• a) Personal data

Personal data means any information relating to an identified or identifiable natural person (hereinafter referred to as the “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

• b) Data subject

Data subject is any identified or identifiable natural person whose personal data are processed by the controller responsible for such processing.

• c) Processing

Processing means any operation or set of operations which is performed upon personal data or upon sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

• g) Controller or controller responsible for processing

The controller or controller responsible for the processing is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for his designation may be provided for in Union or Member State law.

• h) Processor

Processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

• i) Recipient

A recipient is a natural or legal person, public authority, agency or other body to which personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the context of a specific investigation in accordance with Union or Member State law shall not be considered recipients; the processing of those data by those public authorities shall comply with the applicable data protection rules in accordance with the purposes of the processing.

• j) Third person

Third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

• k) Consent

The data subject's consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of his or her personal data.

2.     Manager

Name and address of the controller. For the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in the Member States of the European Union and other data protection-related provisions, a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. If two or more controllers jointly determine the purposes and means of the processing, they are joint controllers. The data controllers are: SIA “TIM-T”, Reg. No.: 43903001784, Peldu iela 22a, Smiltene, LV-4729, Latvia., legal address: Peldu iela 22a, Smiltene, LV-4729, Latvia Contact information in the “Contacts” section: www.vairumnieks.lv. E-mail for questions regarding the processing of your personal data: info@vairumnieks.lv. Each controller separately hereinafter referred to as the Company.

3.     Cookies

Many websites and servers use cookies. Cookies are text files that are stored on a computer system using an internet browser. Many cookies include a so-called cookie ID. A cookie ID is a unique cookie identifier. It consists of a string of characters that can be used to assign internet pages and servers to a specific internet browser in which the cookie was stored. This allows visited internet websites and servers to distinguish the individual browser of the data subject from other internet browsers that contain other cookies. A specific internet browser can be recognised and identified using a unique cookie ID. By using cookies, the Company can provide users of this website with more user-friendly services that would not be possible without the cookie setting. By using a cookie, the information and offers on our website can be optimised with the user in mind. Cookies allow us, as already mentioned, to recognise users of our website. The purpose of this recognition is to make it easier for users to use our website. A website user who uses cookies, for example, does not have to enter access data every time the website is accessed, as this is taken over by the website and the cookie is thus stored on the user's computer system. Another example is a shopping cart cookie in an online shop. The online shop remembers the items that the customer has placed in the virtual shopping cart using the cookie. The data subject may prevent the cookie setting on our website at any time by means of a corresponding setting in his/her Internet browser and may thus permanently deny the setting of cookies. In addition, cookies that have already been set can be deleted at any time using the Internet browser or other software. This is possible in all popular Internet browsers. If the data subject deactivates the cookie setting in his/her Internet browser, not all functions of our website may be fully usable.

4.     Collection of general data and information

The company's website collects a series of general data and information when a data subject or an automated system visits the website. This general data and information is stored in server log files. The collected data may include (1) the browser types and versions used, (2) the operating system used by the accessing system, (3) the website from which the accessing system reaches our website (so-called referrers), (4) the sub-sites of the website, (5) the date and time of access to the website, (6) the internet service provider of the accessing system and (7) any other similar data and information that can be used in the event of attacks on our information technology systems.

The Company does not draw any conclusions about the data subject using this general data and information. Rather, this information is necessary to (1) correctly present the content of our website, (2) optimize the content of our website as well as advertising, (3) ensure the long-term prospects of our information technology systems and website technology, and (4) provide law enforcement authorities with the information necessary for criminal prosecution in the event of a cyber attack. The Company therefore analyzes the anonymously collected data and information statistically in order to increase the data protection and data security of our company and to ensure an optimal level of personal data protection. The anonymous data in the server log files is stored separately from any personal data provided by the data subject.

5.     Registration on our website (if applicable to the specific website)

In some cases, the data subject has the opportunity to register on the controller's website by providing personal data. Which personal data is sent to the controller is determined by the respective input mask used for registration. The personal data entered by the data subject are collected and stored solely for the controller's internal use and for its own purposes. The controller may request a transfer to one or more processors (e.g. a parcel service) who also use the personal data for internal purposes attributable to the controller. When registering on the controller's website, the address assigned by the Internet Service Provider (ISP) and used by the data subject is also stored - the date and time of registration. The storage of this data takes place taking into account that this is the only way to prevent misuse of our services and, if necessary, to allow for the investigation of violations. Since the storage of this data is necessary to ensure the controller. This data is not passed on to third parties unless there is a statutory obligation to transfer the data or if the transfer serves the purpose of criminal prosecution. The registration of the data subject with the voluntary provision of personal data is intended to enable the controller to offer the data subject content or services that can only be offered to registered users due to the nature of the matter in question. Registered persons are free to change the personal data provided during registration at any time or to completely delete them from the controller's data collection.

