Privacy policy
Last updated: 09.10.2026.
1. Who we are
Baltland Group SIA (registration no. 40203509511, VAT LV40203509511), Turaidas iela 6, Rīga, LV-1039, Latvia, runs baltland.com and decides how your personal data is used (we are the "controller" under the GDPR). For any privacy question, write to info@baltland.com.
2. What we collect, why, and for how long
| Why | What data | Legal basis (GDPR) | How long |
|---|---|---|---|
| Processing and delivering your order | Name, email, phone, delivery address and pick-up point, order contents, payment status (we never see your full card details) | Performing our contract with you — Art. 6(1)(b) | As long as Latvian accounting and tax law requires us to keep order records, then deleted |
| Customer service, returns and guarantee claims | Your messages, photos you send, order number | Contract — Art. 6(1)(b); our legitimate interest in handling claims — Art. 6(1)(f) | Until the request and any guarantee period are closed, plus 1 year |
| Email newsletter and early access to new batches | Email, first name (if given), how and when you signed up, whether you open or click our emails | Your consent — Art. 6(1)(a) | Until you unsubscribe. We then keep only your email on a "do not contact" list, so we respect your choice |
| Back-in-stock and new-batch alerts | Email, the product you asked about | Your consent — Art. 6(1)(a) | Until the alert is sent or you unsubscribe |
| Product reviews | Display name, review text, rating, photos you add | Your consent — Art. 6(1)(a) | Until you ask us to remove the review |
| Running and protecting the website | IP address, browser and device data, strictly necessary cookies | Our legitimate interest in a secure, working shop — Art. 6(1)(f) | Short-term, as set by each cookie or log |
| Statistics and advertising | How you use the site, device data, cookie identifiers | Your consent via the cookie banner — Art. 6(1)(a) | Until you withdraw consent, or the cookie expires |
| Legal obligations | Invoices and accounting records | Legal obligation — Art. 6(1)(c) | As required by Latvian law |
3. Who we share your data with
We only share what each provider needs to do its job, and we never sell your personal data.
- Shopify — our online shop platform and checkout.
- Klaviyo — email newsletter, sign-up forms and product reviews.
- DPD — delivery of your parcel.
- Payment providers — processing your payment.
- Google and Meta (Facebook, Instagram) — advertising measurement, only if you accept marketing cookies.
- Our accountant and public authorities — when the law requires it.
4. Data outside the EU
Some of these providers (for example Shopify, Klaviyo, Google and Meta) may process data in the United States or other countries outside the EU. When they do, the transfer is protected by the EU–US Data Privacy Framework where the provider is certified under it, or by the European Commission's Standard Contractual Clauses.
5. Cookies
When you first visit, our cookie banner lets you accept or decline cookies that aren't strictly necessary. Strictly necessary cookies (for the cart and checkout, for example) are always on. Statistics and marketing cookies are only used if you accept them. You can change your choice at any time via Cookie preferences.
6. Your rights
Under the GDPR you can ask us to:
- show you the personal data we hold about you (access);
- correct it (rectification);
- delete it (erasure), unless the law requires us to keep it;
- limit how we use it (restriction);
- give it to you in a portable format (portability);
- stop using it based on our legitimate interest (objection) — and you can always object to marketing.
Where we rely on your consent, you can withdraw it at any time — for emails, simply use the unsubscribe link at the bottom of every email. To use any of these rights, write to info@baltland.com. We reply within one month.
If you think we've handled your data wrongly, you can complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv) or the data protection authority in your own country. We'd be glad if you told us first, so we can put it right.
7. Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
8. Children
Our shop isn't aimed at children under 16, and we don't knowingly collect their personal data.
9. Security
We use reputable providers and keep access to personal data limited to what's needed. No system is perfectly secure, so please don't send sensitive information (like card numbers) by email.
10. Changes
If we change this policy, we'll update it here and change the date at the top.