This policy explains what personal data we process when you shop at coverup.lv, send us a request for a custom order or simply visit the site. We keep it plain, without legal jargon. If anything is unclear, write to up@coverup.lv.
Who processes your data
The data controller is SIA "Mix Max", registration No. 40103263078, address: Augusta Deglava iela 46, Riga, LV-1035. CoverUp is a textile brand of SIA "Mix Max".
For any questions about your data, write to the e-mail address above.
What data we process
We only process the data needed to accept, make and deliver your order or to answer your question.
| Type of data | Examples | When we receive it |
|---|
| Contact details | first name, surname, e-mail, phone number | when you place an order, fill in a form or write to us |
| Delivery details | delivery address or chosen parcel locker | when you place an order |
| Order details | products, sizes, prices, order and payment status, invoices | when you place and pay for an order |
| Company details | name, registration No., VAT No., registered address | if you tick "Buying as a company" at checkout |
| Your design | uploaded files, a link to a file (e.g. failiem.lv), description | when you order a custom product or send a request |
| Correspondence | your messages, questions and our replies | when you write to us via a form, by e-mail or on WhatsApp |
| Technical data | IP address, browser type, time of visit | when you visit the site (for security and, if you agree, for statistics) |
We do not see or store payment card or online banking details. These are processed by the payment service provider (see "Who we share data with").
You can buy as a guest, without creating an account. We do not create customer profiles or make decisions based solely on automated processing.
Why and on what legal basis
| Purpose | Legal basis (Article 6(1) GDPR) |
|---|
| Accepting, making, paying for and delivering orders | performance of a contract (point (b)) |
| Answering questions and quoting for custom orders | steps taken at your request before entering into a contract (point (b)) |
| Warranty, returns and handling complaints | performance of a contract and legal obligation (points (b) and (c)) |
| Accounting and tax obligations | legal obligation (point (c)) |
| Site security, fraud and spam prevention | our legitimate interests (point (f)) |
| Visitor statistics and advertising measurement | your consent (point (a)), which you can withdraw at any time |
If you do not provide the data needed for an order (for example, a phone number for the parcel locker notification), we cannot fulfil the order.
Who we share data with
We do not sell data. We only share it with those who help fulfil your order, and only as much as they need:
- Payments: payments are processed by the payment platform https://makecommerce.lv/, so we transfer the personal data needed to make payments to the platform's owner, Maksekeskus AS.
- Delivery: the carrier you choose (Omniva, DPD, Venipak or Unisend) receives your name, phone number, e-mail and delivery point.
- Website maintenance: the hosting provider Hostinger (servers in the European Union) and the website developer, when technical support is needed.
- Sending e-mails: Google Workspace (Google Ireland Limited), which we use to send order confirmations and reply to messages.
- Accounting: if accounting is outsourced, the accounting service provider receives only the data shown on invoices.
- Statistics and advertising: Google (Google Analytics, Google Tag Manager, Google Ads), only if you have given your consent.
- Public authorities: only where required by law.
Some service providers (for example, Google) may also process data outside the European Economic Area. In that case the transfer takes place with the safeguards set out in the GDPR, for example the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
How long we keep data
- Orders and invoices: for as long as required by accounting and tax legislation.
- Warranty and return information: for the whole warranty period (6 months) and until any possible claims become time-barred.
- Correspondence and requests: 3 years from receipt, if they have not led to an order.
- Uploaded design files: until the order is fulfilled and the warranty period ends (6 months), so that we can make the product again if it needs replacing under warranty.
- Cookies: see the table in the "Cookies" section.
When the period ends, the data are deleted or anonymised.
Your rights
At any time you can:
- find out what data we process about you and receive a copy;
- ask us to correct inaccurate data;
- ask us to delete data we are no longer entitled to keep;
- ask us to restrict processing, or object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw your consent (for example, for statistics cookies). This does not affect processing carried out before the withdrawal.
Send your request to up@coverup.lv. We will reply within one month. To protect your data, we may ask you to confirm your identity, for example with your order number.
If you believe we are processing your data incorrectly, you can lodge a complaint with the Data State Inspectorate (www.dvi.gov.lv). We would be grateful if you contacted us first, so that we can resolve the issue faster.
Cookies
Cookies are small text files that a website saves in your browser. Without the necessary cookies, the cart and language selection would not work. We only switch on statistics and marketing cookies with your consent, which you can give or withdraw in the cookie notice at the bottom of the page.
| Cookie | What it is for | Duration |
|---|
| Necessary (work without consent) |
| wp_woocommerce_session_* | remembers what is in your cart | 2 days |
| woocommerce_items_in_cart, woocommerce_cart_hash | cart status | session |
| pll_language | selected language | 1 year |
| cmplz_* | your cookie choices | 1 year |
| Statistics (only with consent) |
| _ga, _ga_* | Google Analytics: anonymous visitor statistics | up to 2 years |
| Marketing (only with consent) |
| _gcl_au | Google Ads: measuring advertising effectiveness | 90 days |
Your wishlist, recent searches and product list view are stored only in your browser (localStorage). This information is not sent to us, and you can delete it by clearing your browser data.
You can also delete or block cookies in your browser settings. Please note that without the necessary cookies the cart and checkout will not work.
How we protect data
The site only works over an encrypted connection (HTTPS). Only staff who need it for their work have access to orders and requests. Uploaded files are stored in a protected folder that cannot be browsed from outside. Our forms are protected against spam, which briefly uses your IP address.
Changes to this policy
If we change how we process data, we will update this page. The date of the latest update is shown at the top of the page. We will also let you know by e-mail about significant changes that affect orders already placed.
