Privacy policy
Privacy Policy
This Privacy Policy explains how Šarlotes audumi SIA collects, uses, stores, transfers and protects personal data when a Buyer or website visitor uses the online store, places an order, contacts the Seller, creates a customer account, subscribes to the newsletter or uses other services offered by the Seller.
Please read this Privacy Policy carefully. By using the online store, placing an order or providing their personal data, the Buyer confirms that they have read this Privacy Policy.
1. Data controller
The controller of personal data is:
Šarlotes audumi SIA
Registration No.: 44103145434
VAT No.: LV44103145434
Legal address: Vilku iela 12 - 64, Cēsis, Cēsu nov., LV-4101, Latvia
Store address: Jāņa Poruka iela 23, Cēsis, LV-4101, Latvia
Email: eksg.sia@gmail.com
Phone: +371 26757363
In this Privacy Policy, Šarlotes audumi SIA is hereinafter referred to as the Seller, we or the data controller.
2. Scope of this Privacy Policy
This Privacy Policy applies to the Charlotte's Fabric (Šarlotes audumi) online store and to all domain, language, technical and country versions of the online store managed by the Seller, including but not limited to:
- sarlotesaudumi.lv and www.sarlotesaudumi.lv
- sarlotesaudumi.myshopify.com
- internetaveikals.lv and www.internetaveikals.lv
- xn--arlotesaudumi-9tc.lv and www.xn--arlotesaudumi-9tc.lv
- sharlottekangad.ee and www.sharlottekangad.ee
- sarlotesaudiniai.lt and www.sarlotesaudiniai.lt
- charlottenkankaat.fi and www.charlottenkankaat.fi
- tkaninyuszarloty.pl and www.tkaninyuszarloty.pl
- tissusdecharlotte.fr and www.tissusdecharlotte.fr
- charlottesfabric.eu and www.charlottesfabric.eu
- charlottesfabric.com and www.charlottesfabric.com
- other domains, subdomains, language versions or technical Shopify addresses managed by the Seller and used for the operation of the online store.
In the event of differences in interpretation between language versions, the Latvian version shall prevail, insofar as applicable mandatory personal data protection or consumer protection rules do not provide otherwise.
3. Types of personal data we process
Depending on how the Buyer uses the online store, we may process the following personal data:
- identification data: first name, last name, company name, registration number, VAT number, if provided by the Buyer;
- contact information: email address, phone number, delivery address, billing address;
- order information: ordered products, quantity, size, length, colour, selected delivery method, order number, order status, delivery status;
- payment information: payment status, payment method, transaction identifier, invoice information; the Seller does not store full payment card data;
- customer account information: account creation and login information, order history, account activity information, if the Buyer uses a customer account;
- communication information: emails, messages, requests, complaints, withdrawal notices, correspondence on social networks or other communication channels;
- printing and personalisation information: files, images, logos, texts, names, dates, designs and layouts submitted by the Buyer, and notes on placement, size, colour or other personalisation;
- technical information: IP address, device type, browser, operating system, language, approximate location, pages visited, activity in the online store, information from cookies and similar technologies;
- marketing information: consent to receive newsletters, email marketing status, unsubscriptions, campaign interaction data, if such processing takes place;
- reviews, photographs, comments or other content that the Buyer voluntarily submits to the Seller or publishes in connection with the Seller's products or services.
We only process personal data that is necessary for a specific, clear and lawful purpose.
4. Special categories of data
The Seller does not knowingly request or process special categories of personal data, such as information about health, religious beliefs, political opinions, biometric data or other specially protected personal data, except where the Buyer voluntarily submits such information and it is necessary to fulfil a specific request of the Buyer.
We ask the Buyer not to submit special categories of personal data to the Seller unless this is objectively necessary for fulfilling the order.
5. Sources of personal data
We obtain personal data:
- directly from the Buyer when the Buyer places an order, creates a customer account, subscribes to the newsletter, contacts the Seller or submits information for printing or personalisation;
- automatically when the Buyer uses the online store, for example through cookies, server logs, Shopify platform features or other technologies;
- from payment service providers, delivery service providers, the Shopify platform and other service providers, to the extent necessary for order processing, payment, delivery, fraud prevention or customer service.
