Privacy Policy

1. Data controller

The controller of your personal data is SIA "SpiceLab", reg. no. 40203633868, address: Beverīnas iela 31, Valmiera, Valmieras novads, LV-4202, Latvija. Contact for data protection matters: jurgispm@gmail.com.

2. Data we collect

• Order data: name, email, phone, delivery address — to fulfil your purchase contract.
• Payment data: processed by the payment provider (Shopify Payments); we never store your card details.
• Cart data: items in your cart, stored on your device (localStorage) so the cart survives between sessions.
• Contact data: if you write to us — your name, email, and message content.
• Technical data: IP address, browser type, page statistics (see the Cookie Policy).

3. Purposes and legal bases

• Contract performance (Art. 6(1)(b) GDPR): order processing, delivery, customer support.
• Legitimate interests (Art. 6(1)(f)): improving the store, fraud prevention.
• Legal obligations (Art. 6(1)(c)): accounting and tax requirements.
• Consent (Art. 6(1)(a)): marketing emails — only with your consent, revocable at any time.

4. Data sharing

We share data only with providers essential to running the store: Shopify (e-commerce platform), delivery providers (Omniva, DPD, etc.), payment processors, and our accountant — all bound by data processing agreements.

5. Retention

Order and accounting data is kept as required by Latvian law (typically 5–10 years). Marketing data — until you withdraw consent. Cookie lifetimes are listed in the Cookie Policy.

6. Your rights

Under the GDPR you have the right to:

• access your personal data and receive a copy;
• rectify inaccurate data;
• request erasure ("right to be forgotten") where legally possible;
• restrict or object to processing;
• data portability;
• withdraw marketing consent at any time;
• lodge a complaint with the Data State Inspectorate (www.dvi.gov.lv).

7. Contact

For any privacy questions write to jurgispm@gmail.com or call +371 26376721. We respond within 30 days as required by the GDPR.