Privacy policy

This privacy policy explains how we process your personal data when you visit the website www.rigastinte.lv, fill in the contact form or booking request, contact us, or use our services.

1. Who is responsible for your personal data?

The controller of your personal data is SIA “RGS TNT”, registration number 40103615601, legal address: Jūrmalas gatve 107, Rīga, LV-1029, operating under the brand “Rīgas Tinte”.

For questions about the processing of your personal data and exercising your rights, you can contact us:

• Email: info@rigastinte.lv.
• Address for in-person contact: Krišjāņa Barona iela 45/47, Rīga, LV-1011.

2. What personal data do we collect?

The scope of the data we process depends on how you contact us and which services you wish to receive.

Contact forms and correspondence. We process your name, email address, the selected contact topic, the content of your message and any information you provide in further correspondence.

Booking requests. We process your first name, last name, email address, phone number, age, preferred tattoo artist, appointment date and time, as well as information about the planned tattoo, including its size, placement on the body, description and any images you attach, if you submit them.

Provision of services. If we agree on a service, we process information about the booking, the service provided, our communication and payments. If the consent of a parent or guardian is required to receive the service, we also process the necessary information about this consent and the person giving it.

Commercial communications. Where there is a legal basis for sending them, we process your email address and information about your consent to, or objection to, receiving such communications.

Please provide in the forms only the information needed to review your question or request. Do not send copies of identity documents, health information or other sensitive information unless we have separately explained why it is needed and the conditions of its processing.

3. Why and on what legal basis do we process data?

To review bookings and provide services. We use the data provided in your request to contact you, clarify your tattoo idea, assess the scope of work, agree on a time and provide the service. The legal basis is taking steps at your request prior to entering into a contract and the performance of a contract under Article 6(1)(b) of the General Data Protection Regulation.

To answer other questions. We use contact form and correspondence data to handle general questions, collaboration proposals, and requests from guest artists and the press. The legal basis is our legitimate interest in maintaining communication and responding to the requests we receive under Article 6(1)(f) of the Regulation. If the question relates to entering into or performing a contract, the corresponding contractual legal basis applies.

To comply with legal obligations. We process the necessary data to comply with accounting and other applicable legal requirements. The legal basis is Article 6(1)(c) of the Regulation.

To protect our rights. Where necessary, we process data to handle complaints, resolve disputes and defend our rights. The legal basis is our legitimate interest in protecting our rights under Article 6(1)(f) of the Regulation.

To send news and offers. The conditions and legal basis for this processing are described in Section 4.

Completing the mandatory fields in the forms is necessary for us to review the relevant request. If the required information is not provided, we may be unable to respond or arrange the service. Providing any other information is voluntary.

4. Communication, news and offers

After receiving a contact form or booking request, we may contact you using the contact details you provided to answer your question, clarify your request or agree on the service.

Submitting the contact form and confirming that you have read this privacy policy do not in themselves constitute consent to receive advertising or newsletters.

If your email address was obtained in the course of a commercial transaction, we may use it to occasionally send you information about our similar services and offers, in compliance with Section 9, Paragraph two of the Law on Information Society Services. In that case, we give you the opportunity to object to such use of your email address at the time it is collected, and to opt out free of charge in every subsequent message. The legal basis for processing personal data is our legitimate interest in informing existing customers about similar services, while respecting their rights and interests.

If this exception does not apply, we send commercial communications only after receiving your separate, voluntary consent. In that case, the legal basis for processing is Article 6(1)(a) of the Regulation.

You can opt out of receiving commercial communications at any time by using the unsubscribe option in the email you received or by writing to info@rigastinte.lv. After you opt out, we will stop using your data for direct marketing.

Opting out does not affect your ability to receive our services. Where necessary, we will still send you information related to your request, booking or the provision of the service.

5. Who may have access to personal data?

Personal data is available only to those persons who need it to perform their duties, including employees and tattoo artists involved in reviewing your request or providing the service.

We may engage service providers for data processing who provide website maintenance, form and booking functionality, data storage, email communication, the sending of commercial communications and accounting services. Where these service providers act as data processors, they process data on our behalf and in accordance with the data protection requirements set out in the contract.

In cases provided for by law, we may transfer data to competent authorities or professional advisers where necessary to comply with legal obligations or to protect our rights.

We use the following service providers:

• Hostinger: website hosting, data storage and email services, including the address info@rigastinte.lv. Data is stored on servers in Lithuania, with backups in France, both within the European Union.
• Stripe Payments Europe, Limited (Ireland): payment processing when you purchase gift cards. Payment card details are processed by Stripe, and we do not have access to them.
• Accounting service providers: to the extent necessary to comply with accounting obligations set out in applicable laws.

