Privacy

Last updated: 11.10.2026

This policy explains what personal data STR collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR).

1. Controller

For any privacy question or request, write to waewstorebussines@gmail.com.

2. What we collect and why

Data	Purpose	Legal basis
Name, email, phone, delivery address, parcel locker, ordered items, payment status	Process, deliver and support your order; send order emails and the invoice	Contract (Art. 6(1)(b))
Account: email, password (stored only as a secure hash), saved addresses, language, wishlist	Your account, order history, faster checkout	Contract
Google / Apple sign-in: name, email, account identifier	Sign you in without a password	Contract
Invoices and order records	Accounting and tax obligations	Legal obligation (Art. 6(1)(c))
Newsletter email and language	News about drops and offers, welcome code	Consent (Art. 6(1)(a)) — withdraw any time
Back-in-stock and drop reminders	One email when the item or drop is available	Consent (your request)
Unfinished checkout (email, items)	One reminder that items are still in your bag	Legitimate interest (Art. 6(1)(f)) — stop with one click
Review request after delivery; reviews and photos you send	Ask for and publish product reviews (shown with your first name and initial)	Legitimate interest; publication with your consent
IP address, browser, security events	Keep the store secure, prevent fraud and abuse (rate limits)	Legitimate interest

We do not sell personal data and do not use advertising or analytics trackers.

3. Who receives data

• Stripe (payments) — card details go directly to Stripe; we only receive the payment status.
• Carriers you choose (e.g. Omniva, DPD, Venipak, Smartpost/Itella, Latvijas Pasts, DHL, UPS) — name, address or parcel locker, phone and email needed for delivery.
• Email provider that delivers our emails, and our hosting provider that runs the website.
• Address search: when you type an address, only the typed text is sent through our server to an OpenStreetMap-based service (Photon by Komoot) to suggest addresses.
• Google / Apple, only if you choose to sign in with them.
• Authorities, only when the law requires it.

Some providers (e.g. Stripe) may process data outside the EU; this is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

4. How long we keep it

• Account data — until you delete the account (profile data is erased within 30 days of the request).
• Orders and invoices — as long as Latvian accounting law requires (generally 5 years).
• Unpaid, abandoned checkouts — deleted after 12 months.
• Newsletter — until you unsubscribe; reminder opt-outs are kept so we respect them.
• Security logs — a few weeks.

5. Cookies

We use only cookies needed for the store to work: a session cookie (keeps you signed in, remembers your bag, protects forms), a language cookie, and small cookies that remember that you've seen the intro or closed the top bar. No advertising or analytics cookies, so no consent banner is needed.

6. Your rights

You can ask for access to your data, correction, erasure, restriction, data portability, and object to processing based on legitimate interest. You can withdraw consent at any time (e.g. the unsubscribe link in every newsletter). Much of this you can do yourself in your account. You may also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, dvi.gov.lv) or the authority in your country.

7. Security

Connections are encrypted (HTTPS), passwords are stored only as strong hashes, access to the admin is protected, and card data never touches our systems.

8. Changes

We will update this page if our processing changes; the date at the top shows the latest version.