Privacy Policy

SIA "FL BIROJS" Privacy Policy 

The purpose of this Privacy Policy is to inform how the personal data of data subjects is collected and processed, to explain how long it is stored, to whom it is disclosed, what rights data subjects have, and where to turn regarding the exercise of those rights or other matters related to the processing of personal data.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter – the Regulation), the Personal Data Processing Law of the Republic of Latvia, and other legal acts governing the protection of personal data.

SIA "FL BIROJS" follows these main principles of data processing:

– personal data is collected only for clearly defined and lawful purposes;

– personal data is processed only lawfully and in good faith;

– personal data is kept up to date;

– personal data is stored securely and for no longer than required by the defined data processing purposes or legal acts;

– personal data is processed only by SIA "FL BIROJS" employees who have been granted such rights in accordance with their job duties, or by duly authorized data processors.

1. DEFINITIONS

1.1. Data Controller – SIA "FL BIROJS" (hereinafter – the Company), registration number 40003875292, registered address Krustpils iela 54E, Riga, Latvia, LV-1057.

1.2. Data Subject – any natural person whose data is processed by the Company. The Data Controller collects only the data subject’s data that is necessary to ensure the Company’s operations and/or that arises from visiting, using or browsing the Company’s website, its „Facebook“ social network account, and similar (hereinafter – the Website). The Company ensures that the personal data collected and processed will be secure and used only for a specific purpose.

1.3. Personal data – any information directly or indirectly related to a data subject whose identity is known, or can be directly or indirectly established using the relevant data. Processing of personal data is any operation performed on personal data (including collection, recording, storage, editing, alteration, granting of access, submission of requests, transfer, archiving, etc.).

1.4. Consent – any freely given and informed confirmation by which the data subject agrees that their personal data be processed for a specific purpose.

2. SOURCES OF PERSONAL DATA

2.1. Personal data is provided by the data subject themselves. The data subject contacts the Company, uses the services provided by the Company, purchases goods and/or services, leaves comments, asks questions, subscribes to newsletters, contacts the Company to request information, etc.

2.2. Personal data is obtained when the data subject visits the Company’s website. The data subject fills in the forms available there, or for some other reason leaves their contact details, etc.

2.3. Personal data is obtained from other sources. Data is obtained from other institutions or companies, publicly available registers, etc.

3. PROCESSING OF PERSONAL DATA

3.1. By providing personal data to the Company, the data subject agrees that the Company will use the data collected in order to fulfil its obligations towards the data subject and to provide the services the data subject expects.

3.2. The Company processes personal data for the following purposes:

3.2.1. Ensuring the sale of furniture sold by the Company, delivery of orders to the Company’s customers, provision of furniture assembly services, and administration of the Company’s debtors. The following data is processed for this purpose:

• Contracts, VAT invoices and other related documents are kept in accordance with the retention periods set out in the internal records-management document-retention schedule approved by order of the Chief State Archivist of Latvia, as well as the periods set out in the Company’s approved internal local legal act (adopted for each calendar year).
• Data related to the administration of the Company’s debtors is stored for no longer than is necessary for the purposes for which the personal data is processed.

• Legal basis for processing personal data – the necessity to perform a contract to which the client, as the data subject, is a party, or to take steps at the client’s request prior to entering into a contract with them (GDPR Article 6(1)(b)); cases where the processing of certain personal data is required by law (GDPR Article 6(1)(c)); and the necessity to pursue the Company’s legitimate interest in improving its operations and business results (GDPR Article 6(1)(f)).

3.2.2. Ensuring the Company’s operations and business continuity. The following data is processed for this purpose:

• For the purpose of concluding and performing contracts, the personal data of suppliers (natural persons) may be processed: name(s), surname(s), personal identity number or date of birth, residential address, phone number, e-mail address, place of work, position, signature, details stated on a business-activity certificate (type of activity, group, code, name, periods of activity, date of issue, amount), individual activity certificate number, whether the data subject is a VAT payer, bank account and bank, the amount and currency of the service/goods, and any other data provided by the data subject, obtained by the Company in accordance with legal acts in the course of its operations, and/or which the Company is required to process under laws and/or other legal acts.
• For the purpose of concluding and performing contracts, the data of suppliers’ representatives is also processed: name(s), surname(s), phone number, e-mail address, company name, address, position, and authorization details (number, date, the authorized person’s date of birth, signature).
• Contracts, VAT invoices and other related documents are kept in accordance with the retention periods set out in the internal records-management document-retention schedule approved by order of the Chief State Archivist of Latvia, as well as the periods set out in the Company’s approved internal local legal acts (adopted for each calendar year).
• Legal basis for processing personal data – the necessity to perform a contract to which the client, as the data subject, is a party, or to take steps at the client’s request prior to entering into a contract with them (GDPR Article 6(1)(b)), as well as cases where the processing of certain personal data is required by law (GDPR Article 6(1)(c)).

