Privacy Policy
Last updated: 3 August 2026
This Privacy Policy explains how PERFECT SOLUTIONS SIA processes personal data in connection with the use of the SujLetak.lv online shop, customer service, orders and product delivery.
1. Data controller
The data controller is:
PERFECT SOLUTIONS SIA
Registration number: 40103682176
Registered and contact address: A. Deglava iela 106, Riga, LV-1082, Latvia
Telephone: 25634646
Email: info@sujletak.lv
Website: https://sujletak.lv/
Questions about personal-data processing and requests to exercise your rights may be sent to info@sujletak.lv.
2. What personal data may be processed?
Depending on the service used, we may process:
- identification data, such as your first and last name;
- contact details, such as your email address and telephone number;
- delivery and billing addresses;
- account data and an encrypted password value;
- order, product, price, delivery and payment information;
- information included in a bank transfer, including the payer’s name, account number, amount and payment reference;
- communications, warranty, withdrawal, return and complaint information;
- newsletter subscription choices and consent information;
- the name and content voluntarily provided in product reviews;
- technical data such as IP address, browser and device information, session identifiers, security logs and cookie preferences;
- with your consent, website usage statistics provided by Google Analytics.
We normally obtain personal data directly from you when you register an account, place an order, contact us, submit a review, warranty or withdrawal request, or subscribe to news. Technical data is obtained automatically when the website and its security tools are used. We also receive bank-transfer information from the credit institution servicing the company.
3. Purposes and legal bases for processing
| Purpose | Personal data | Legal basis |
|---|---|---|
| Creating and maintaining an account | Name, contact details, addresses, account and authentication data | Entering into and performing a contract, or steps before entering into a contract (Article 6(1)(b) GDPR) |
| Receiving and processing an order, payment, delivery and order-related communication | Contact details, addresses, order, delivery and bank-transfer information | Performance of a contract (Article 6(1)(b) GDPR) |
| Compliance with invoicing, accounting and tax requirements | Order, payment, invoice and transaction data | Compliance with a legal obligation (Article 6(1)(c) GDPR) |
| Handling customer questions, warranties, withdrawals, returns and complaints | Contact details, communications, order and product information | Performance of a contract, legal obligations and our legitimate interest in establishing and defending legal claims (Article 6(1)(b), (c) and (f) GDPR) |
| Website, account and form security and prevention of fraud and automated submissions | IP address, session and technical information, anti-bot verification results | Our legitimate interest in protecting the website and services (Article 6(1)(f) GDPR) |
| Publishing and moderating product reviews | Provided name, review content and technical information | Our legitimate interest in providing customer reviews and preventing abusive content (Article 6(1)(f) GDPR) |
| Sending news and offers | Email address and consent information | Your consent (Article 6(1)(a) GDPR) |
| Analysing and improving website usage | Cookie identifiers, IP and device information, website usage events | Your consent (Article 6(1)(a) GDPR) |
Where processing is based on legitimate interests, we assess whether those interests improperly affect your rights and freedoms. You have the right to object to such processing.
4. Is providing personal data mandatory?
Data marked as mandatory in an order or registration form is required to create an account, process an order, communicate with you and arrange delivery. If the data is not provided, we may be unable to create an account or accept or fulfil an order.
Consent to newsletters and analytics cookies is voluntary. Refusal does not affect your ability to use the shop or make a purchase.
5. Recipients of personal data
Personal data may be disclosed only to the extent necessary for the relevant service:
- Tevale SIA — hosting, server and email infrastructure;
- Venipak SIA, Unisend SIA and Omniva SIA — order delivery;
- authorised persons of PERFECT SOLUTIONS SIA — order processing, customer service and internal accounting;
- credit institutions servicing the company — processing and identification of bank transfers;
- Google Ireland Limited and affiliated Google companies — Google Analytics after consent;
- public authorities, courts, law-enforcement bodies or professional advisers where disclosure is required by law or necessary to protect our legal interests.
Delivery companies and credit institutions may also act as independent data controllers for data they process to fulfil their own services and legal obligations.
6. Transfers outside the European Economic Area
When Google Analytics are used, certain technical data may be processed outside the European Economic Area, including in the United States. Google uses applicable transfer mechanisms, including the EU-US Data Privacy Framework and European Commission standard contractual clauses where applicable. Further information is available in the Google Privacy Policy.
7. Retention periods
| Data | Retention period or criterion |
|---|---|
| Orders, invoices, payments and other accounting source data | At least 5 years, or longer where required by applicable law |
| Customer account data | While the account is active or until a deletion request; transaction data is retained after account deletion for as long as required by legal obligations |
| Contact-form messages and ordinary customer correspondence | Up to 2 years after the matter is resolved, unless the information must be retained for an order, warranty or legal claim |
| Warranty, withdrawal, return and complaint data | Until the matter is finally resolved and the applicable limitation period has expired; accounting documents are retained for at least 5 years |
| Newsletter subscription data | Until consent is withdrawn; a minimal record may then be retained to respect and demonstrate the opt-out |
| Anti-bot and submission rate-limiting IP records | 7 days |
| Google Analytics event-level data | Up to 14 months where consent has been given |
| Server access and error logs | For as long as necessary for website security, operation and technical troubleshooting, subject to the hosting provider’s retention period |
When a retention period ends, data is deleted or irreversibly anonymised unless continued retention is required by a legal obligation or legal claim. Data in backups is deleted in accordance with the service provider’s backup rotation cycle.
8. Cookies and analytics
Necessary cookies are used for the shop, session, cart, language, currency, security and cookie-preference functions. Google Analytics is activated only after your consent. Consent may be changed at any time by selecting “Cookie settings” in the website footer.
Further information is available in our Cookie Policy.
9. Data security
We use proportionate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction. Access is granted only to persons and service providers that need the data to perform their duties.
10. Your rights
Under the GDPR, you have the right to:
- receive information about processing and obtain access to your data;
- request correction of inaccurate or incomplete data;
- request erasure in the circumstances provided by law;
- request restriction of processing in the circumstances provided by law;
- receive your data in a structured, commonly used and machine-readable format where data portability applies;
- object to processing based on our legitimate interests;
- withdraw consent at any time without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with the Latvian Data State Inspectorate.
Requests may be sent to info@sujletak.lv. To protect your data, we may request information needed to verify your identity. We will respond without undue delay and normally within one month.
Latvian Data State Inspectorate: Elijas iela 17, Riga, LV-1050, Latvia; email pasts@dvi.gov.lv; website www.dvi.gov.lv.
11. Automated decision-making
We do not use solely automated decision-making or profiling that produces legal or similarly significant effects concerning you.
12. Website and form security
We use the Cloudflare Turnstile security service to protect the website, customer accounts, registration forms and contact forms against automated submissions, spam and other malicious activity.
During this check, the IP address, browser User-Agent information, TLS connection characteristics, website identifier, originating domain and other technical signals required for the security assessment may be processed.
The legal basis for this processing is the controller's legitimate interest in protecting the website, its users and information systems against fraud, spam, automated attacks and unauthorised use in accordance with Article 6(1)(f) of the General Data Protection Regulation.
Cloudflare, Inc. processes part of this data on our behalf when providing the Turnstile service and may also process certain signals as an independent controller to improve its bot-detection capabilities. Data may be processed outside the European Economic Area subject to the data-protection safeguards specified by Cloudflare. Further information is available in the Cloudflare Turnstile Privacy Addendum and the Cloudflare Privacy Policy.
13. Changes to this Privacy Policy
We may update this Privacy Policy when our processing activities, service providers or applicable requirements change. The current version will always be available on this page.