This policy explains how SIA Strix Studios processes personal data when you visit the M701 online shop, create an account, shop as a guest, place an order, subscribe to newsletters, submit a review or contact us. We process personal data under the General Data Protection Regulation (GDPR) and applicable Latvian law.
1. Data controller and contact details
The controller responsible for your personal data is SIA Strix Studios, registration number 40103735793.
Registered address: Rīga, Vecmīlgrāvja 1. līnija 35–39, LV-1015, Latvia.
Business premises: Viskalu 36A, Rīga, LV-1006, Latvia.
Telephone: +371 22 43 50 75.
Privacy and customer enquiries: [email protected].
2. Personal data we collect and its sources
We collect information you provide through checkout, your account, newsletter subscriptions, reviews, contact forms, email or other communications. We also receive payment confirmations from payment providers and shipment updates from carriers. Technical information is collected when your browser connects to our services and, with consent where required, through analytics.
- Contact and order details: name, email address, telephone number, billing and delivery details, selected parcel locker, purchased goods, order history and correspondence about delivery, returns or complaints.
- Business purchase details: company name, registration and VAT numbers, business address and contact-person details, where relevant.
- Account details: account identifiers, login credentials, saved addresses and account preferences.
- Payment information: payment method, amount, status, transaction references and information necessary to reconcile payments or issue refunds. Card payments are processed through Stripe; please do not send full card details or security codes by email or contact form.
- Messages and reviews: information you include in enquiries, attachments, ratings, review text and the name displayed with a review.
- Subscription and consent records: email address, subscription choices, consent dates and unsubscribe requests.
- Technical and analytics information: IP address, browser and device information, request times, security logs, cookie identifiers and, where you consent to analytics, page visits, interactions, referral information and approximate location.
If you provide another person's details for delivery, ensure you are entitled to do so and make this policy available to them. Do not include sensitive personal information in reviews or messages unless necessary for your request.
3. Purposes and legal bases
- Orders, payments, delivery, accounts and purchase-related support: performance of a contract or steps requested before entering into a contract, under GDPR Article 6(1)(b).
- Accounting, tax records and mandatory consumer or regulatory obligations: compliance with legal obligations, under Article 6(1)(c).
- General enquiries and communications with business representatives: our legitimate interest in responding to requests and managing business relationships, under Article 6(1)(f), where the contractual basis does not apply to the individual.
- Website operation, security, troubleshooting and establishing or defending legal claims: our legitimate interests in maintaining a reliable shop, protecting information and protecting our rights, under Article 6(1)(f). We limit this processing to what is necessary and balance it against your rights.
- Newsletter subscriptions, publication of reviews and optional analytics: your consent, under Article 6(1)(a). You may withdraw consent at any time.
Information marked as required at checkout is needed to process the purchase or meet legal requirements. Without it, we may be unable to accept payment, fulfil your order or provide an invoice. An account is optional because guest checkout is available. Newsletter subscriptions, reviews and optional analytics are voluntary and are not conditions of purchase.
4. Newsletters and public reviews
If you subscribe, we use your email address to send the newsletters you requested through Brevo. You can unsubscribe using the link in a newsletter or by contacting us. Unsubscribing does not stop necessary order or service messages. We do not use your data for other marketing or advertising profiles. Individual email-open or click tracking is not covered by newsletter consent alone; such optional tracking requires separate consent where applicable.
When you submit a review for publication, its text, rating and chosen display name may be visible to other visitors. Your email address is not published as part of the review. Avoid including private contact details in public text. You may contact us to withdraw consent to publication or request removal.
5. Cookies, Google Analytics and Google Tag Manager
Strictly necessary cookies support functions such as the shopping basket, checkout, login, security and remembering cookie choices. Where the legal exemption applies, these do not require consent.
With your consent, we use Google Analytics to understand how visitors use the shop and improve its content and usability. Google Tag Manager manages website tags; it is not itself a legal basis for collecting data. Optional analytics tags and related data collection are enabled only after the corresponding consent.
You may reject optional cookies or change and withdraw consent through the website's cookie settings. Rejecting analytics does not prevent shopping. Browser settings also allow you to delete or block cookies, although blocking necessary cookies may affect functionality.
The cookie settings provide details of the cookies actually used, their providers, purposes and durations. Our retention period for Google Analytics user-level and event-level data is up to 14 months, without restarting that period for a user identifier on each new visit. This setting does not determine individual cookie lifetimes. Statistics that no longer identify anyone may be retained longer. See Google's Privacy Policy for Google's processing information.