6. Purposes and legal bases for processing personal data
The Seller processes personal data for the following purposes and on the following legal bases:
| Purpose | Data processed | Legal basis |
|---|---|---|
| Accepting and fulfilling orders | First name, last name, contact information, delivery address, order information | Performance of a contract or steps prior to entering into a contract |
| Arranging delivery | First name, last name, address, parcel locker, phone, email, order information | Performance of a contract |
| Payment processing | Payment status, payment method, transaction information, invoice details | Performance of a contract and legal obligation |
| Invoicing and accounting | Identification data, order information, payment information, invoice information | Legal obligation |
| Customer service and communication | Contact information, correspondence, order information, information on complaints or requests | Performance of a contract and the Seller's legitimate interests |
| Handling of withdrawals, returns and complaints | Order information, correspondence, photographs, return information, payment information | Legal obligation, performance of a contract and legitimate interests |
| Fulfilment of printing, personalisation and custom orders | Files, images, logos, texts, names, dates, layouts, designs and order instructions | Performance of a contract |
| Ensuring the operation and security of the online store and preventing fraud | Technical data, IP address, device information, activity in the online store | The Seller's legitimate interests and legal obligation, where applicable |
| Email marketing and newsletters | Email address, name, consent information, marketing interaction data | Consent or legitimate interests, where permitted by applicable law |
| Use of reviews, customer photos or social media content in marketing | Reviews, photos, name, social media profile or submitted content | Consent or legitimate interests, where applicable and permitted |
| Protection of legal claims and dispute resolution | Order information, payment information, correspondence, evidence, technical data | The Seller's legitimate interests and legal obligation |
7. When providing personal data is mandatory
In order for the Seller to accept, process and fulfil an order, the Buyer must provide the information necessary for fulfilling the order, such as first name, last name, email, phone number, delivery address or selected parcel locker, and the information required for payment.
If the Buyer does not provide the mandatory information, the Seller will not be able to accept or fulfil the order, arrange delivery, issue an invoice or provide the specific service.
Information provided for marketing, reviews, customer photos or other additional activities is voluntary, unless otherwise stated in a specific case.
8. Payment processing
Payments in the online store may be processed by payment service providers, including MakeCommerce/Maksekeskus AS, Shopify Payments, banks, payment card processors or other payment service providers available at checkout.
To process a payment, the Seller or the technical platform of the online store may transfer to payment service providers the personal data necessary for the payment, such as the order number, payment amount, email address, first name, last name and other information required for the payment.
The Seller does not store full payment card data. The security of payment cards and payment processing is ensured by the relevant payment service provider in accordance with its terms and privacy policy.
9. The Shopify platform and other service providers
The online store operates on the Shopify platform. Shopify and service providers associated with Shopify may process personal data to ensure the operation of the online store, order processing, customer accounts, payments, security, fraud prevention, technical maintenance, analytics and other online store functions.
When the Shopify platform is used, personal data may also be processed outside Latvia and the European Economic Area, with appropriate data protection mechanisms applied where required by applicable law.
The Seller may also use other service providers, such as delivery companies, payment service providers, accounting service providers, email service providers, marketing tools, analytics tools, customer service tools and Shopify apps.
Service providers may process personal data only to the extent necessary to provide the specific service and in accordance with applicable personal data protection rules.
10. Recipients of personal data
The Seller does not sell Buyers' personal data to third parties.
The Seller may transfer personal data to the following categories of recipients where necessary for a specific processing purpose:
- the Shopify platform and service providers associated with Shopify;
- payment service providers, banks and payment card processors;
- delivery and logistics service providers, such as parcel locker, courier and postal service providers;
- accounting, tax, legal and audit service providers;
- IT maintenance, server, email, data storage, security and technical support service providers;
- providers of marketing, email newsletter, advertising, analytics or social media tools, where such tools are used and the processing is permitted by law;
- state and municipal authorities, law enforcement agencies, courts, supervisory authorities or other persons, where the transfer of data is required by law or necessary to protect the Seller's rights.
