1. Introduction

SJR SIA (“we”, “us”, “our”) is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit sjr.lv or make a purchase from our online store.

This policy is compliant with the General Data Protection Regulation (GDPR) and applicable Latvian data protection law.

2. Data We Collect

When you place an order:

• Full name
• Delivery address
• Email address
• Phone number (if provided)
• Payment information (processed securely by Stripe — we do not store card details)
• Order history and transaction records

When you browse our website:

• IP address and browser type (via cookies)
• Pages visited and time spent on site
• Referring website or advertisement

3. How We Use Your Data

• Order fulfilment: processing and delivering your purchase
• Communication: order confirmations, shipping updates, and responding to enquiries
• Legal compliance: meeting our obligations under EU consumer and tax law
• Analytics: understanding how our website is used to improve it (anonymised data only)
• Marketing: only with your explicit consent

4. Legal Basis for Processing

• Contract performance: processing necessary to fulfil your order
• Legal obligation: compliance with EU and Latvian law
• Legitimate interests: improving our service and preventing fraud
• Consent: marketing communications (you may withdraw consent at any time)

5. Third Parties We Share Data With

• Stripe: payment processing — see Stripe’s Privacy Policy
• Klarna: buy now pay later — see Klarna’s Privacy Policy
• Express Post (express.pasts.lv): delivery of your order
• Google Analytics: anonymised website analytics

We do not sell your personal data to any third party.

6. Data Retention

We retain order and transaction data for 5 years as required by Latvian accounting law. Website analytics data is retained for 26 months. You may request deletion of your personal data at any time, subject to legal retention requirements.

7. Your Rights Under GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (“right to be forgotten”), where legally permissible
• Restrict processing of your data
• Data portability — receive your data in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time for consent-based processing

To exercise any of these rights, contact us at sjrisinajumi@inbox.lv. We will respond within 30 days.

8. Cookies

We use cookies to operate the website, process transactions, and analyse traffic. You can manage cookie preferences via the cookie consent banner when you first visit our site. For full details, see our Cookie Policy.

9. Data Security

We use SSL encryption on all pages, secure payment processing via Stripe, and restrict access to personal data to authorised personnel only. In the event of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours.

10. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) at www.dvi.gov.lv.

11. Contact