6.     Regular deletion and blocking of personal data

The data controller shall process and store the personal data of the data subject only for the period necessary to achieve the purpose of the storage, or as long as the European Union legislator or other legislators grant it in the legal acts to which the controller is subject. If the storage purpose is not applicable or if the storage period set by the European Union legislator or other competent legislator expires, the personal data shall be erased regularly in accordance with legal requirements.

7.     Data subject rights

• a) Right of approval

Each data subject shall have the right granted by the European Union legislator to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed. If the data subject wishes to exercise this right of confirmation, he or she may at any time contact the controller.

• b) Right of access Each data subject has the right granted by the European Union legislator to receive from the controller free of charge information about his or her stored personal data at any time and a copy of this information.

In addition, European directives and regulations grant the data subject access to the following information:

o purpose of processing;

o the categories of personal data concerned;

o recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;

o if possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period;

o the existence of the right to request from the controller the rectification or erasure of personal data or the restriction of the processing of personal data concerning the data subject or to object to such processing;

o the existence of the right to lodge a complaint with a supervisory authority;

o if the personal data were not collected from the data subject, any available information about their source;

o the existence of automated decision-making, including profiling, as referred to in Article 22(1) and (4) of the GDPR and, at least in these cases, meaningful information about the logic involved, as well as the significance and foreseeable consequences of such processing for the data subject.

Furthermore, the data subject has the right to obtain information as to whether personal data are transferred to a third country or an international organisation. In such a case, the data subject has the right to be informed of the relevant safeguards regarding the transfer of data.

If the data subject wishes to exercise this right of access, he or she may contact us at any time.

• c) Right to rectification Each data subject shall have the right granted by the European legislator to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by providing supplementary information. If the data subject wishes to exercise this right to rectification, he or she may contact us at any time.

• d) Right to erasure (right to be forgotten) Each data subject shall have the right granted by the European legislator to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller shall be obliged to erase personal data without undue delay where one of the following grounds applies, unless the processing is necessary:

o The personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed.

o The data subject withdraws consent to processing based on point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR and where there is no other legal basis for the processing.

o The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there is no overriding legitimate basis for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.

o Personal data has been unlawfully processed.

o The personal data must be erased for compliance with a legal obligation under Union or Member State law to which the controller is subject.

o The personal data are collected in connection with the provision of information society services referred to in Article 8(1) of the GDPR.

If one of the aforementioned reasons applies and a data subject wishes to request the erasure of personal data stored by the Company, he or she may, at any time, contact us at the above e-mail address.

e) Right to restriction of processing Each data subject shall have the right granted by the European Union legislator to obtain from the controller restriction of processing where one of the following conditions applies:

o The accuracy of the personal data is contested by the data subject for a period of time that allows the controller to verify the accuracy of the personal data.

o The processing is unlawful and the data subject opposes the erasure of the personal data and instead requests the restriction of their use.

o The controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims.

o The data subject has objected to the processing pursuant to Article 21(1) of the GDPR pending verification whether the legitimate grounds of the controller override those of the data subject.

If one of the aforementioned conditions is met, and a data subject wishes to request the restriction of the processing of stored personal data, he or she may, at any time, contact us at the above e-mail address.

• f) Right to data portability Each data subject shall have the right to receive personal data concerning him or her, which were provided to a controller, in a structured, commonly used and machine-readable format. He or she shall have the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided, where the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated means, unless the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising his or her right to data portability pursuant to Article 20(1) of the GDPR, the data subject has the right to receive personal data transmitted directly from one controller to another, where technically feasible and where such processing does not adversely affect the rights and freedoms of other persons.

In order to exercise the right to data portability, the data subject may contact us at any time at the e-mail address provided above.

• g) Right to object Each data subject has the right, on grounds relating to his or her particular situation, to object at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1) of the GDPR. This also applies to profiling based on these provisions.

