This Privacy Policy explains how we collect, use, store and process your personal data, so please read it carefully before you start using the services of SIA "ELYNDI". When registering on or otherwise using the website of SIA "ELYNDI", you will be asked to confirm that you have read and understood this Privacy Policy.

Definitions used:

Personal data – any information relating to an identified or identifiable natural person.

Data subject – an identified or identifiable natural person (hereinafter – the Customer).

Profiling – automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person.

Controller – SIA "ELYNDI".

Processor – a natural or legal person who processes personal data on behalf of the controller, SIA "ELYNDI".

Third party – a natural or legal person, public authority, agency or body other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Consent of the data subject (Customer) – any freely given, specific, informed and unambiguous indication of the Customer's wishes, by a statement or by a clear affirmative action, signifying that the Customer agrees to the processing of their personal data.

Cookies – text files stored on the device used by the user in order to personalise the usability of the SIA "ELYNDI" website for each individual user of the website.

1. General Provisions

1.1. SIA "ELYNDI" is committed to protecting and respecting your privacy. We do everything possible to ensure that our processing of personal data complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

1.2. The controller of your personal data is SIA "ELYNDI", unified registration number: 41203051814, legal address: Rīga, Klijānu iela 10, LV-1013, telephone number: +371 26623075.

1.3. The processors of your personal data are legal persons that process personal data on behalf of SIA "ELYNDI" and in accordance with the instructions of SIA "ELYNDI", and that have undertaken to comply with the requirements of the law in the field of data processing.

1.4.1. When processing personal data, the Controller:

1.4.1. ensures that personal data are processed lawfully and fairly;

1.4.2. respects the rights of the Customer;

1.4.3. provides the Customer with transparent information on the fact that their personal data are collected, used, consulted or otherwise processed, and on the extent to which the personal data are or will be processed, stating the specific purposes of the processing;

1.4.4. ensures that personal data are adequate, relevant and necessary for the purposes for which they are processed. The Controller processes only such data, and only to such an extent, as corresponds to the Controller's business activities in order to provide services/sell goods.

1.4.5. ensures that personal data are not kept for longer than necessary, that is, for as long as the contract concluded with the Customer is in force; for as long as the Controller or the Customer can pursue their legitimate interests in accordance with the procedure laid down in external laws and regulations; for as long as either party has a legal obligation to store the data; or for as long as the Customer's consent to the relevant processing of personal data remains valid, where there is no other lawful basis for the processing. Once the retention period for the personal data has expired, the personal data are irreversibly erased.

1.4.6. ensures that personal data are accurate and that inaccurate personal data are rectified or erased.

1.4.7. ensures that personal data are processed in a manner that ensures appropriate security and confidentiality of the personal data, including by preventing unauthorised access to or use of personal data and unauthorised access to the systems and equipment used for data processing.

1.4.8. ensures that personal data are not transferred without secure and adequate protection.

1. Legal Bases for the Processing of Personal Data

2.1. Your personal data are processed on the following legal bases:

• Article 6(1)(a) of the General Data Protection Regulation – where your consent has been obtained;
• Article 6(1)(b) of the General Data Protection Regulation – for the performance of a contract;
• Article 6(1)(c) of the General Data Protection Regulation – for compliance with a legal obligation;
• Article 6(1)(f) of the General Data Protection Regulation – for the protection of our legitimate interests or those of third parties;

2.2. If you choose not to provide some of your personal data, or withdraw your consent in full or in part (with regard to specific data provided), SIA "ELYNDI" will not be able to provide the Customer with the services that require the relevant personal data.

1. Personal Data and the Purposes of Processing

3.1. The Controller processes personal data for the following purposes:

3.1.1. to identify the Customer;

3.1.2. to prepare and conclude a contract;

3.1.3. to deliver goods and provide services (to perform contractual obligations);

3.1.4. to advertise and distribute goods, i.e. for commercial purposes;

3.1.5. to provide customer service;

3.1.6. to create and manage the Customer's profile;

3.1.7. to examine and handle objections;

3.1.8. to administer payments;

3.1.9. to improve the operation of the website;

3.1.10. for statistics and market research;

3.1.11. to ensure security.

