Privacy Policy
Last updated:
This policy explains how we process your personal data when you visit vinylera.eu, place an order, contact us or shop in our store. We process data under the General Data Protection Regulation (GDPR) and Latvian law.
1. Controller
- SIA ALPO Holding, registration No. 40203616872, VAT No. LV40203616872
- Address: Kalnciema iela 40, Riga, LV-1046, Latvia
- E-mail for data protection matters: [email protected]
- Phone: 20616459
2. What data we process and why
| When | Data | Purpose and legal basis |
|---|---|---|
| An order in the online shop | Name, surname, e-mail, phone, delivery address or parcel locker, comment, items ordered, payment and delivery details | Fulfilling the order and contacting you about it — performance of a contract (GDPR Art. 6(1)(b)); keeping invoices and accounting records — legal obligation (Art. 6(1)(c)) |
| A purchase in the shop or a wish-list entry | Name, surname, phone, e-mail, address (if you give it), purchases, records you are looking for | Recording the sale and the invoice; letting you know when a wanted item arrives — performance of a contract or your request |
| The contact form or an e-mail | Name, e-mail, phone (if given), your message | Answering your question — our legitimate interests or steps before entering into a contract |
| Visiting the website | IP address, browser details, pages visited (in server logs); technical error information | Running the website, security and fixing errors — our legitimate interests (Art. 6(1)(f)) |
We do not use your data for automated decision-making or profiling, do not send marketing e-mails and do not sell data to third parties.
3. Who receives the data
We share data only with the service providers the website and the shop need, and only as much as they need:
- Hostinger — hosting of the website and its database (servers in the European Union, Lithuania);
- Cloudflare — the domain's DNS and protection of the website; site traffic, including IP addresses, passes through it;
- Resend — sending order e-mails;
- Google (Gmail) — the shop's mailbox, which receives order notifications and contact form messages;
- Sentry — recording technical errors (data stored in the EU, Germany; without IP addresses or cookies);
- delivery and parcel locker providers — only the details needed for delivery (name, phone, address or parcel locker);
- the bank, our accountant and public authorities (such as the State Revenue Service) where the law requires.
Some providers (Cloudflare, Resend, Google) are based in the USA. Such transfers take place under Chapter V of the GDPR — on the basis of the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
4. How long we keep data
- Orders, invoices and related data — 5 years, as required by the Latvian Accounting Law.
- A client's contact details and wish list — while needed to stay in touch with you, or until you ask us to delete them.
- Contact form messages — while needed to deal with your question, and no longer than 2 years.
- Server logs and error records — briefly, usually up to 90 days.
5. Your rights
You have the right to access, rectify and erase your data, to restrict its processing, to object to processing based on legitimate interests, and to receive your data in a portable format. Data we must keep by law (such as invoices) cannot be erased before the retention period ends.
To use your rights, write to [email protected]. We will reply within one month. If you believe your data is processed unlawfully, you may complain to the Data State Inspectorate of Latvia (www.dvi.gov.lv).
7. Changes to this policy
We may update this policy, for example when adding new payment methods or service providers. The current version is always available on this page, with its date at the top.