11. Delivery service providers
To deliver the order, the Seller may transfer to the delivery service provider the Buyer's first name, last name, phone number, email address, delivery address, selected parcel locker, shipment information and other information necessary for delivery.
Delivery service providers process personal data to deliver the shipment, provide shipment tracking, send notifications, hand over the shipment, process returns or carry out other delivery-related activities.
12. Cookies and similar technologies
The online store may use cookies and similar technologies to ensure the operation of the website, the shopping cart, the customer account, security, language and country settings, analytics, marketing, measurement of advertising effectiveness and improvement of the user experience.
Necessary cookies are used so that the online store can function and the Buyer can place an order. Analytics, marketing and other non-essential cookies are used only where permitted by applicable law and, where required, with the Buyer's consent.
The Buyer can manage cookie settings in their browser or, if a cookie management tool is available in the online store, by using that tool.
More detailed information about cookies may be provided in a separate Cookie Policy or in the cookie settings window.
13. Marketing and newsletters
The Seller may send the Buyer newsletters, offers, promotions or other marketing information if the Buyer has consented to this or if such communication is permitted by applicable law.
The Buyer has the right to unsubscribe from marketing messages at any time by using the unsubscribe link in the email or by contacting the Seller by email: eksg.sia@gmail.com.
Unsubscribing from marketing messages does not affect the receipt of notifications related to order fulfilment, such as order confirmation, delivery information, payment information or replies to the Buyer's requests.
14. Reviews, customer photos and social media
If the Buyer voluntarily submits a review, photograph, video, comment or other content to the Seller, the Seller may process it to respond to the Buyer's message, improve the quality of its services or, if the Buyer has given consent or applicable law permits it, use it for marketing and communication purposes.
If the Buyer publishes a comment, tags the Seller on social media or engages with the Seller's social media content, the relevant social media platforms may process personal data in accordance with their own privacy policies.
15. Printing and personalisation files
If the Buyer submits a file, image, logo, text, photograph, illustration or other material for a printing or personalisation order, the Seller processes this material only for the preparation and fulfilment of the specific order, quality control, communication with the Buyer and handling of possible claims.
The Buyer is responsible for ensuring that the submitted materials do not infringe the rights of third parties, including copyright, trademark rights, design rights, personal data protection rules or image rights.
We ask the Buyer not to submit sensitive, unlawful, offensive or third-party-rights-infringing materials for printing.
16. International transfer of personal data
As the online store operates in an international e-commerce environment and uses the Shopify platform and payment, delivery, email, marketing, analytics or other service providers, personal data may be processed or transferred outside Latvia, the European Union or the European Economic Area.
If personal data is transferred to a country outside the European Union or the European Economic Area for which no adequacy decision has been adopted, the Seller or the relevant service provider applies appropriate safeguards, such as the European Commission's standard contractual clauses or other safeguards provided for by law, where required.
17. Personal data retention periods
The Seller stores personal data only for as long as necessary to achieve the relevant processing purpose, to comply with legal requirements, to perform the contract, to handle the Buyer's requests, to protect the Seller's rights or for other lawful purposes.
| Data category | Retention period |
|---|---|
| Order and delivery data | As long as necessary for fulfilling the order, customer service and handling withdrawals, returns, warranty or claims. |
| Invoices and accounting documents | For the retention period specified by law. |
| Communication with the Buyer | As long as necessary to handle the specific matter and to protect the Seller's rights. |
| Customer account data | As long as the customer account is active or until the Buyer requests its deletion, unless there is another lawful basis for retaining the data longer. |
| Marketing consent data | Until consent is withdrawn or until the data is no longer needed for the relevant marketing purpose. |
| Printing and personalisation files | As long as necessary for fulfilling the order, quality control, handling possible claims or reprocessing the order at the Buyer's request. |
| Technical data and cookie data | In accordance with the lifetime of the specific cookie, platform, security or analytics tool. |
If personal data is no longer needed for the specific purpose and there is no other lawful basis for retaining it, the data is deleted, anonymised or securely restricted.
Technical backup copies may be kept for a limited time until they are overwritten or deleted in accordance with the operating procedures of the relevant systems.
