Privacy Policy

SIA RIKI.LV Registration No.: 40203469011 VAT payer No.: LV40203469011 Legal address: Miera iela 16 k5 — 26, LV-2169, Salaspils, Latvia E-mail: [email protected] Phone: +371 67 819 778 Website: www.riki.lv

Policy updated: 12.07.2026

1. Controller

The controller of your personal data is SIA RIKI.LV, registration No. 40203469011, legal address: Miera iela 16 k5 — 26, LV-2169, Salaspils, Latvia (hereinafter — the Controller).

On matters concerning the processing of personal data you may contact the Controller by writing to [email protected] or calling +371 67 819 778.

2. General principles

This Privacy Policy applies to the processing of the personal data of natural persons carried out by the Controller in operating the website www.riki.lv (hereinafter — the Website).

The Controller processes your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, hereinafter — the GDPR), the Personal Data Processing Law of the Republic of Latvia and other applicable legislation.

The Controller processes only those personal data that are necessary to achieve the specific purpose of processing, and keeps them only for as long as necessary.

3. What data we process and why

3.1. Registration and account maintenance

Data categories: first name, surname, e-mail address, phone number, password (in encrypted form).

Purpose of processing: creation and maintenance of the user account, authentication.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Retention period: while the account is active. If the user has not logged into the account for 3 (three) years, the account and the data linked to it are deleted.

3.2. Order processing and fulfilment

Data categories: first name, surname, delivery address, e-mail address, phone number, order information, payment information.

Purpose of processing: order processing, delivery of goods, invoicing.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Retention period: 10 (ten) years in accordance with the accounting and tax legislation of the Republic of Latvia.

3.3. Customer support

Data categories: name, e-mail address, correspondence, information about the enquiry.

Purpose of processing: answering your questions, handling complaints and enquiries.

Legal basis: the Controller's legitimate interests in providing quality customer service (Article 6(1)(f) GDPR).

Retention period: up to 5 (five) years after the enquiry has been resolved.

3.4. Accounting and financial records

Data categories: invoices, payment information, transaction data.

Purpose of processing: bookkeeping, compliance with tax legislation.

Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

Retention period: 10 (ten) years in accordance with statutory requirements.

3.5. Marketing (only with consent)

Data categories: e-mail address.

Purpose of processing: sending commercial communications about the Controller's products, news and offers.

Legal basis: your consent (Article 6(1)(a) GDPR).

Retention period: until the consent is withdrawn. You may withdraw your consent at any time by e-mailing [email protected] or by clicking the link in a commercial e-mail.

3.6. Operation of the Website (cookies)

Data categories: IP address, browser type and version, time and duration of the visit, pages visited.

Purpose of processing: ensuring and improving the technical operation of the Website.

Legal basis: the Controller's legitimate interests (necessary cookies) or your consent (analytics and marketing cookies) — see the Cookie Policy.

Retention period: see the Cookie Policy.

3.7. AI consultant (chatbot)

Data categories: chat message text; contact details if you voluntarily provide them (name, phone, e-mail); IP address; browser data (user-agent); approximate location (country, city); interface language; technical session identifier.

Purpose: product range consultations, product selection, forwarding your enquiry to a manager for a callback.

Legal basis: the Controller's legitimate interest in quality customer service (Art. 6(1)(f) GDPR).

Retention: the conversation history is kept for 90 days from the session's last activity and is then deleted automatically.

Session identifier: a technical token aiChatSessionToken is stored in your browser's localStorage to resume the conversation on a repeat visit; you may delete it in your browser settings at any time.

Transfers outside the EEA: to generate replies, message text is processed by the AI service provider DeepSeek (Hangzhou DeepSeek AI Co., Ltd., China) under Chapter V GDPR safeguards (standard contractual clauses, Art. 46 GDPR).

⚠ Important: please do not enter personal data (personal ID code, address, payment details) or commercially sensitive information in the chat — it is not needed for a consultation.

4. Recipients of personal data

The Controller may disclose your personal data to the following recipients:

IT and hosting service providers (Makonix.com SIA, Latvia) — to maintaon the Website;
courier and delivery service providers (AS carrier) — to deliver goods;
accounting service providers — to keep financial records;
payment service providers — to process payments;
the AI service provider (DeepSeek — Hangzhou DeepSeek AI Co., Ltd., China) — to generate the AI consultant's replies (see clause 3.7);
public authorities — where required by law (for example, the State Revenue Service).

Personal data are disclosed only to the extent necessary to achieve the specific purpose.

5. Transfers of personal data outside the European Union

As a rule, the Controller does not transfer your personal data outside the European Union or the European Economic Area. The exception is the AI consultant (see clause 3.7): chat message text is processed by the AI service provider DeepSeek (Hangzhou DeepSeek AI Co., Ltd., China). In such cases the Controller ensures appropriate data protection safeguards in accordance with Article 46 GDPR (standard contractual clauses).

6. Your rights

Under the GDPR you have the following rights:

Right of access to your personal data — you may request information about which of your personal data the Controller processes.
Right to rectification — you may request the correction of inaccurate or incomplete personal data.
Right to erasure — you may request the deletion of your personal data where there is no longer a legal basis for the processing.
Right to restriction of processing — you may request that the processing of your personal data be restricted in certain cases.
Right to object — you may object to the processing of your personal data based on the Controller's legitimate interests.
Right to data portability — you may request to receive your personal data in a structured, commonly used and machine-readable format.
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, please contact the Controller by writing to [email protected].

If you believe that your personal data protection rights have been violated, you have the right to lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija):

Datu valsts inspekcija Elijas iela 17, Rīga, LV-1050, Latvia Phone: +371 67223131 E-mail: [email protected] Website: www.dvi.gov.lv

7. Security

The Controller uses appropriate technical and organisational measures to protect your personal data against unauthorised access, destruction, alteration or disclosure. These measures include SSL encryption, secure data storage and access restrictions.

8. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy at any time by publishing the current version on the Website. The Controller recommends reviewing the current version of the Privacy Policy regularly.

9. Cookies

Information about the use of cookies is available in the Cookie Policy: www.riki.lv/cookies.html