Privacy Policy

1. Data Controller Information

This Privacy Policy explains how personal data is processed when you visit the Soul Fabrics online store (the “Store”), place an order or contact us. It is issued in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and the Personal Data Processing Law of the Republic of Latvia.

The controller of your personal data is Natalja Timinska, a self-employed person registered with the State Revenue Service of Latvia, trading under the name Soul Fabrics (“we”, “us”). Registration number: 27078011229. Address: Jūrmala, Slokas 29-, LV-2015, Latvia. Email: soulfabrics.lv@gmail.com.

We have not appointed a data protection officer, as we are not required to do so under Article 37 GDPR. All data protection enquiries may be sent to the email address above.

2. Personal Data Collected

We collect only the personal data necessary for the purposes described in this Policy. Depending on how you use the Store, this may include:

Identification and contact data: first and last name, email address and telephone number.

Order data: purchased products, sizes, quantities, prices, delivery method, order number, order date and any comments you add to the order.

Delivery data: delivery address or the selected parcel locker.

Custom order data: the information you provide in the custom order form, including the requested product, and your confirmation of the applicable return conditions.

Correspondence: the content of your messages to us, including withdrawal notices, return requests and complaints.

Technical data: your language preference, the contents of your shopping cart and your cookie choice, which are stored in your browser. We do not currently use analytics, advertising or tracking cookies.

We do not knowingly collect personal data from children under 16. Children’s clothing is sold to adults only.

3. Order Processing Data

When you place an order, we process your identification, contact, order and delivery data in order to conclude and perform the contract, including confirming the order, preparing and dispatching the goods, issuing an invoice and handling any withdrawal, return or complaint.

After payment, we send an order confirmation and invoice to the email address you provided. This message is necessary for the performance of the contract and for compliance with our legal obligation to confirm the contract on a durable medium.

Providing this data is a requirement for concluding the contract. Without it, we are unable to accept and deliver your order.

4. Payment Processing

Card payments, Apple Pay and Google Pay are processed by Stripe Payments Europe, Limited (Ireland) and its affiliates (“Stripe”).

Your payment card details are entered directly on the secure payment page provided by Stripe and are never transmitted to or stored on our servers. We receive only limited information about the transaction, such as its status, amount, date, payment method type and the last four digits of the card.

Stripe is certified to the Payment Card Industry Data Security Standard (PCI DSS). For certain purposes, such as fraud prevention and compliance with financial regulations, Stripe acts as an independent controller. That processing is governed by the Stripe Privacy Policy: https://stripe.com/privacy.

5. Shipping Information

To deliver your order, we share your name, telephone number, email address and delivery address or selected parcel locker with the delivery service you choose: Omniva for parcel lockers in Latvia, or a courier service for deliveries in Latvia and other EU countries.

Delivery services use this data only to deliver the parcel and to notify you of its status. Where they act as independent controllers, their own privacy policies apply.

6. Legal Basis for Processing

We process personal data only where we have a legal basis under Article 6(1) GDPR:

Performance of a contract (Article 6(1)(b)): processing orders, payments, deliveries, order confirmations, withdrawals, returns and complaints, and responding to custom order requests at your request.

Compliance with a legal obligation (Article 6(1)(c)): keeping accounting and tax records, issuing invoices and fulfilling obligations under consumer protection law.

Legitimate interests (Article 6(1)(f)): ensuring the security of the Store, preventing fraud and misuse, and establishing, exercising or defending legal claims. We rely on this basis only where our interests are not overridden by your rights and freedoms.

Consent (Article 6(1)(a)): sending marketing communications where you have subscribed to them. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

Storing your cart, language preference and cookie choice in your browser is strictly necessary to provide the Store and does not require consent.

7. Data Retention Periods

We keep personal data only for as long as necessary for the purpose for which it was collected, or as required by law:

Order data and invoices: for at least five years, as required for source documents by the Accounting Law of the Republic of Latvia.

Correspondence concerning withdrawals, returns and complaints: until the matter is resolved and until the end of the two-year legal guarantee period.

Custom order requests that do not result in an order: 12 months from the date of the request.

Marketing data: until you unsubscribe or withdraw your consent.

Data stored in your browser: until you delete it using your browser settings.

When the retention period expires, the data is deleted or anonymised.

8. Data Sharing with Service Providers

We do not sell or rent your personal data. We share it only with service providers that help us operate the Store, and only to the extent necessary:

Stripe — payment processing.

Resend — sending order confirmations and other transactional emails.

Hostinger — website hosting and data storage.

Omniva and courier services — delivery of orders.

Accounting and legal advisers — where necessary to comply with our legal obligations.

Where these providers act as our processors, they process data only on our instructions under data processing agreements that meet the requirements of Article 28 GDPR. We may also disclose data to public authorities where required by law.

9. International Data Transfers

We primarily process personal data within the European Economic Area (EEA). Some of our service providers, including Stripe and Resend, or their affiliates may process data in the United States or other countries outside the EEA.

In such cases, data is transferred only where an adequate level of protection is ensured: on the basis of an adequacy decision of the European Commission, including the EU–U.S. Data Privacy Framework for certified recipients, or on the basis of Standard Contractual Clauses approved by the European Commission, together with supplementary measures where necessary.

You may request further information about the safeguards applied by contacting us.

10. Customer Rights Under GDPR

Under the GDPR, you have the following rights:

Right of access — to obtain confirmation of whether we process your data and a copy of it.

Right to rectification — to have inaccurate or incomplete data corrected.

Right to erasure — to have your data deleted where there is no longer a legal basis for processing it, subject to our statutory retention obligations.

Right to restriction of processing — to limit the processing of your data in the cases provided for by law.

Right to data portability — to receive the data you provided to us in a structured, commonly used and machine-readable format.

Right to object — to object at any time to processing based on our legitimate interests and to processing for direct marketing purposes.

Right to withdraw consent — at any time, where processing is based on consent.

To exercise your rights, contact us at soulfabrics.lv@gmail.com. We will respond within one month of receiving your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by a further two months, in which case we will inform you. We may ask you to verify your identity before responding.

11. Data Security Measures

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including:

encrypted data transmission over HTTPS;

payment processing exclusively through Stripe, so that card details never reach our systems;

access to personal data limited to persons who need it to perform their tasks, protected by strong passwords and two-factor authentication where available;

the use of reputable service providers that apply their own security measures.

No method of transmission over the internet is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority and, where required, inform you without undue delay.

12. Marketing Communications

We send marketing communications, such as news about collections and special offers, only to customers who have given their explicit consent.

Order confirmations and other messages necessary to perform your contract are not marketing communications and are sent regardless of your marketing preferences.

You may unsubscribe at any time by using the link included in every marketing email or by contacting us. Withdrawing consent does not affect your orders.

We do not currently use personalised advertising or profiling, and we do not make decisions based solely on automated processing that produce legal effects concerning you.

13. Complaints and Supervisory Authorities

If you believe that we process your personal data unlawfully, please contact us first so that we can resolve the matter.

You also have the right to lodge a complaint with a supervisory authority. In Latvia, this is the Data State Inspectorate (Datu valsts inspekcija), www.dvi.gov.lv. If you live in another EU member state, you may also lodge a complaint with the supervisory authority of your country of residence, place of work or place of the alleged infringement.

14. Contact Information

Soul Fabrics — Natalja Timinska

Address: Jūrmala, Slokas 29-, LV-2015, Latvia

Email: soulfabrics.lv@gmail.com

Phone: +37126353649

We may update this Privacy Policy to reflect changes in our practices or in the law. The current version is always published on this page together with the date of the last update.