The Company shall no longer process the personal data in the event of the objection, unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

If the Company processes personal data for direct marketing purposes, the data subject has the right to object at any time to the processing of his or her personal data for such marketing. This applies to profiling insofar as it is related to such direct marketing. If the data subject objects to the Company processing the data for direct marketing purposes, we will no longer process the personal data for this purpose.

To exercise the right to object, the data subject may contact us directly at the e-mail address provided above.

• h) Automated individual decision-making, including profiling Each data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her, unless the decision [1] is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) is not authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, or [3] is not based on the data subject's explicit consent.

If the decision (1) is necessary for entering into, or the performance of, a contract between the data subject and a data controller, or (2) is based on the data subject's explicit consent, the Company shall implement suitable measures to safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and contest the decision.

If the data subject wishes to exercise the rights concerning automated individual decision-making, he or she may, at any time, contact us directly at the above e-mail address.

• i) Right to withdraw data protection consent

Each data subject has the right to withdraw his or her consent to the processing of personal data concerning him or her at any time. If the data subject wishes to exercise the right to withdraw consent, he or she may, at any time, contact us directly at the above-mentioned e-mail address.

8. Facebook and Meta

The website links to the company’s Facebook profile. The website currently does not use Meta Pixel or Facebook tracking plugins. If you follow the link to Facebook, further data processing is governed by that service’s privacy policy.

9. Website analytics

The website currently does not use Google Analytics. With your consent, WooCommerce analytics cookies help identify the source of visits and potential orders. Information about these cookies, their duration and how to change your consent is available in the Cookie Policy.

10. Remarketing

The website currently does not use Google or Meta remarketing tracking tools. If these tools are introduced, this policy, the Cookie Policy and the consent settings will be updated before they are used.

11. Google Ads

The website currently does not use Google Ads conversion tracking code or Google Ads advertising cookies.

12. Instagram and other external links

The website links to the company’s Instagram and TikTok profiles. These links do not themselves set social-network tracking cookies. If you open an external link, data processing on that website is governed by its own privacy and cookie policies.

13.                        Legal basis for processing

We collect and process your personal information only if we have a legal basis for processing under applicable law (including GDPR):

• we have received your consent,

• the agreement or contract concluded with you must be fulfilled,

• we are required to do so by law, or

• we have legitimate interests and this processing does not harm you.

However, we will always obtain your consent as a parent or legal guardian if your child provides personal information online.

We will always inform you about the processing and the purpose of the processing, unless in special cases we have a legitimate reason not to do so.

We process your personal information only for the initial purpose described above.

We do not disclose your personal information to third parties or companies unless you have given us your consent, unless we have an agreement with you or unless we are legally obliged to do so. Third parties to whom your Personal Data may be disclosed are independent service providers who provide us with, for example, call center, information technology, email delivery, legal advice and other similar services. These third parties will have access to Personal Data only for the purpose of providing these services to us.

We may supplement your personal information with information from other databases to ensure that your data is accurate and up-to-date.

We use high technical standards to securely protect your personal information. You have the right to lodge complaints about the processing of your personal data with a Data Protection Supervisory Authority.

14.                        Legitimate interests of the controller or a third party

If the processing of personal data is based on Article 6(1)(f) of the GDPR, then our legitimate interests are to conduct our business: to develop and promote our products and services.

15.                        Period for which personal data will be stored

We do not store your personal information for longer than is necessary to achieve the purposes for which it was collected. The criterion used to determine the retention period for personal data is the relevant statutory retention period. After the expiry of that period, the relevant data is usually deleted when it is no longer necessary for the purpose.

16.                        Provision of personal data as a mandatory or contractual requirement;

Requirement necessary for the conclusion of a contract; Obligation of the data subject to provide personal data; possible consequences of failure to provide such data.

We clarify that the provision of personal data is partly required by law (e.g. tax regulations and others) or may arise as a result of contractual provisions (e.g. information about the contractual partner). Sometimes it may be necessary to conclude a contract by which the data subject provides us with their personal data, which we must then process. The data subject is obliged to provide us with their personal data when we sign a contract with this data subject. The consequences of failure to provide personal data in such a case would be that the contract with the data subject could not be concluded. If you have a request, comment or question about this Privacy Policy, please contact us by writing an e-mail to the e-mail address: info@vairumnieks.lv.