Privacy Policy

Last updated: 11.08.2026

This Privacy Policy explains what personal data Atspruds ("we", "us", "our") collects when you browse www.atspruds.com, register an account, place an order, or contact us, why we collect it, who we share it with, and what rights you have over it. It should be read alongside our Cookie Policy and Terms & Conditions.

Who we are

The data controller responsible for your personal data is:

Didzis Sprūds
Adress: Brīvības 136-23, Rīga, LV-1012
Registration number: 06048411325
VAT number: LV06048411325

You can reach us about any privacy question via Contact Us form.

What personal data we collect

We collect the following categories of personal data:

Account data: email address, password (stored as a salted hash, never in plain text), first and last name, phone number, country, and a record of your acceptance of our Terms & Conditions (which version, and when).
Order and delivery data: billing and delivery name, street address, additional address details, city, postal code, country, and phone number for you and, if different, the recipient; the products, options and quantities you order; the total price, shipping cost and VAT breakdown; and your chosen payment method. Card numbers are entered directly on Stripe's own payment page and never pass through or get stored on our servers.
Saved addresses: if you create an account, any address you save to your address book for future orders.
Contact form data: your name, email address, optional phone number, and the content of your message.
Cookies and similar technologies: analytics, functionality and (where you consent) marketing cookies, as set out in full in our Cookie Policy.

We do not knowingly collect any special category data (e.g. health, religion, biometric data) and ask that you don't include any in free-text fields such as the contact form or address notes.

Why we process your data, and our legal basis

To create and manage your account — necessary to perform our contract with you (Art. 6(1)(b) GDPR).
To process and deliver your orders, including sharing your delivery details with our shipping carrier — necessary to perform our contract with you (Art. 6(1)(b)).
To process payment via Stripe and to detect and prevent fraud — necessary to perform our contract with you and our legitimate interest in preventing fraudulent transactions (Art. 6(1)(b) and (f)).
To respond to messages sent through our contact form — our legitimate interest in answering enquiries, or steps taken at your request prior to a contract (Art. 6(1)(f) / (b)).
To keep accounting and tax records of your order — a legal obligation we're subject to (Art. 6(1)(c)).
To record your consent to our Terms & Conditions — a legal obligation to demonstrate accountability, and our legitimate interest in being able to show what you agreed to (Art. 6(1)(c) / (f)).
For analytics and marketing cookies — only with your consent, given (or withdrawn) through the cookie banner (Art. 6(1)(a)). See our Cookie Policy.

Who we share your data with

We share personal data with the following service providers, who process it on our behalf or in their own right as part of delivering our service:

Stripe, Inc. — processes your payment and card details directly; receives your email address and order amount to do so.
Supabase, Inc. — hosts our database and handles account authentication; stores all account, order, and address data described above.
Resend — sends transactional emails on our behalf (order confirmations, and messages submitted through the contact form).
Our shipping carrier(s) — Latvijas pasts, VAS or Omniva, SIA — receive the recipient's name, address, and phone number to deliver your order.
Google LLC (Google Tag Manager / Analytics) and Cookiebot — only if you consent to analytics or marketing cookies via our cookie banner.

We do not sell your personal data, and we only disclose it beyond the above where required by law (for example, to a tax authority) or to protect our legal rights.

International data transfers

Some of the providers listed above may process personal data outside the European Economic Area (for example, in the United States). Where that happens, we rely on a valid transfer mechanism such as the European Commission's Standard Contractual Clauses or the provider's own adequacy certification.

How long we keep your data

Account data is kept for as long as your account is active, and deleted (or anonymised) 3 years after your last order or account activity.
Order and invoicing records are kept for 5 years.
Contact form messages are kept for 12 months from your last message, unless a longer period is needed to resolve an ongoing query.
Cookie retention periods are listed individually in our Cookie Policy.

Your rights

Under the GDPR, you have the right to:

Ask us for a copy of the personal data we hold about you (right of access);
Ask us to correct inaccurate or incomplete data (right to rectification);
Ask us to delete your data, where we no longer have a valid reason to keep it (right to erasure);
Ask us to restrict how we use your data, or object to certain processing (rights to restriction and objection);
Ask us to provide your data in a portable, machine-readable format (right to data portability);
Withdraw consent at any time, where we rely on consent (e.g. analytics/marketing cookies), without affecting processing carried out before you withdrew it.

We don't currently have a self-service tool for exporting or deleting your account — to exercise any of these rights, please contact us. We'll respond within one month, as required by law.

If you're unhappy with how we've handled your data, you also have the right to lodge a complaint with your local data protection supervisory authority — for us, that's Data State Inspectorate of Latvia (Datu valsts inspekcija).

Security

We use industry-standard measures to protect your data: all traffic to our site is encrypted (HTTPS), passwords are stored as salted hashes rather than plain text, payment card details are handled entirely by Stripe and never touch our servers, and access to order and customer data within our admin tools is restricted to authorised staff. No method of transmission or storage is 100% secure, but we work to protect your data using these safeguards.

Children's privacy

Our website and services are not directed at children, and we do not knowingly collect personal data from anyone under 16 years old.

Changes to this policy

We may update this Privacy Policy from time to time, for example if we start using a new service provider or our legal obligations change. We'll update the "Last updated" date at the top of this page whenever we do, and encourage you to check back periodically.

Contact us

If you have any questions about this Privacy Policy or how we handle your data, please get in touch.