PRIVACY POLICY
Last updated: July 17, 2026
1. GENERAL PROVISIONS
1.1. This Privacy Policy provides information about the collection, processing, and storage of personal data obtained from customers who visit the online store https://santabrokane.com (hereinafter referred to as the Data Subject).
1.2. Personal data means any information relating to an identified or identifiable natural person, i.e., the Data Subject. Processing means any operation performed on personal data, such as collection, recording, use, consultation, deletion, or destruction.
1.3. Consent of the Data Subject means any freely given, specific, informed, and unambiguous indication of the customer’s (Data Subject’s) wishes, by a statement or by a clear affirmative action, signifying agreement to the processing of their personal data.
1.4. Third party means any natural or legal person, public authority, agency, or body other than the Data Subject, the Controller, the Processor, and persons who, under the direct authority of the Controller or Processor, are authorized to process personal data.
1.5. The Data Controller complies with the principles of personal data processing established by applicable laws and regulations and is able to demonstrate that personal data are processed in accordance with the applicable legal requirements.
2. DATA CONTROLLER
2.1. The Data Controller of the online store https://santabrokane.com is Santa Brokāne, Registration No. 16038811367. For any questions regarding the processing of personal data, you may contact us at art@santabrokane.com.
3. PROCESSING OF PERSONAL DATA
3.1. Personal data may only be processed on one of the following legal bases:
3.1.1. Consent of the Customer (Data Subject) – the Customer’s (Data Subject’s) freely given, specific, informed, and unambiguous indication that they consent to the processing of their personal data. By voluntarily providing their personal data, the Customer (Data Subject) confirms their consent to the processing of such data.
3.1.2. Compliance with a Legal Obligation – where required by applicable laws, regulations, administrative acts, or lawful requests from public authorities, we are entitled to process the Customer’s personal data to the extent necessary to comply with such legal obligations or to respond to lawful requests from competent public authorities.
3.1.3. Legitimate Interests – we are entitled to process the Customer’s personal data where such processing is necessary for the purposes of our legitimate interests.
3.2. By entering the required information when placing an order on santabrokane.com, the Customer (Data Subject) confirms that they have read and accepted this Privacy Policy and agree that the personal data provided may be collected, used, and processed for the purpose of processing the order and delivering the purchased goods. By submitting the information, the Customer also agrees to receive emails related to the processing and fulfilment of their order.
3.3. No separate payment platform is used for processing payments. We issue a pro forma invoice, which is sent to the Customer (Data Subject) for advance payment.
3.4. The Customer’s personal data are collected when the Customer completes the order form on the website by providing their contact information, including their first name, last name, and email address.
3.5. All personal information provided by the Customer when making a purchase through the website is treated as confidential, except where disclosure is required by applicable law.
3.6. The Data Controller shall not be liable for any loss or damage suffered by the Data Subject or any third party resulting from false, inaccurate, or incomplete personal data provided by the Data Subject.
4. PURPOSES OF PERSONAL DATA PROCESSING
4.1. We process the personal data collected from our Customers (Data Subjects) solely for the purposes set out below, in compliance with the applicable legislation governing the processing of personal data and depending on the scope of the personal data provided by the Customer (Data Subject) and the consent given for the specific processing purposes.
4.2. The personal data collected from Customers are processed for the following specific purposes:
-
- First name and last name – to identify the Customer in the online store;
-
- Address – for the delivery of ordered goods;
-
- Mobile phone number – to communicate with the Customer regarding the delivery of ordered goods or other matters related to the order;
-
- Email address – to provide notifications regarding the Customer’s order, payment, and delivery information;
-
- Any other information voluntarily provided to us during the purchase of products offered on the website or when contacting us.
4.3. In addition to the above, the Data Controller has the right to verify the accuracy of the information provided by using publicly available registers where permitted by applicable law.
4.4. The legal basis for the processing of personal data is Article 6(1)(a), (b), (c), and (f) of the General Data Protection Regulation (GDPR):
a) the Data Subject has given consent to the processing of their personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract to which the Data Subject is a party or in order to take steps at the request of the Data Subject prior to entering into a contract;
c) processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
f) processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of personal data, in particular where the Data Subject is a child.
5. RETENTION OF PERSONAL DATA
5.1. The Data Controller shall retain and process the Data Subject’s personal data for as long as at least one of the following conditions applies:
5.1.1. The personal data are necessary for the purposes for which they were collected;
5.1.2. The Data Controller and/or the Data Subject may exercise their legitimate interests in accordance with the procedures established by applicable laws and regulations, including, but not limited to, submitting objections or bringing or defending legal claims;
5.1.3. The Data Controller is subject to a legal obligation to retain the personal data, for example, under the Accounting Law or other applicable legislation;
5.1.4. The Data Subject’s consent to the relevant processing of personal data remains valid, provided there is no other lawful basis for processing the personal data.
5.2. Once the conditions referred to in this section no longer apply, the retention period for the Data Subject’s personal data expires. All relevant personal data are permanently deleted from computer systems and electronic and/or paper records containing such personal data, or the data are anonymised.
5.3. When processing and storing personal data, the Data Controller implements appropriate organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure, or any other unlawful processing.
6. RECIPIENTS OF PERSONAL DATA
When processing our Customers’ personal data, we maintain strict confidentiality and implement appropriate measures to protect personal data against unauthorised access, accidental loss, or destruction.
Where there is a lawful basis for doing so, the Customer’s personal data may, in exceptional cases, be disclosed to the following recipients:
-
- Public authorities and law enforcement agencies, upon their lawful request and in accordance with applicable laws;
-
- Service providers and data processors engaged by the Data Controller to fulfil its contractual and legal obligations, where such processing is necessary on our behalf. These may include, for example, accountants and courier service providers.
7. THE CUSTOMER’S RIGHTS REGARDING THE PROCESSING OF PERSONAL DATA
7.1. In accordance with the General Data Protection Regulation (GDPR) and the laws of the Republic of Latvia, you have the following rights:
7.1.1. To access your personal data, receive information about how your personal data are processed, and request a copy of your personal data in electronic format.
7.1.2. To request the correction of inaccurate, incorrect, or incomplete personal data.
7.1.3. To request the deletion of your personal data (“the right to be forgotten”), except where the retention of such data is required by law.
7.1.4. To withdraw your previously given consent to the processing of your personal data.
7.1.5. To restrict the processing of your personal data, including the right to request that we temporarily suspend the processing of all your personal data.
7.1.6. To lodge a complaint with the Data State Inspectorate of the Republic of Latvia.
7.2. You may exercise your rights by submitting a request via email to art@santabrokane.com.
8. FINAL PROVISIONS
This Privacy Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), as well as the applicable laws and regulations of the Republic of Latvia and the European Union.
The Data Controller reserves the right to amend or supplement this Privacy Policy at any time without prior notice. Any amendments shall become effective upon their publication on https://santabrokane.com.