Privacy policy

1. Controller

The controller of personal data is SIA “Cosmepro”, reg. No. 40203481832, registered address: Ieroču iela 2-11, Riga, LV-1013 — the official PAESE representative in Latvia. Studio and shop: Aleksandra Čaka iela 26, Riga.

For questions about data processing write to info@paesecosmetics.lv or call +371 26 849 411.

2. What data we process

• Order data: first and last name, email, phone, delivery address or chosen parcel locker, ordered products, amount, discounts, gift card and payment status. We neither see nor store payment card details — they are processed by the payment service provider.
• Account data: login email, encrypted password, addresses, order history (including orders placed in the previous paesecosmetics.lv shop), wishlist and personal offers.
• Business partner data: company name, registration and VAT number, address, contact person, terms of cooperation and the content of the application.
• Communication: messages from contact forms, email, phone, WhatsApp and Instagram, including photos you send for a shade consultation.
• Reviews: name, rating, text and photos added to a review.
• Unfinished order: if you enter your email at checkout but do not finish the order, we keep the email and cart contents to remind you about the cart.
• Site use: anonymised visit statistics without cookies (pages, source, device type). The IP address is not stored: a new irreversible code is created from it every day. With your consent — also analytics and advertising cookies (see section 6).

3. Purposes and legal basis

Purpose	Legal basis (GDPR Art. 6)
Accepting the order, payment, delivery, returns and communication about the order	Performance of a contract — point 1(b)
Customer account, order history, partner prices and discounts	Performance of a contract — b)
Invoices and accounting	Legal obligation — c)
Reminders about an unfinished order and requests to rate a purchase	Legitimate interests — f); you can opt out at any time via the link in the email
Answering questions, shade consultations, partnership applications	Steps at your request before a contract — b), legitimate interests — f)
Cookie-free site statistics, security and fraud prevention	Legitimate interests — f)
Google Analytics, Google Ads and Meta measurement and advertising	Consent — a)
Newsletters	Consent — a)

4. Who we share data with

We share data only with the service providers needed for the purpose concerned, and only to the extent they need:

• Stripe — card payment processing;
• Omniva — parcel locker delivery (name, phone, email, locker);
• SendPulse — sending order and account emails; Google Workspace — our email;
• netcup GmbH (Germany) — the server that runs the site;
• accounting software and accounting service providers — invoices and bookkeeping;
• Google (Analytics, Ads) and Meta (Facebook, Instagram) — only with your consent;
• public authorities, where required by law.

Some service providers (such as Google, Meta, Stripe) may also process data outside the European Economic Area. In that case data protection is ensured by a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or standard contractual clauses. We do not sell data.

5. How long we keep data

• orders and invoices — as long as accounting law requires (usually 5 years) and until possible claims become time-barred;
• customer account — while the account is active or until it is deleted at your request;
• unfinished order data — 90 days;
• anonymised visit statistics — up to 400 days;
• communication and applications — until the matter is resolved, but no longer than 2 years; shade consultation photos are deleted after the consultation;
• reviews — while they are published on the site;
• cookie choice — 12 months.

6. Cookies

Cookies are small files that a website stores on your device. We use two types of cookies:

• Necessary — cart, checkout, account login, security and your cookie choice. The shop does not work without them, so no consent is needed. Guests’ wishlists are saved in the browser’s storage.
• Analytics and marketing — Google Analytics, Google Ads and Meta Pixel. They help us understand what visitors find useful and show relevant ads. They are switched on only with your consent.

If you agree to these cookies, we also send purchase information from our server to measure results accurately: to Google with analytics consent (order amount and products), to Meta with marketing consent (also encrypted email and phone). You can change your choice at any time: Cookie settings.

7. Your rights

You have the right to request access to your data, its correction or erasure, restriction of processing, data portability, to object to processing based on legitimate interests and to withdraw consent at any time. Send requests to info@paesecosmetics.lv — we will reply within one month. You can correct most account data yourself in My account.

If you believe we process data incorrectly, you can complain to the Data State Inspectorate (www.dvi.gov.lv), but we invite you to contact us first — we will try to resolve the matter.

8. Changes to this policy

We may update this policy if our services or the law change. The current version is always available on this page.