of action taken without undue delay, normally within one month. For complex or numerous requests, this may be extended by two further months; we will inform you of the extension and reasons within the first month.
Latvia's supervisory authority is the Data State Inspectorate (Datu valsts inspekcija): https://www.dvi.gov.lv. You may also contact another competent supervisory authority, including in the Member State of your habitual residence, workplace or the alleged infringement.
11. Security and automated processing
We apply technical and organisational measures appropriate to the risk and restrict access to persons who need it to perform their duties.
If a particular service is intended to use solely automated decision-making, including profiling, that produces legal or similarly significant effects on you, we provide separate information before such processing about its basis, the logic involved, its significance, envisaged consequences and your rights. Independent processing by a payment or financing provider must also be described in that provider's privacy notice.
12. Changes to this policy
We may update this policy when services, processing activities or legal requirements change. The current version is published at www.valter.lv. Material changes are communicated appropriately; updating the policy does not replace obtaining fresh consent where required.