Contact form and booking request data, as well as the newsletter subscriber list, are stored in our website's database, and the tools used for this purpose do not transfer data to third parties.

Transfers outside the European Economic Area. Stripe may also process data in the United States. In that case, the transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, as well as on standard contractual clauses approved by the European Commission. More information is available in Stripe's privacy policy.

6. How long do we keep personal data?

We keep personal data only for as long as necessary for the relevant purpose.

• We keep contact form messages and correspondence until the question is resolved and any related follow-up actions are completed.
• We keep booking requests and their attachments while the request is being reviewed and the service is being arranged. If the service is not provided and no further communication is planned, we delete the data unless there is another justified reason to keep it.
• We keep documents related to the services provided and payments for the periods set out in applicable laws.
• If data is needed to resolve a specific dispute or claim, we keep it until the matter is finally resolved or the applicable limitation period for the claim expires, to the extent necessary to protect our rights.
• We use data for sending commercial communications for as long as the relevant legal basis exists and this purpose remains relevant. If you withdraw your consent or object to direct marketing, we stop this use.
• We may keep minimal information about your opt-out to make sure you do not receive unwanted commercial communications in the future. We keep evidence of consent or opt-out for as long as necessary to demonstrate compliance with our obligations and to handle possible claims.

We regularly review the need to keep data. When data is no longer needed and there is no other legal basis for keeping it, we delete or anonymize it.

7. How do we protect personal data?

We implement technical and organizational measures appropriate to the nature and risks of the processing to protect personal data against unauthorized access, disclosure, alteration, loss or destruction. We restrict access to data according to job duties and require confidentiality to be maintained.

8. Cookies and website technical data

Cookies are small text files that a website stores on your device.

Necessary cookies. These enable the basic functioning of the website and do not require your consent:

• woocommerce_cart_hash, woocommerce_items_in_cart: for the shopping cart to work; deleted when you close your browser.
• wp_woocommerce_session_*: to keep the contents of your shopping cart; up to 2 days.
• __stripe_mid, __stripe_sid: for secure payment processing and fraud prevention during payment; up to 1 year and 30 minutes respectively.
• Cookie consent cookie: to remember your choice; up to 12 months.

Analytics cookies. These are used only if you have given your consent:

• _ga, _ga_*: Google Analytics 4, to understand how visitors use the website; up to 2 years. The service is provided by Google Ireland Limited, and data may be transferred to the United States under the EU-U.S. Data Privacy Framework. The legal basis for processing is your consent under Article 6(1)(a) of the Regulation.

You can change or withdraw your choice at any time using the “Cookie settings” link in the website footer. You can also delete cookies in your browser settings.

Technical data. When you visit the website, our hosting provider automatically processes technical data, such as your IP address, browser type, time of visit and the pages requested. We use this data to keep the website secure and working, based on our legitimate interest under Article 6(1)(f) of the Regulation. It is stored for a short period in accordance with the hosting provider's terms.

9. What are your rights?

Under applicable data protection rules, you have the right to:

• Receive information about the processing of your personal data, access your data and receive a copy of it.
• Request the correction of inaccurate data or the completion of incomplete data.
• Request the erasure of your data where there is a legal basis for it. This right is not absolute, for example where the data must be kept to comply with a legal obligation.
• Request the restriction of processing in the cases provided for by law.
• Object to processing based on legitimate interests, on grounds relating to your particular situation.
• Object at any time, free of charge, to the use of your data for direct marketing.
• Withdraw your consent where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it.
• Receive the data you provided in a structured, commonly used and machine-readable format and ask for it to be transferred to another controller, where processing is automated and based on consent or a contract.

To exercise your rights, write to info@rigastinte.lv. If necessary, we may ask for reasonable additional information to verify your identity.

We will respond to your request without undue delay, usually within one month. If the deadline has to be extended due to the complexity or number of requests, we will inform you of the extension and the reasons for it. In cases provided for by law, the deadline may be extended by a further two months.

If you believe that your data is being processed improperly, you have the right to lodge a complaint with the Data State Inspectorate. Information on how to lodge a complaint is available at www.dvi.gov.lv.

10. Changes to this privacy policy

We may update this privacy policy if our data processing or the applicable requirements change. We publish the current version and the date of the update on this page. Where necessary, we will inform you separately about significant changes.

Changes to the privacy policy do not in themselves constitute consent to new purposes of data processing.