3.2. The Controller processes the following personal data:

3.2.1. for processing registration data – first name, surname, email address, password.

3.2.2. for processing delivery data – first name, surname, email address, mobile phone number, address, delivery method, payment method, payment information.

3.2.3. cookies – the Customer's browsing history and behaviour on the Controller's website.

3.2.3. for processing accounting data – order history, payment information, delivery information.

3.2.3. for marketing information – first name, surname, telephone number, email address, device identification number. 3.2.3. for claims – first name, surname, contact details, order and delivery information.

3.3. Personal data are processed for commercial purposes only if the Customer has given a freely given, specific, informed and unambiguous indication that they agree to such activities. The Customer may object to receiving commercial communications in accordance with the law by not giving their consent to receive commercial communications (read more about commercial communications in Section 6 of this Policy).

3.4. Personal data may be processed by automated means, including by profiling the Customer, in order to make new, special and individual offers from the Controller to a specific customer, taking into account the information obtained and automatically compiled by the Controller from the personal data provided by the customer and from their previous purchases on the Controller's website, if the customer has consented to this.

3.5. The Controller may carry out automated decision-making in respect of the Customer if the Customer has given a freely given, specific, informed and unambiguous indication that they agree to such activities. The Customer may object to automated decision-making in accordance with the law by not giving their consent to the automated processing of personal data.

3.6. The Controller carries out automated decision-making, for example, to prepare and display commercial communications (pop-up banners) on the website in order to advertise the goods available on the website and to help Customers choose from the range of goods offered, including on the basis of the information on the most popular goods shown in the commercial communications (pop-up banners). By consenting to the automated processing of personal data for this purpose, the Customer agrees that the Controller will use information about the goods the person has purchased on the website when displaying commercial communications (pop-up banners) on the website, which will contain the following data: information about the purchased item, an image of the item from the website and anonymised information about the person who purchased the specific item, with the pop-up banner stating, for example: "A customer from Riga has just bought… (information about the item as described above)".

3.7. The Controller carries out automated decision-making in order to send the Customer a reminder about the goods placed in the shopping cart of the customer's profile on the website.

3.8. The Controller carries out automated decision-making in order to ask the Customer to submit a review of an item, which is included, without any information identifying the Customer, in the statistics on the rating of the item.

3.7. Opting out of receiving commercial communications has no legal consequences for the Customer and does not restrict the Customer's right to purchase goods and services on the website.

3.8. Opting out of automated data processing for the purposes referred to in these terms has no legal consequences for the Customer and does not restrict the Customer's right to purchase goods and services on the website.

1. Personal Data We Transfer to Third Parties

4.1. We may transfer the Customer's personal data to the categories of recipients listed below:

4.1.1. Financial transactions related to the purchase of goods on the website may be processed by the Controller's payment service providers. We disclose the Customer's financial transaction data to the Controller's payment service providers to the extent necessary to carry out payment transactions, issue refunds and handle complaints.

4.1.2. For the purpose of providing specific services, we may transfer the Customer's personal data to other service providers, such as website hosting providers, courier services, providers of servers and their technical maintenance, email service providers and accounting service providers.

4.2. We may transfer the Customer's personal data not only in the cases indicated above, but also when fulfilling our legal obligations and, where necessary, to protect the interests of the Customer or other persons, for example when applying to a court or to state institutions.

4.3. We may transfer the Customer's personal data to state authorities in accordance with the laws and regulations in force in the Republic of Latvia, in the manner and to the extent laid down by law.

4.4. For direct marketing purposes, and with the Customer's consent, we may transfer personal data to our partners who provide us with marketing services.

4.5. We will only engage service providers that have implemented appropriate technical and organisational measures ensuring an appropriate level of security of data processing in line with the procedures laid down by law, that is, a level of personal data processing and protection equivalent to the requirements of the General Data Protection Regulation.

4.6. In certain cases, and in compliance with the requirements of the law, personal data are accessed by the Controller's cooperation partners located in third countries (that is, countries outside the European Union and the European Economic Area): developers or service providers acting as data processors.