18. Security of personal data
The Seller implements reasonable technical and organisational security measures to protect personal data against unauthorised access, accidental loss, destruction, disclosure, alteration or other unlawful processing.
Access to personal data is granted only to those persons and service providers who need it to perform a specific work duty or service.
However, the Buyer understands that no transmission of data over the internet or electronic storage system can be guaranteed to be absolutely secure.
19. Rights of the data subject
In accordance with applicable personal data protection rules, the Buyer or any other person whose personal data is processed has the right to:
- request access to their personal data;
- request the rectification of inaccurate or incomplete personal data;
- request the erasure of personal data where there is a legal basis for erasure;
- request the restriction of processing of personal data;
- object to the processing of personal data where the processing is based on legitimate interests;
- receive their personal data in a structured, commonly used and machine-readable format where the right to data portability applies;
- withdraw consent where the processing of personal data is based on consent;
- lodge a complaint with a supervisory authority.
Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
In some cases, the Seller will not be able to fully comply with a request for erasure or restriction of processing if the storage or processing of the data is necessary to comply with legal requirements, perform a contract, keep accounts, resolve disputes or protect the Seller's rights.
20. How to exercise your rights
To exercise their personal data rights, the Buyer can contact the Seller by email: eksg.sia@gmail.com.
To protect personal data, the Seller has the right to verify the identity of the person making a request before fulfilling it.
The Seller responds to personal data requests within the time limits set by law.
21. Right to lodge a complaint
If the Buyer believes that their personal data is being processed unlawfully or that the Seller has not properly handled a data protection request, the Buyer has the right to lodge a complaint with the Data State Inspectorate of Latvia or with the competent data protection supervisory authority of their country of residence.
Data State Inspectorate of Latvia (Datu valsts inspekcija):
Website: www.dvi.gov.lv
Email: pasts@dvi.gov.lv
Phone: +371 67223131
Address: Elijas iela 17, Rīga, LV-1050, Latvia
22. Automated decision-making and profiling
The Seller does not make decisions based solely on automated processing of personal data that would produce legal effects for the Buyer or similarly significantly affect the Buyer.
The online store may use automated tools, such as fraud prevention, security, payment risk, analytics or personalised content tools, but they are used only to improve the security and operation of the online store, the customer experience or order processing.
23. Personal data of children
The online store is not intended for children under the age of 16 to make purchases or provide personal data independently without the consent of a parent or legal guardian.
If the Seller becomes aware that a child's personal data has been provided without the required consent of a parent or legal guardian, the Seller takes reasonable steps to delete such data or restrict its processing, unless there is another lawful basis for processing the data.
24. International customers
If the Buyer is located outside Latvia or outside the European Union, they may have additional rights under the mandatory personal data protection rules of the relevant country, insofar as these apply to the Seller in the specific case.
The Seller handles privacy and data protection requests in good faith and in accordance with applicable law.
The Seller does not sell Buyers' personal data. If, in a particular jurisdiction, the Buyer has the right to opt out of the sale, sharing or use of personal data for targeted advertising, the Buyer can contact the Seller by email: eksg.sia@gmail.com, or use the privacy or cookie settings available in the online store, where available.
25. Links to third-party websites
The online store may contain links to third-party websites, payment service providers, delivery service providers, social networks or other external resources.
The Seller is not responsible for the privacy practices of third-party websites, platforms or services. The Buyer is advised to read the privacy policies of the relevant third parties.
26. Changes to the Privacy Policy
The Seller has the right to amend this Privacy Policy from time to time where necessary due to changes in legislation, changes in the operation of the online store, changes of service providers, technical solutions or other significant circumstances.
The current version of the Privacy Policy is published in the online store. In the event of significant changes, the Seller may inform Buyers in the online store or in another appropriate way.
27. Contact information for privacy matters
For questions about the processing of personal data, the exercise of data protection rights or this Privacy Policy, the Buyer can contact the Seller:
Šarlotes audumi SIA
Email: eksg.sia@gmail.com
Phone: +371 26757363
Store address: Jāņa Poruka iela 23, Cēsis, LV-4101, Latvia
28. Validity of the Privacy Policy
This Privacy Policy is effective from the moment of its publication in the online store.
Last updated: 28 June 2026.