Privacy Policy
General Provisions
1.1. This Privacy Policy describes how SIA “Altes,” registration no.: 45403042897, legal address: Vienības gatve 87e, Riga, Latvia, LV-1004 (hereinafter referred to as the “Data Controller”), collects, processes, and stores personal data obtained from its clients and website visitors at drflex.eu (hereinafter referred to as the “Data Subject” or “You”).
1.2. Personal data refers to any information relating to an identified or identifiable natural person, i.e., the Data Subject. Processing refers to any operation performed on personal data, such as collection, recording, modification, use, access, deletion, or destruction.
1.3. The Data Controller adheres to the principles of data processing prescribed by law and ensures that personal data is processed in compliance with applicable legal regulations.
Collection, Processing, and Storage of Personal Data
2.1. The Data Controller collects, processes, and stores personally identifiable information primarily through the online store’s website and email communications.
2.2. By visiting and using the services provided on the online store, you agree that any information you provide will be used and managed in accordance with the purposes outlined in this Privacy Policy.
2.3. The Data Subject is responsible for ensuring that the personal data submitted is accurate, complete, and up-to-date. Providing false information intentionally is considered a violation of this Privacy Policy. The Data Subject must immediately inform the Data Controller of any changes to the submitted personal data.
2.4. The Data Controller is not liable for any damages incurred by the Data Subject or third parties due to the submission of inaccurate personal data.
Processing of Customer Personal Data
3.1. The Data Controller may process the following personal data:
3.1.1. First name, last name
3.1.2. Date of birth
3.1.3. Contact information (email address and/or phone number)
3.1.4. Transaction data (purchased goods, delivery address, price, payment information, etc.)
3.1.5. Any other information submitted during the use of the website’s services or products or when contacting us.
3.2. In addition to the above, the Data Controller has the right to verify the accuracy of the provided data using publicly available registers.
3.3. The legal basis for processing personal data is established in Article 6(1) of the General Data Protection Regulation (GDPR), including:
a) The Data Subject has given consent for the processing of their personal data for one or more specific purposes;
b) Processing is necessary for the performance of a contract to which the Data Subject is a party or to take steps at the Data Subject’s request prior to entering into a contract;
c) Processing is necessary for compliance with a legal obligation to which the Data Controller is subject;
f) Processing is necessary for the purposes of legitimate interests pursued by the Data Controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject that require the protection of personal data, particularly if the Data Subject is a child.
3.4. The Data Controller stores and processes the Data Subject’s personal data as long as at least one of the following criteria is met:
3.4.1. The personal data is necessary for the purposes for which it was collected;
3.4.2. The Data Controller and/or the Data Subject may exercise legitimate interests under applicable external regulations, such as filing objections, claims, or legal proceedings;
3.4.3. While there is a legal obligation to retain the data, for example, in accordance with the Accounting Law;
3.4.4. As long as the Data Subject’s consent for the relevant personal data processing is in effect, provided there is no other lawful basis for data processing.
Once the conditions mentioned in this section cease to exist, the retention period for the Data Subject’s personal data also ends. All relevant personal data is irreversibly deleted from computer systems and electronic and/or paper documents that contained the data or such documents are anonymized. a legal obligation to retain the data, for example, in accordance with accounting laws.
3.5. To fulfill its obligations towards you, the Data Controller has the right to transfer your personal data to business partners and data processors who process data on our behalf, such as accountants, courier services, and others. The data processor becomes the controller of personal data during such processing.
Payment processing is carried out by the payment platforms Stripe and PayPal. Therefore, our company transfers the necessary personal data for payment execution to the owners of these platforms (Stripe and PayPal).
Upon request, we may transfer your personal data to government authorities and law enforcement agencies to defend our legal interests, including preparing, submitting, and defending legal claims if necessary.
Data Subject Rights
4.1. In accordance with the General Data Protection Regulation (GDPR) and the laws of the Republic of Latvia, you have the following rights:
4.1.1. Access your personal data – You have the right to receive information about how your personal data is processed, request a copy of your personal data in electronic format, and transfer this data to another controller (data portability);
4.1.2. Request correction – You have the right to request the correction of incorrect, inaccurate, or incomplete personal data;
4.1.3. Request deletion – You have the right to request the deletion of your personal data (“the right to be forgotten”), except in cases where the law requires data retention;
4.1.4. Withdraw consent – You have the right to withdraw your previously given consent for the processing of personal data;
4.1.5. Restrict data processing – You have the right to request a temporary suspension of all processing of your personal data;
4.1.6. Lodge a complaint – You have the right to file a complaint with the Data State Inspectorate (Datu valsts inspekcija).
You can submit a request to exercise your rights by filling out a form in person at Brīvības gatve 403, Riga, Latvia, LV-1024, or by sending a request electronically via email to customer support at
hello@drflex.eu.
Final Provisions
5.1. This Privacy Policy has been developed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (April 27, 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, which repeals Directive 95/46/EC (General Data Protection Regulation), as well as the applicable laws of the Republic of Latvia and the European Union.
5.2. The Data Controller reserves the right to make changes or additions to this Privacy Policy at any time without prior notice. Amendments become effective upon their publication on the website drflex.eu.