4.7. In the cases referred to in clause 4.6, the cooperation partners engaged by the Controller in third countries ensure a level of data protection equivalent to the level of data protection ensured by the Controller.

1. Cookies

5.1. The website may use cookies. The cookie policy is available here.

1. Commercial Communications

6.1. A commercial communication is any communication in electronic form designed to promote, directly or indirectly, goods or services or the image of a merchant, organisation or person engaged in commercial activity, economic activity or a regulated profession. Information allowing direct access to general information about the service provider and its activities (a domain name or an email address) is not considered a commercial communication.

6.2. The Controller may use personal data to provide information about the services, promotions and other activities offered by www.elyndi.com.

6.3. When using www.elyndi.com, you can sign up for (give your consent to) receiving commercial communications.

6.4. The consent given by the Customer to receive commercial communications remains valid until it is withdrawn (including after the termination of the service contract). The Customer may at any time opt out of receiving further commercial communications in any of the following ways:

6.4.1. by ticking the relevant box in their user profile at www.elyndi.com;

6.4.2. by sending an email to hello@elyndi.com;

6.4.3. in person at the point of sale;

6.4.4. by using the automated option provided in the commercial communication to unsubscribe from further communications, by clicking the unsubscribe link at the end of the relevant commercial communication (email).

6.5. SIA "ELYNDI" stops sending commercial communications as soon as the Customer's request has been processed. Processing of the request depends on technical capabilities and may take up to three days.

1. Your Rights

7.1. the right to receive information about the processing of personal data;

7.2. the right to access the personal data about you that we store;

7.3. the right to request rectification of the personal data about you that we store (you can correct most of it yourself by logging in to your account);

7.4. the right to ask us to erase your personal data ("the right to be forgotten");

7.5. the right to restrict the processing of your personal data;

7.6. the right to object to the processing of your personal data;

7.7. the right to object to the processing of your personal data for direct marketing purposes;

7.8. the right to object to automated processing of personal data;

7.9. the right to data portability;

7.10. the right to withdraw consent to the processing of your personal data;

7.11. the right to lodge a complaint with a supervisory authority;

7.12. If you wish to exercise your rights, or if you have any questions about the processing of personal data or the exercise of your rights, please contact us by email.

7.13. If you believe that, in processing your personal data, we are in breach of the legislation governing personal data protection, you have the right to lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija), located at Elijas iela 17, Rīga, LV-1050, https://www.dvi.gov.lv/lv/. In all cases, please contact us before lodging a complaint so that we can find a suitable solution together.

1. Consent and Changes to the Privacy Policy

8.1. By using the online shop www.elyndi.com and/or taking part in www.elyndi.com activities, the Customer confirms their consent to the processing of personal data.

8.2. Withdrawal of consent does not affect data processing carried out while the Customer's consent was valid.

8.3. Withdrawal of consent cannot stop data processing that is carried out on other legal bases.

8.4. Upon receiving a request from the Customer to exercise their rights, the Controller verifies the Customer's identity, assesses the request and fulfils it in accordance with the law.

8.5. The Controller sends its reply to the Customer by registered letter to the contact address provided by the Customer or, at the Customer's request, as an electronically signed reply by email, taking into account, as far as possible, the method of receiving the reply indicated by the Customer.

8.6. The Controller ensures compliance with data processing and protection requirements in accordance with the law and, if the Customer raises an objection, takes appropriate action to resolve it. However, if this is unsuccessful, the Customer has the right to apply to the supervisory authority.

8.7. The Controller reserves the right to unilaterally amend and supplement the Privacy Policy at any time without notice by publishing the changes in the Privacy Policy section of www.elyndi.com.

1. Contact Us

9.1. To improve the quality of our services, we always welcome feedback from our customers and are happy to answer any questions you may have.

9.2. You can contact us by whichever of the methods listed in the Privacy Policy or in the Contacts section of the website www.elyndi.com is most convenient for you.

Privacy Policy last updated:

5 May 2022