Controller
Personal data controller: Spices Ierīkošana Rīga (spicesierikosanariga.lv).
If you have questions about data processing or want to exercise your rights, get in touch using the form on the contact page.
What data we process
- In the request form: name, phone number, address, the chosen service, when the service is needed, and the description you write (for example the type and depth of the source, the problem, access).
- Technical data: IP address, browser and device information and the time of the request, which the hosting provider processes to keep the website running and secure.
- Cookies, as described on the cookies page.
Please do not give data in the form that is not needed to assess the job, especially health data or other sensitive data.
Why and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| To answer the request, get in touch, state a price and agree on the job | Form data | Steps taken before entering into a contract at your request, GDPR Article 6(1)(b) |
| To send a confirmation message that the request was received to the phone you gave | Name, phone | GDPR Article 6(1)(b) |
| To do the job and prepare the work documents | Form data, address, scope of work | Performance of a contract, GDPR Article 6(1)(b) |
| Meeting accounting and tax requirements | Transaction data | Legal obligation, GDPR Article 6(1)(c) |
| Keeping records of requests, resolving disputes, website security | Form and technical data | Legitimate interests, GDPR Article 6(1)(f) |
| Visit statistics, if used | Cookie data | Consent, GDPR Article 6(1)(a) |
Who we pass data to
- Service providers (partners who do the job you requested). They receive only the data needed to carry out the request.
- An accredited laboratory, if you order a water test: only the data needed to identify the sample and prepare the result, for example the address where the sample was taken.
- Processors we use to run the website and handle requests: providers of website hosting, form processing and automation, data storage and messaging services. They process the data only on our instructions and in line with GDPR Article 28.
- State authorities only when the law requires it.
We do not sell your data and do not pass it to third parties for marketing.
Transfers outside the European Economic Area
Some service providers may process data outside the European Economic Area. In such cases the transfer takes place only with the safeguards set out in Chapter V of the GDPR, for example on the basis of a European Commission adequacy decision or standard contractual clauses.
How long we keep data
- Requests that did not lead to a job are kept no longer than 24 months after the last contact, and then deleted.
- Data related to a completed job is kept as long as accounting and tax laws require, or until the limitation period for possible claims ends.
- Technical data is kept as long as needed for website security.
You can ask for data to be deleted earlier if the law does not require it to be kept.
Your rights
- to access your data and receive a copy of it;
- to correct inaccurate data;
- to ask for data to be deleted;
- to ask for processing to be restricted;
- to object to processing based on legitimate interests;
- to receive your data in a portable format;
- to withdraw consent at any time, if processing is based on it.
We answer a request without undue delay and within one month at the latest, as the GDPR requires. If you believe your data is being processed incorrectly, please first get in touch with us; you also have the right to lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv).
Do you have to give your data
Giving data is voluntary, but without a phone number or other contact details we cannot answer the request. We do not carry out automated decision-making or profiling that would have legal effects for you.
Changes
We may update this policy if the services we use or the law change. The current version is always available on this page. Version: 03.11.2026.
Sources
- General Data Protection Regulation (EU) 2016/679: legal basis (Art. 6), processors (Art. 28), data subject rights (Art. 15–22), answer within one month (Art. 12, para. 3), transfers to third countries (Chapter V). checked 30 October 2026
- Data State Inspectorate - the supervisory authority for complaints checked 30 October 2026