Privacy Policy

Effective from 9 November 2026.

We respect your privacy. This privacy policy explains what personal data we process on the website janisbusevicsdesign.eu, why we do so, with whom we share the data, how long we keep it and what your rights are. The policy has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Personal Data Processing Law and the Law on Information Society Services.

1. Controller

• Controller and processor: JANIS BUSEVICS DESIGN, janisbusevicsdesign.eu (hereinafter the Website), Matīsa iela 16, Rīga, LV-1001, Latvia.
• Address: Matīsa iela 16, Rīga, LV-1001, Latvia
• E-mail for privacy enquiries: [email protected]
• E-mail for order enquiries: [email protected]
• Phone: +371 29112765

2. What data we process and why

2.1. Orders and delivery

Data: first name, last name, e-mail, phone, billing and delivery address or the selected parcel locker, order contents and amount, delivery method, tracking number, payment status, your notes on the order and correspondence about the order.
Purpose: accepting the order, payment, delivery, notifications about the order status, handling cancellations and complaints.
Legal basis: conclusion and performance of a contract (Article 6(1)(b) GDPR) and compliance with a legal obligation, for example accounting requirements (point (c)).

2.2. Gift cards

Data: the buyer's data, the recipient's name and e-mail, the word "From", the message, the selected sending date, gift card code, expiry date, balance and usage history.
Purpose: creating, sending and using the gift card.
Legal basis: performance of a contract with the buyer; for the recipient's data, our legitimate interest in fulfilling the buyer's order (Article 6(1)(f) GDPR). If you provide another person's data, please inform that person.

2.3. Workshops

Data: each participant's first name, last name, e-mail and phone, ticket code, arrival check-in, the giver's name and message (if the place was given as a gift).
Purpose: reserving a place, sending tickets and reminders, registering participants at the workshop, informing about changes.
Legal basis: performance of a contract; for participants who are not buyers, our legitimate interest in running the event.

2.4. Customer account

Data: first name, last name, e-mail, phone, password (stored only in encrypted form), saved addresses and parcel lockers, language choice, wishlist, gift cards and workshop bookings, two-step login settings, trusted devices, as well as information about logins from a new device (time, IP address, browser and device type). If you provide it, also your birthday (day and month, without the year).
Purpose: creating and maintaining the account, faster checkout, order history, account security, sending e-mails in your chosen language, sending a birthday discount.
Legal basis: performance of a contract (use of the account); legitimate interests (security of the account and the website); for the birthday, your consent (Article 6(1)(a) GDPR), which you can withdraw by deleting your birthday in your profile.

If you create an account or log in with Google or Facebook, we receive your first name, last name and e-mail address from that service. We do not receive your Google or Facebook password. We use this login method only if you choose it yourself.

2.5. Communication and enquiries

Data: name, e-mail, phone and the content of the message you provide in an enquiry form, by e-mail, by phone or on WhatsApp, for example information about the event, preferred date, number of participants and budget.
Purpose: answering questions, preparing a quotation.
Legal basis: steps taken before entering into a contract at your request (point (b)) and our legitimate interest in replying to your messages (point (f)).

2.6. Chat window and virtual assistant

The website has a chat window in which a virtual assistant (an artificial intelligence system) answers questions, and you can ask to speak with Jānis at any time. We process the chat text, name and e-mail (if you provide them in order to receive a reply by e-mail), a studio visit request and a random chat identifier stored in your browser's storage.
Purpose: answering questions about products, orders and the studio, handing the conversation over to Jānis.
Legal basis: legitimate interests in providing customer support and steps taken before entering into a contract.
Please do not share sensitive data in the chat, such as payment card details or health information.

2.7. News and offers by e-mail

Data: e-mail, name, selected news topics, consent status and history (when, where and with what wording consent was given or withdrawn).
Purpose: sending news and offers.
Legal basis: your consent (Article 6(1)(a) of the GDPR and Article 9 of the Information Society Services Law). We kindly ask you to confirm your consent via the link in the e-mail. You may withdraw your consent at any time using the unsubscribe link in every message or on the e-mail settings page, where you can also choose topics. We send transactional e-mails (order confirmation, delivery and status notifications, tickets) regardless of news consent, as they are necessary for the performance of the contract.

2.8. Product availability notification

Data: the e-mail and name you leave for a sold-out product.
Purpose: to notify you once when the product is available again. After the notification is sent, the entry is deleted.
Legal basis: your request and consent.

2.9. Customer service and customer summary

To serve our customers better, we compile a customer summary (also for buyers without an account): contact details, purchase history, internal notes and tags, language and e-mail marketing consent history.
Legal basis: our legitimate interest in providing quality customer service and in proving consent. No automated decisions that have legal consequences for you are made on the basis of this summary.

2.10. Website operation and security

Data: IP address, browser and device information, login attempts, number of registrations from one IP address, server logs.
Purpose: operation of the website, protection against attacks, fake accounts and fraud.
Legal basis: our legitimate interest in ensuring the security of the website and customer data.
To offer the website in a language suitable for you, our CDN provider Cloudflare determines the country from your IP address. We use the country code only to offer a language and do not store it separately.

3. Where we obtain data from

Most of the data is provided by you. Some data we receive from other persons: the buyer of a gift card or workshop participation (about the recipient or participant), Google or Facebook (if you choose to log in with them), the payment service provider (payment status) and carriers (delivery status).