6. Who receives personal data
We share only the information needed for the relevant service or legal purpose with authorised staff and the following categories of recipient:
- DigitalOcean: hosting and technical infrastructure for the shop and its data.
- Cloudflare: website delivery, performance and security services, which may process network and request information.
- Brevo: transactional email delivery and subscribed newsletters, including necessary contact and message information.
- Google: Google Analytics and Google Tag Manager services, subject to the consent arrangements described above.
- Stripe and SEB: payment processing, settlement and refunds.
- DPD, Omniva or another carrier agreed for your order: recipient name, contact details, delivery destination and shipment information necessary for delivery.
- Accounting, legal and technical service providers: where engaged and where access is necessary for their work.
- Competent authorities: where disclosure is legally required or necessary for a lawful claim or proceeding.
Providers processing data on our behalf must act under appropriate data-processing arrangements. Banks, payment providers, carriers and other recipients may also act as independent controllers for their own legal obligations and services. Their privacy notices explain that processing. We do not sell personal data.
7. International transfers
Some providers and their subprocessors operate internationally. Data may therefore be processed outside the European Economic Area, including in the United States. We do not assume that all data remains in Latvia or the EU.
Where such a transfer occurs, it must be covered by an applicable European Commission adequacy decision or appropriate safeguards, such as the Commission's Standard Contractual Clauses and any necessary supplementary measures. Reliance on the EU–US Data Privacy Framework is limited to recipients with a valid certification covering the relevant processing. Contact us to request information about the safeguards for a particular transfer or a copy of the applicable safeguards, subject to protection of confidential information.
8. How long we retain data
We apply the following retention schedule. Where categories overlap, we retain only the information needed for the purpose that remains valid.
- Invoices and other ordinary accounting supporting documents: at least five years, and longer only where required by accounting, tax or transaction-traceability obligations. Accounting registers are retained for ten years where required by Latvian law.
- Operational order and delivery records: three years after completion of the order, unless needed for an unresolved complaint, a legal claim or the accounting obligations above.
- Customer accounts: while active; deleted or anonymised after three years of inactivity. You may request earlier account deletion. Separately required transaction records remain subject to their own retention periods.
- Enquiries and support correspondence: two years after resolution, unless part of a transaction record, an unresolved dispute or a legal obligation requiring longer retention.
- Newsletter subscription data: until you unsubscribe or after two years without renewed confirmation of interest. Minimal suppression information may be retained while we operate the mailing list to honour an unsubscribe request.
- Consent records: while we rely on the consent and for up to three years afterwards to demonstrate compliance, unless a particular claim requires longer retention.
- Published reviews: until you withdraw publication consent, the relevant product page is removed or three years after publication, whichever occurs first.
- Google Analytics user-level and event-level data: up to 14 months, as described above.
- Routine website and security logs: up to 90 days; relevant entries may be kept longer to investigate a specific incident or protect legal rights.
- Backup copies: deleted data expires from routine backups within 90 days. Backups are restricted to recovery purposes; relevant deletions are reapplied if a backup is restored.
Where a legal hold or dispute requires longer retention, we restrict use to that purpose and delete or anonymise the data when the need ends. Independent providers may have separate legal retention obligations for data they control.
9. Security and automated decisions
We use appropriate technical and organisational measures to protect personal data, including limiting access to people and providers who need it. No online system can guarantee absolute security. Keep your account credentials confidential and contact us if you suspect unauthorised use.
We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you. Payment providers may carry out their own security and compliance checks under their own privacy notices.
10. Your rights
Subject to the conditions in the GDPR, you may request access to and a copy of your data, correction, erasure, restriction of processing and portability of data processed by automated means on the basis of consent or a contract.
You may object to processing based on legitimate interests for reasons relating to your particular situation. You may object to direct marketing at any time. You may withdraw consent without affecting the lawfulness of processing carried out before withdrawal.
Send requests to [email protected]. We may request proportionate information to verify your identity. We normally respond within one month; where legally permitted, we may extend this by up to two further months and explain the reason within the first month. Requests are normally free of charge.
These rights are not absolute: for example, we may need to retain an invoice despite an account-deletion request. We will explain any applicable restriction.
11. Complaints and policy changes
You may contact us about any privacy concern. You also have the right to complain directly to Latvia's Data State Inspectorate (Datu valsts inspekcija), or another competent data-protection authority, including in the EU/EEA country of your habitual residence or place of work. Contacting us first is not a condition for exercising that right.
We may update this policy when our services or legal requirements change. The current version will be available on this page. We will give additional notice of material changes where appropriate and obtain new consent where required.