Privacy Policy

Who We Are

This Privacy Policy describes how kormwick (kormwick Society with Limited Liability) collects, uses, and protects your personal information. We are committed to safeguarding your privacy and handling your data responsibly when you visit our website and purchase our midsummer solstice wreath kits.

We operate an e-commerce platform dedicated to handcrafted DIY wreath kits inspired by the Jūrmala Jāņi midsummer traditions, featuring oak leaves and wildflowers. Your trust is important to us, and we take our data protection responsibilities seriously.

Information We Collect

We collect personal information in several ways:

Account Information: When you register or create an account, we collect your name, email address, phone number, and password.
Order Information: We collect billing and shipping addresses, payment details (processed securely through third-party providers), and order history.
Communication Data: Messages, inquiries, and feedback you send through our contact forms or customer service channels.
Usage Data: Information about how you interact with our website, including pages visited, time spent, and click behavior.
Device Information: IP address, browser type, operating system, and device identifiers for analytics and security purposes.
Cookies: We use cookies to enhance your browsing experience and understand user preferences.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Consent: Where you have explicitly agreed to data processing, such as subscribing to our newsletter or marketing communications.
Contract Performance: Processing necessary to fulfill your orders, manage your account, and provide customer service.
Legal Obligation: Compliance with applicable laws, tax regulations, and data protection requirements.
Legitimate Interests: To improve our services, prevent fraud, maintain website security, and conduct analytics for business optimization.

In each case, we balance your rights against our legitimate interests to ensure fair and transparent data handling.

How We Use Your Information

We use the information we collect for specific purposes:

Processing and fulfilling your orders, including shipping and delivery management.
Creating and maintaining your account, and providing customer support.
Sending transactional emails about order confirmations, updates, and receipts.
Marketing communications and promotional offers (only with your consent).
Analyzing website usage patterns to improve our platform and user experience.
Detecting and preventing fraud, unauthorized access, and security threats.
Complying with legal obligations and responding to lawful requests from authorities.

We do not sell or share your personal data with third parties for their independent marketing purposes. Service providers assisting us with operations are bound by confidentiality agreements.

Data Retention

We retain your personal information for specific periods based on the type of data and its purpose:

Account Data: Retained for the duration of your account, and for 24 months after account deletion or last interaction.
Order Information: Maintained for 7 years to comply with accounting and tax regulations, then securely deleted.
Contact Form Messages: Stored for up to 24 months after your last message, then permanently removed.
Analytics and Usage Data: Retained for up to 14 months to analyze trends and improve our services.
Server Logs and IP Data: Kept for 12 months for security monitoring and troubleshooting purposes.
Marketing Consent Records: Maintained for the duration of your subscription, plus 12 months after unsubscription.

After the retention period expires, we securely delete or anonymize your data. In cases of legal disputes or regulatory requirements, we may retain data longer as permitted by law.

Your Rights

Under data protection laws, you have the following rights regarding your personal information:

Right to Access: You can request a copy of all personal data we hold about you.
Right to Rectification: You can correct or update inaccurate or incomplete information.
Right to Erasure: You can request deletion of your data, subject to legal and contractual obligations.
Right to Restrict Processing: You can limit how we use your information in certain circumstances.
Right to Data Portability: You can receive your data in a structured, commonly used format.
Right to Object: You can withdraw consent for marketing communications and certain processing activities.
Right to Lodge a Complaint: You have the right to file a complaint with the Data Protection Authority of Latvia.

To exercise any of these rights, please contact us using the information provided below.

Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience and analyze website performance. Cookies are small files stored on your device that help us recognize you and remember your preferences.

Types of Cookies We Use:

Essential Cookies: Required for basic website functionality, security, and order processing.
Analytics Cookies: Help us understand how visitors interact with our site to improve user experience.
Preference Cookies: Remember your choices, such as language and display preferences.
Marketing Cookies: Track your activity to deliver personalized advertisements and offers.

You can control cookie preferences through your browser settings or our cookie management tool on the homepage. Disabling certain cookies may affect website functionality. For detailed information about our cookie practices, please see our Cookie Policy.

Data Security

We implement comprehensive security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. Our security practices include encrypted data transmission (SSL/TLS), secure payment processing through trusted providers, restricted access to personal data, regular security audits, and employee training on data protection.

While we strive to maintain the highest security standards, no method of transmission over the internet is completely secure. We encourage you to use strong passwords and report any security concerns immediately. We will notify you of any data breaches affecting your information as required by law.

Third-Party Links and Services

Our website may contain links to third-party websites and services that are not operated by us. This Privacy Policy applies only to our platform. We are not responsible for the privacy practices of external websites, and we encourage you to review their privacy policies before providing any information.

If you access third-party payment processors or services through our website, your data will be handled according to their terms and policies. We carefully select service partners who meet our data protection standards.

International Data Transfers

If we transfer your personal data outside the European Economic Area (EEA), we implement appropriate safeguards such as Standard Contractual Clauses or other mechanisms approved by data protection authorities. We ensure that transfers comply with GDPR and other applicable data protection laws.

By using our services, you consent to the transfer of your information to countries outside the EEA if necessary for order fulfillment and service provision.

Children's Privacy

Our services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children without verifiable parental consent. If we become aware that we have collected data from a child under 13 without appropriate parental permission, we will take steps to delete such information promptly.

For young users aged 13-18, we provide additional privacy protections and recommend parental guidance when sharing personal information online.

Policy Updates and Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Last Updated" date and, where appropriate, by sending you an email notification or displaying a prominent notice on our website.

Your continued use of our services after such modifications constitutes your acceptance of the updated Privacy Policy. We recommend reviewing this page periodically to stay informed about how we protect your information.

Data Protection Authority

If you believe your data protection rights have been violated or you have concerns about our processing practices, you have the right to lodge a complaint with the Data Protection Authority of Latvia (Datu Valsts Inspekcija - DVI). You can contact them at their official website or office for further assistance.