3.2.3. Performance of internship agreements. The following data is processed for this purpose:

• Name(s), surname(s), personal identity number, or, if none, date of birth, signature, phone number, e-mail address, address, educational institution, internship period, and description of duties.
• Interns’ personal data contained in the relevant documents (contracts, orders, applications, etc.), whether in electronic form, on paper or in another format, is kept in accordance with the retention periods set out in the internal records-management document-retention schedule approved by order of the Chief State Archivist of Latvia, and the Company’s approved internal local legal acts (adopted for each calendar year).
• Legal basis for processing personal data – the necessity to perform a contract to which the intern, as the data subject, is a party, or to take steps at the intern’s request prior to entering into a contract with them (GDPR Article 6(1)(b)), as well as cases where the processing of certain personal data is required by law (GDPR Article 6(1)(c)).

3.2.4. Administration of requests, comments and complaints. The following data is processed for this purpose:

• Name(s), surname(s) and/or username, e-mail address, phone number, address, and the subject and text of the request, comment or complaint.
• Data relating to requests, comments and complaints is stored for 1 year from the date of submission.
• Legal basis for processing personal data – processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (GDPR Article 6(1)(f)), as well as the consent of the data subject (GDPR Article 6(1)(a)).

3.2.5. Electronic commerce. The following data is processed for this purpose:

• Name(s), surname(s), purchase history, delivery address for goods, residential address, phone number, e-mail address.
• Personal data is stored only to the extent, and for as long as, necessary to achieve the specified purposes. Once processing of a client’s personal data is no longer necessary, a decision is made to destroy it, except for data which must be archived under legal requirements or the Company’s internal local legal acts.
• Legal basis for processing personal data – the necessity to perform a contract to which the client, as the data subject, is a party, or to take steps at the client’s request prior to entering into a contract with them (GDPR Article 6(1)(b)).

3.2.6. Providing telephone consultations about the Company’s services, in order to improve the quality of customer service and to verify that information is provided competently and promptly (call recording). The following data is processed for this purpose:

• Audio recording of the phone call, and the date and duration of the call.
• Phone call recordings are kept for 1 (one) month.
• Legal basis for processing personal data – the consent of the data subject (GDPR Article 6(1)(a)).

3.2.7. Direct marketing. The following data is processed for this purpose:

• Name(s), surname(s), residential address, e-mail address, phone number.
• Data is stored for 5 years from the date consent is given. This period may be extended if the personal data is used, or may be used, as evidence or a source of information in pre-trial or other proceedings, including an investigation by the Data State Inspectorate, or in civil, administrative or criminal proceedings, or in other cases provided for by law. In such cases personal data may be stored for as long as necessary for these processing purposes and is destroyed without delay once no longer needed.
• Legal basis for processing personal data – the consent of the data subject (GDPR Article 6(1)(a)) and the necessity to pursue the Company’s legitimate interest in improving its operations and business results (GDPR Article 6(1)(f)).

3.2.8. Other purposes for which the Company is entitled to process a data subject’s personal data, where the data subject has given consent, where processing is necessary to pursue the Company’s legitimate interests, or where the Company is required to process the data under applicable legal acts.

4. USE OF SOCIAL NETWORKS

4.1. All information you provide via social media (including posts, use of the „Like“ and „Follow“ buttons, and other communications) is controlled by the controller of the relevant social network.

4.2. The Company currently has a profile on the „Facebook“ social network; its privacy policy is available here: https://www.facebook.com/privacy/explanation;

4.3. The Company currently has a profile on the „Instagram“ social network; its privacy policy is available here: https://help.instagram.com/519522125107875;

4.4. The Company currently has a profile on the „LinkedIn“ social network; its privacy policy is available here: https://www.linkedin.com/legal/privacy-policy;

4.5. The Company currently has a profile on the „YouTube“ social network; its privacy policy is available here: https://policies.google.com/privacy?hl=en-US;

4.6. The Company currently has a profile on the „TikTok“ social network; its privacy policy is available here: https://www.tiktok.com/legal/page/row/privacy-policy/en.

4.7. We recommend reviewing third parties’ privacy notices and contacting the relevant service providers directly if you have questions about how they use your personal data.

5. SENDING NEWSLETTERS

5.1. The Company uses the third-party service „Omnisend“ to send newsletters. To successfully deliver newsletters, the third party „Omnisend“ uses only the recipient’s e-mail address. „Omnisend“’s privacy policy is available here:

• „Omnisend“ privacy policy: https://www.omnisend.com/privacy/

5.2. You may opt out of receiving newsletters by clicking the „Unsubscribe“ button at the bottom of any newsletter received, by replying to the newsletter, or by contacting the Company directly by e-mail to request that you no longer receive newsletters from the Company.

6. ELECTRONIC COMMERCE

6.1. The Company’s online store is built on the „WordPress“ platform. Data collected for e-commerce purposes is stored on „WordPress“ servers. The online-store platform’s privacy policy is available at:

• „WordPress“ privacy policy: https://wordpress.org/about/privacy/.