4. Data recipients and processors

We do not sell data. We share data only with those service providers who are necessary to achieve the purposes stated:

• Hosting: Hetzner Online GmbH, the server is located in Finland (EU). Website data and the database are stored on this server.
• Website development and technical maintenance: EvoEX (Latvia).
• Cloudflare, Inc.: content delivery network (CDN), protection against attacks and country detection for language offering. All website traffic passes through Cloudflare.
• Resend: sending e-mails (transactional e-mails and news). Resend receives the recipient's e-mail, name and the content of the message.
• myPOS: payment processing. Card data is processed only by myPOS; we do not see it. As a payment service provider, myPOS also processes data as an independent controller in accordance with its own privacy policy.
• Swotzy and the carriers Omniva, DPD, SmartPosti (Itella) and Venipak: preparing and delivering shipments. We pass on to them your first name, last name, phone number, e-mail and delivery address or parcel locker, as well as the weight and dimensions of the shipment. Carriers also process data as independent controllers.
• Anthropic, PBC: operation of the virtual assistant in the chat window. Anthropic receives the text of the conversation in order to prepare a reply. According to Anthropic's commercial terms, API conversation data is not used to train models.
• Google and Meta (Facebook): only if you choose to log in with a Google or Facebook account. A Google Maps map is embedded on the Contacts page; when it loads, Google receives your IP address and may set its own cookies.
• Accounting service provider: processing of accounting documents, if accounting is handled by an external service provider.
• Public authorities (for example, the State Revenue Service, law enforcement authorities, courts): only if required by law.

We have concluded, or acceded to, data processing agreements with our processors that provide for data confidentiality and security.

5. Transfer of data outside the European Economic Area

Some service providers (Cloudflare, Resend, Anthropic, as well as Google and Meta if you choose to log in with them) are registered in the USA, and data may be processed outside the European Economic Area. In such cases, data is transferred using the safeguards provided for in Chapter V of the GDPR: the European Commission's decision on the adequacy of the EU-US Data Privacy Framework for companies certified under it, or standard contractual clauses approved by the European Commission. For more information about the measures applied, you may write to [email protected].

6. How long we keep data

• Order and payment data that serve as accounting supporting documents: no less than 5 years in accordance with Article 28 of the Accounting Law, and for as long as is necessary to handle potential claims.
• Customer account: for as long as the account is active or until you ask us to delete it. Unconfirmed accounts are deleted after 72 hours. If you delete your account, order data that must be kept for accounting purposes is retained until the end of the period mentioned above.
• Gift cards: during the validity period and afterwards as accounting data.
• Workshop participant data: 12 months after the workshop, purchase data as accounting data.
• Communication, requests and conversations in the chat window: up to 2 years after the last contact.
• Studio visit request from the chat window: 30 days.
• Newsletter consent: until the consent is withdrawn. We keep the history of consent and withdrawal for 3 years after the consent is withdrawn, so that we can prove that consent was given.
• Back-in-stock sign-up: until the notification is sent.
• Security logs: up to 90 days.

7. Cookies and browser storage

Cookies are small text files stored on your device. We use only those cookies and browser storage entries that are necessary for the website to work and to provide the features you request. In accordance with Article 7.1, paragraph two, of the Law on Information Society Services, consent is not required for such cookies. We do not use analytics or advertising cookies. No analytics or advertising tools are used on the website. If any are added, we will ask for your consent first.

Necessary cookies:

• wp_woocommerce_session_*, woocommerce_cart_hash, woocommerce_items_in_cart: shopping cart and session (up to 2 days or until the browser is closed);
• wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie: account login (until the end of the session or up to 14 days if you choose "Remember me");
• twe_lang_choice: the website language you have chosen (1 year);
• jbd_2fa_p: two-step login process session (until the browser is closed);
• jbd_2fa_t: trusted device, so that the two-step code is not requested every time (30 days);
• jbd_dev: device recognition, to alert you about a login from a new device (400 days);
• jb_oauth_state: security check when logging in with Google or Facebook (10 minutes);
• jbd_ep, jbd_ep_u: e-mail settings page session (up to 1 hour);
• Cloudflare security cookies, for example __cf_bm (30 minutes), which Cloudflare may set for protection against bots.

In the browser storage (localStorage) we save a random chat window identifier, so that you can continue the conversation.

Third-party cookies: Google may set its own cookies when the Google Maps map is loaded on the Contact page, and Google or Facebook if you choose to log in with them. You can delete or block cookies in your browser settings, but without the necessary cookies the cart and account login will not work.

8. Your rights

You have the right to:

• access your data and receive a copy of it;
• correct inaccurate data (you can correct most of it yourself in the "My account" section);
• request deletion of data if it is no longer needed or if you withdraw your consent, except for data that must be kept by law;
• request restriction of processing;
• receive the data you provided in a structured, machine-readable format (data portability);
• object to processing based on legitimate interests, and to object at any time to the use of data for direct marketing;
• withdraw your consent at any time; this does not affect the lawfulness of processing before the withdrawal.

To exercise your rights, please write to [email protected]. We will reply without undue delay, and no later than within one month. To protect your data, we may ask you to confirm your identity, for example by replying from your account e-mail address.

9. Complaints

If you believe that we are processing your data unlawfully, please contact us first. You have the right to lodge a complaint with the Data State Inspectorate: Elijas iela 17, Riga, LV-1050, e-mail [email protected], www.dvi.gov.lv, or with the data protection supervisory authority in your EU country of residence.

10. Data security

The website runs on an encrypted HTTPS connection. Two-step login is available for customer accounts and is mandatory for team accounts, passwords are stored in encrypted form, data is accessible only to authorised persons, and we make backup copies. Should a data security incident occur that may pose a high risk to your rights, we will inform you.

11. Children

The website is not intended for children under 13 years of age, and we do not knowingly collect their data. Orders may be placed by adults or by minors with the consent of a parent or guardian.

12. Changes

We may update this policy, for example when our services or legal requirements change. The current version is always available on this page.