A privacy policy you can actually read.

Who is responsible

The controller of your personal data is SIA Semers Group, a company registered in Latvia.

• Registration number: 40203400507
• VAT number: LV40203400507
• Legal address: Vēju iela 14, Carnikava, Ādažu novads, LV-2163, Latvia
• Office: Pildas iela 10, Rīga, LV-1035

You can reach us about anything in this policy at av@semers.org. We are a small company and do not have a separate data protection officer; write to the same address and the person who runs the shop will answer.

What we collect and why

We collect personal data in three situations. For each one, here is what we take, what we do with it, and the legal basis under Article 6 of the GDPR.

When you place an order

Your name, e-mail address, phone number (the carrier sends delivery notices and the parcel-locker code to it), delivery address or parcel locker, country, the items and quantities in your box, and any gift message or note. We use this to check stock, confirm the order and its payment, deliver the parcel, answer questions about the order, and keep the accounting records the law requires.

Legal basis: performance of a contract with you, including the steps before it, under Article 6(1)(b); and compliance with our legal obligations under Article 6(1)(c) for the invoicing and accounting side.

Payment. Payments are processed by Paysera. When you pay, you enter your payment details on Paysera’s pages, not on ours. We receive a confirmation that payment succeeded and a reference, never your full card number.

When you write to us

Through the contact form, the wholesale form or plain e-mail: your name, e-mail address, company name if you give one, the topic and your message. We use it to reply and to keep track of the conversation.

Legal basis: steps towards a contract under Article 6(1)(b) when your message is about an order or a wholesale supply; otherwise our legitimate interest in answering people who write to us, under Article 6(1)(f).

When you browse the site

Our hosting provider records technical logs: your IP address, the time, the page requested, your browser type and the referring page. These are needed to serve the site, keep it secure and diagnose faults. Product images are delivered from a content delivery network, which sees your IP address in order to send you the file.

We do not run analytics at the moment. If we add it, we will use a cookieless, privacy-friendly tool that counts page views in aggregate without identifying you, and we will update this section.

Legal basis: our legitimate interest in running a secure, working website, under Article 6(1)(f).

What we do not do

• No profiling and no automated decisions that affect you legally.
• No selling, renting or trading of personal data.
• No advertising trackers, no social media pixels, no retargeting.

Who we share it with

We share personal data only with providers that help us run the shop, and only as much as each one needs to do its job.

• Hosting and serverless functions. The site, and the small function that receives order requests and form messages, run on a cloud hosting platform. It processes the data you submit and keeps short-lived technical logs.
• E-mail delivery. A transactional e-mail service sends our order confirmations and delivers your form messages to our inbox.
• Team notifications. New orders and messages are also relayed to an internal messaging channel, so that a person in Riga sees them quickly.
• Parcel carriers. Your name, address, phone number and e-mail go to the carrier that delivers your parcel, Omniva for a parcel locker in the Baltics, or the courier that delivers elsewhere in Europe, so they can deliver it and send you locker codes or delivery notices. Carriers also process this data under their own privacy policies.
• Payment provider. Your payment data goes directly to Paysera, which processes the payment and acts as an independent controller for its own fraud prevention.
• Accountants and authorities. Our accountant sees invoices and order records. Tax and other authorities receive data when the law obliges us to provide it.

Each provider is bound by a data processing agreement or by law. We do not share your data with anyone else, and we do not share it with the retailers who sell our products in shops.

Data outside the EEA

Some of the providers above run their infrastructure outside the European Economic Area, mainly in the United States. Where that happens we rely on the safeguards the GDPR allows: an adequacy decision of the European Commission, such as the EU–US Data Privacy Framework for certified companies, or the Commission’s standard contractual clauses together with any additional measures needed. Ask us if you would like details of the safeguards used for a specific provider.

How long we keep it

When a period ends we delete the data, or anonymise it so that it can no longer be linked to you.

Your rights

Under the GDPR you can ask us, at any time, to:

• Access the data we hold about you, and receive a copy.
• Rectify data that is inaccurate or incomplete.
• Erase data we no longer need to keep. Accounting records must stay for the legal period; everything else goes.
• Restrict processing while a question about it is being resolved.
• Port the data you gave us, in a common machine-readable format.
• Object to processing based on legitimate interest, and to direct marketing at any time, no reason needed.

To use any of these rights, e-mail av@semers.org from the address you used with us, or tell us how we can confirm it is you. We answer within one month. If a request is complex we may take up to two further months, and we will tell you why. There is no charge, unless a request is manifestly unfounded or excessive.

If you think we have handled your data wrongly, we would like to hear it from you first. You also have the right to complain to a supervisory authority. For us that is the Data State Inspectorate of Latvia (Datu valsts inspekcija, dvi.gov.lv). You may also complain to the authority in the EU country where you live.

Cookies and local storage

This site sets no tracking or advertising cookies, which is why there is no cookie banner. What we do use in your browser:

• Local storage for your cart. The items you add are saved in your browser’s local storage under our domain, so your box survives a page reload. Nothing is sent to us until you place an order. Clearing the site data in your browser empties the cart.
• Strictly necessary storage. Our hosting platform, or Paysera while you pay, may set a cookie that is essential for security or to complete a payment. Such cookies need no consent under the ePrivacy rules. We will list them here if and when they appear.

If we ever add a cookie that needs your consent, we will ask for it first, and you will be able to say no.

Children

Our snacks are for everyone; our shop is for adults. We do not knowingly collect personal data from children and we do not market to them. If you believe a child has given us personal data, write to us and we will delete it.

Security

The site is served over HTTPS. Order data travels encrypted to our providers, access to our inbox and tools is limited to the people who need it, and we hold no card data at all. No system is perfectly secure. If a breach ever affects your data, we will tell you and the supervisory authority as the GDPR requires.

Changes to this policy

We will update this policy when our processes or the law change; the date at the top tells you when. For changes that matter, such as a new purpose or a new kind of data, we will let you know by e-mail if we have your address, or with a notice on the site.

Contact

SIA Semers Group
Office: Pildas iela 10, Rīga, LV-1035
Legal address: Vēju iela 14, Carnikava, Ādažu novads, LV-2163, Latvia
Reg. No. 40203400507 · VAT No. LV40203400507
av@semers.org · +371 22841714

Prefer a form? Use the contact page. Curious about our shipping? See shipping & returns and the terms of sale.