6.2. The Company uses the A/S Swedbank platform to process payments. The payment platform’s privacy policy is available at:

• A/S Swedbank privacy policy: https://www.swedbank.lv/about/swedbank/about/privacy.

Our website is protected by a security protocol based on a data-encryption (SSL) certificate. The address of such secure store websites contains the letter „s“: „https://“.

7. DISCLOSURE OF PERSONAL DATA

7.1. The Company undertakes to observe its duty of confidentiality towards data subjects. Personal data may be disclosed to third parties only where necessary to conclude and perform a contract for the data subject’s benefit, or for other lawful reasons.

7.2. The Company may transfer personal data to its data processors, who provide services to the Company and process personal data on the Company’s behalf. Data processors may process personal data only in accordance with the Company’s instructions and only to the extent necessary to properly perform the obligations set out in the contract. The Company only engages data processors that provide sufficient guarantees that appropriate technical and organizational measures will be implemented, so that processing meets the Regulation’s requirements and protects the data subject’s rights.

7.3. The Company may also disclose personal data in response to requests from courts or state authorities, to the extent necessary to properly comply with applicable legal acts and the instructions of state authorities.

7.4. The Company guarantees that personal data will not be sold or rented to third parties. 

8. PROCESSING OF MINORS’ PERSONAL DATA

8.1. Persons under the age of 14 may not provide any personal data via the Company’s website. If a person is under 14 years of age, the consent of a parent or legal guardian must be obtained before any personal information is provided in order to use the Company’s services.

9. PERSONAL DATA RETENTION PERIOD

9.1. Personal data collected by the Company is stored in printed documents and/or the Company’s information systems. Personal data is processed for no longer than is necessary to achieve the purposes of processing, or for no longer than required by data subjects and/or provided for by legal acts.

9.2. Although a data subject may terminate their contract and stop using the Company’s services, the Company remains obliged to retain the data subject’s data in case of possible future claims or legal proceedings, until the applicable data-retention periods expire.

10. RIGHTS OF THE DATA SUBJECT

10.1. The right to receive information about the processing of data.

10.2. The right to access the data being processed.

10.3. The right to request correction of data.

10.4. The right to request erasure of data (the “right to be forgotten”). This right does not apply where the personal data for which erasure is requested is processed on another legal basis, for example, where processing is necessary to perform a contract or to comply with an obligation under applicable legal acts.

10.5. The right to restrict processing.

10.6. The right to object to processing.

10.7. The right to data portability. The right to data portability must not adversely affect the rights and freedoms of others. The data subject does not have the right to data portability for personal data that is processed in a non-automated manner in structured files, such as paper documents.

10.8. The right not to be subject to a decision based solely on automated processing, including profiling.

10.9. The right to lodge a complaint about the processing of personal data with the Data State Inspectorate.

The Company is obliged to enable the data subject to exercise the rights listed above, except in cases established by legal acts where it is necessary to safeguard state security or defence, public order, the prevention, investigation, detection or prosecution of criminal offences, important economic or financial interests of the state, the prevention, investigation and detection of breaches of professional or service ethics, or the protection of the rights and freedoms of the data subject or other persons.

11. PROCEDURE FOR EXERCISING DATA SUBJECT RIGHTS

11.1. To exercise their rights, a data subject may contact the Company:

11.1.1. by submitting a written application in person, by post, through a representative, or by electronic means – by e-mail: birojs@flbirojs.lv;

11.1.2. verbally – by phone: «[+371] 27507502»;

11.1.3. in writing – at the address: Krustpils iela 54E, Riga, LV-1057. 

11.2. To protect data from unlawful disclosure, upon receiving a data subject’s request to provide data or to exercise other rights, the Company is obliged to verify the identity of the data subject.

11.3. The Company shall respond to the data subject no later than one month from the date the request is received, taking into account the specific circumstances of the processing. Where necessary, this period may be extended by a further two months, taking into account the complexity and number of requests.

12. RESPONSIBILITIES OF THE DATA SUBJECT

12.1. The data subject is obliged to:

12.1.1. inform the Company of any changes to the information and data provided. It is important for the Company to hold correct and up-to-date information about the data subject;

12.1.2. provide the information necessary for the Company, upon receiving a request from a data subject, to identify that data subject and confirm that it is in fact dealing with them (by presenting an identity document, in another manner established by legal acts, or by using electronic means of communication that allow the data subject to be properly identified). This is necessary to protect the data of the data subject and other persons, so that information disclosed about a data subject is provided only to that data subject, without endangering the rights of others. 

13. FINAL PROVISIONS

13.1. By providing personal data to the Company, the data subject agrees to this Privacy Policy, understands its terms, and agrees to comply with them.

13.2. In the course of developing and improving its operations, the Company has the right to unilaterally amend this Privacy Policy at any time, whether in part or in full, by giving notice on the website www.flbirojs.lv.

13.3. Additions or amendments to the Privacy Policy take effect on the day they are published, i.e. the day they are posted on the website www.flbirojs.lv.