Privacy Policy

SIA “Gamalu” — www.gamalu.eu

1 General provisions

1.1

This Privacy Policy describes how SIA “Gamalu”, registration number 40203721465, registered address Rīga, Viļa Plūdoņa iela 3 – 3A, LV-1002 (hereinafter — the “Controller”, “we” or “us”) collects, processes and stores the personal data that the online store www.gamalu.eu receives from its customers and from persons who visit the website (hereinafter — the “Data Subject” or “you”).

1.2

Personal data is any information relating to an identified or identifiable natural person. Processing is any operation performed on personal data, including collection, recording, storage, use, disclosure and erasure.

1.3

The Controller ensures that personal data is processed in accordance with applicable law, including Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”).

2 Collection, processing and storage of personal data

2.1

Personal data is collected mainly through the online store and by e-mail, and, where necessary, in paper form (for example, in the course of corporate orders or marketing activities).

2.2

Personal data is processed only where there is a lawful basis for doing so, including where processing is necessary to fulfil an order or contract, comply with a legal obligation, pursue our legitimate interests, or where you have given your consent.

2.3

The Data Subject is responsible for the accuracy of the data submitted and must notify us without delay of any changes to it.

2.4

The Controller is not liable for losses arising from incorrectly supplied information.

3 Processing of customer personal data

3.1

The Controller may process the following personal data:

  • name and surname;
  • contact details (e-mail address and/or telephone number);
  • transaction data (goods purchased, delivery address, price, payment information, etc.);
  • any other information submitted to us while purchasing goods and services offered on the website or while contacting us.
3.2

In addition to the above, the Controller is entitled to verify the accuracy of the data submitted using publicly available registers.

3.3

The legal basis for processing personal data is Article 6(1)(a), (b), (c) and (f) of the GDPR:

  • (a) consent — where the data subject has given consent to the processing of their personal data for one or more specific purposes, for example for marketing communications where consent is required;
  • (b) contract — where processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract, including processing and delivering orders;
  • (c) legal obligation — where processing is necessary for compliance with a legal obligation to which the Controller is subject, including applicable accounting, tax and other legal requirements;
  • (f) legitimate interests — where processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, such as protecting the website, preventing fraud, handling customer enquiries and defending legal claims, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject, in particular where the data subject is a child.
3.4

The Controller stores and processes the Data Subject’s personal data for as long as at least one of the following criteria applies:

  • the personal data is necessary for the purposes for which it was received;
  • for as long as the Controller and/or the Data Subject may exercise their legitimate interests in the manner prescribed by law, for example, to submit objections or to bring or conduct a claim in court;
  • for as long as there is a legal obligation to retain the data, for example under accounting legislation;
  • for as long as the Data Subject’s consent to the relevant processing remains in force, where no other lawful basis for processing exists.

Once these circumstances cease to apply, the retention period ends and all relevant personal data is irreversibly deleted from computer systems and from the electronic and/or paper documents that contained it, or those documents are anonymised.

3.5

In order to fulfil our obligations towards you, the Controller is entitled to transfer your personal data to cooperation partners and processors who carry out the necessary processing on our behalf — for example accountants, courier services and IT service providers. Payment processing is provided by Stripe and PayPal, and therefore we transfer to these providers the personal data required to execute the payment. Upon request, we may transfer your personal data to state and law-enforcement authorities in order to defend our legal interests where necessary, by drawing up, submitting and defending legal claims.

3.6

When processing and storing personal data, the Controller implements organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing.

4 Rights of the Data Subject

4.1

Under the GDPR and applicable national law you have the right to:

  • access your personal data, receive information about its processing, request a copy of your personal data in electronic format, and have that data transferred to another controller (data portability);
  • request the rectification of incorrect, inaccurate or incomplete personal data;
  • have your personal data erased (the “right to be forgotten”), except where the law requires the data to be retained;
  • withdraw consent previously given for the processing of personal data;
  • restrict the processing of your data — the right to request that we temporarily stop processing all of your personal data;
  • lodge a complaint with the supervisory authority, the Data State Inspectorate of the Republic of Latvia (www.dvi.gov.lv).
4.2

To exercise these rights, please submit a request by e-mail to gamalueu@gmail.com

4.3

We respond to requests within one month of receipt. Where the request is complex or where several requests have been received, this period may be extended by a further two months, and we will inform you of the extension and the reasons for it.

5 Final provisions

5.1

This policy has been drawn up in accordance with the EU General Data Protection Regulation, the laws of the Republic of Latvia and other applicable legislation.

5.2

The Controller is entitled to amend this policy without prior notice. The latest version is always available on the website: https://www.gamalu.eu.

Secure Payments
Tellus gravida ipsum aut facilisis tempus at et aliquam estsem.
Free Shipping
Non pulvinar aenean ultrices lectus vitae imperdiet aeu.
24/7 Support
Nullam iaculis vestibulum arcu id urnain pellentesque quis.
Gifts & Sales
Aliquet ullamcorper leo mi vel sit pretium euismod eget libero.