Ilze Baltic

Privacy policy

1. Who processes your data

The controller of your personal data is ILZE Baltic, UAB, company code 304232419, VAT number LT100010137215, Turgaus a. 6-4, LT-77188 Šiauliai, Lithuania ("we"). This policy explains how we process the personal data of customers and visitors of the ilzebaltic.lv online store under the EU General Data Protection Regulation (GDPR).

For any question about your data, write to info@ilzebaltic.lv or call +370 609 38750.

2. What data we receive

  • Account: first and last name, e-mail, password (stored only in encrypted form), your newsletter choice.
  • Order: delivery address or chosen parcel locker, phone, e-mail, order contents and total, payment method and status, order comment; for a company invoice — company name, registration and VAT number, address.
  • Enquiries: your messages and our correspondence with you.
  • Reviews and wishlist: the name you give, rating and review text; saved products.
  • Technical data: IP address, browser and device type, pages visited, cookies (see section 9).

We never receive card details or online-banking credentials — they are processed by the payment provider or your bank.

3. Why we process data and on what legal basis

  • Creating and running your account — contract with you (Art. 6(1)(b) GDPR).
  • Placing, paying for and delivering orders, returns and warranty matters — contract (Art. 6(1)(b)).
  • Accounting, invoices and taxes — our legal obligation (Art. 6(1)(c)).
  • Answering your questions and customer service — contract or our legitimate interest (Art. 6(1)(b) and (f)).
  • Newsletter with offers — your consent (Art. 6(1)(a)); you can withdraw it at any time via the link in every e-mail or in your profile.
  • An e-mail after a purchase asking you to rate the product (sometimes with a discount for your next order) — our legitimate interest (Art. 6(1)(f)); you can opt out of these e-mails at any time by writing to us.
  • Publishing your review on the site — your consent, given by submitting the review (Art. 6(1)(a)).
  • Visitor statistics (Google Analytics) — only with your consent in the cookie banner (Art. 6(1)(a)).
  • Site security, preventing abuse and protecting our rights — legitimate interest (Art. 6(1)(f)).

Your name, contact details and address are needed for an order — without them we cannot fulfil it. The newsletter, reviews and analytics are optional. We do not make decisions based solely on automated processing that have legal effects for you.

4. Who we share data with

  • The courier DPD — name, address or parcel locker, phone and e-mail, to deliver your order and notify you about the delivery.
  • The payment service Klix (AS Citadele banka) and your bank — the information needed for the payment.
  • Google Ireland Limited (Google Analytics) — only if you allowed analytics cookies.
  • PrestaShop SA (France), the developer of the shop platform — order information without names or addresses (customer number, amounts, status, payment and delivery method) for the platform services to work.
  • The hosting provider and mail server the shop runs on (servers in the EU).
  • Accountants, auditors, public authorities and courts — where the law requires it.

We do not sell your data and do not share it for other companies' advertising.

5. Transfers outside the EU

Your data is stored in the European Union. Google may process analytics data in the USA; such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) and standard contractual clauses.

6. How long we keep data

  • Account — as long as it exists; you can delete it at any time (see section 7).
  • Orders and invoices — as long as accounting law requires (10 years in Lithuania).
  • Correspondence — as long as needed to resolve the matter and possible claims, but no longer than the limitation period.
  • Newsletter subscription — until you unsubscribe; we keep the record of your consent as long as it is needed as proof.
  • Reviews — while they are published or until you ask us to delete them.
  • Server logs (IP addresses, requests) — 14 days.
  • Visit statistics in the shop system (IP address, time, pages) — no longer than 12 months (then deleted automatically).
  • Google Analytics data — no longer than 14 months.

7. Your rights

You have the right to access your data and get a copy; to correct inaccurate data; to have data deleted; to restrict processing; to receive your data in a machine-readable format and pass it to another company; to object to processing based on legitimate interest — including opting out of marketing e-mails at any time; and to withdraw consent (this does not affect the lawfulness of processing before the withdrawal).

You can download your data and request its deletion in "My account" → "GDPR - Personal data", or by writing to info@ilzebaltic.lv. We reply within one month.

If you believe we are breaching your rights, you can lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or with the supervisory authority of your country: in Latvia — Datu valsts inspekcija (dvi.gov.lv), in Estonia — Andmekaitse Inspektsioon (aki.ee).

8. How we protect data

Only employees who need it for their work have access to the data. The site uses a secure connection (HTTPS) and passwords are stored in encrypted form.

9. Cookies

Necessary cookies keep the cart, login and chosen language working — they do not need consent. Google Analytics cookies (_ga, _ga_*) are set only after you click "Accept all" in the banner. Your choice is stored in your browser. You can change or withdraw it at any time: cookie settings (the link is also at the bottom of every page).

10. Children

The shop is not intended for children under 14, and we do not knowingly collect their data.

11. Changes to this policy

We may update this policy; the current version is always published on this page. Last updated: 25.09.2026.