EVAR · Personal Data Protection Notice
|
Key information Last updated: 1. September 2026 Controller: Possumus SIA (“EVAR”), registration No. 40103613193. Privacy contact: direktore@beautyschool.lv Registered address: Elizabetes iela 65-2, LV- 1050 |
|---|
At EVAR, we value your trust and take the protection of your personal data seriously. We are committed to handling your information responsibly, transparently and securely throughout your experience with us. This Privacy Policy explains how we collect, use, store, share and protect your personal information when you visit our website, create an account, place an order, contact us or otherwise use our services. We process personal data in accordance with the General Data Protection Regulation (GDPR), applicable Latvian data protection law (Fizisko personu datu apstrādes likums) and other applicable European Union and Latvian legal requirements relating to the relevant processing activity.
1. Who we are and when this Policy applies
EVAR (“we”, “us”, “our”) operates the online cosmetics store which is the marketplace for the beauty of being alive and is the controller of personal data processed for the purposes described in this Privacy Policy, unless another entity is identified as an independent controller for a specific processing activity. This Policy applies when you visit or use our website and online store, create or use an account, place an order, receive delivery, contact customer support, subscribe to marketing, interact with product recommendation or AI-assisted features, or otherwise interact with EVAR.
We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), the Latvian Fizisko personu datu apstrādes likums, and other applicable Latvian and EU/EEA rules, including rules governing cookies and electronic commercial communications. Where applicable, EVAR also complies with any mandatory national or European data protection requirements that supplement the GDPR and apply to the relevant processing activity.
2. Our data-protection principles
We apply the GDPR principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. This means that your personal data is processed only where there is a valid legal basis and in a transparent manner, collected for specified and legitimate purposes, limited to what is necessary for those purposes, kept accurate and up to date, and retained no longer than necessary. We also implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. We seek to collect only data that is reasonably necessary and proportionate for the stated purpose and to design our services so that privacy-protective settings are used by default where appropriate. You are responsible for ensuring that the personal data you provide to us is accurate and, where relevant, kept up to date. Please notify us or update your account if your information changes. In accordance with the GDPR’s Article 25 - principle of data protection by design and by default, we seek to integrate appropriate privacy and data-protection safeguards into our services and processing activities from the outset.
3. Personal data we process and where it comes from
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Name, surname, email address, telephone number, billing and delivery address, and similar contact details. | Directly from you; in limited cases from another customer, e.g. where you are named as a gift recipient. |
| Account and authentication data | Account identifier, login/authentication data, saved preferences and account settings. | Directly from you and from Shopify when providing the account functionality. |
| Order and transaction data | Products viewed, wish-listed, added to cart, ordered, returned, exchanged or cancelled; order number; purchase history; delivery and refund status. | From you, Shopify, payment providers and delivery/fulfilment providers. |
| Payment-related data | Payment method, payment status, transaction identifiers and limited payment metadata. EVAR does not intend to store full payment-card credentials; these are handled by the relevant payment service provider and/or Shopify payment services. | From you, Shopify and the payment service provider. |
| Communications and service data | Customer-support messages, complaints, returns or product-safety communications, and other correspondence. | Directly from you and, where relevant, from service providers assisting with the request. |
| Device, usage and security data | IP address, device/browser information, identifiers, timestamps, page interactions, security logs and similar technical data. | Automatically from your device, Shopify and permitted cookies or similar technologies. |
| Marketing and preference data | Newsletter subscription status, consent/objection records, campaign engagement and product or communication preferences. | Directly from you and from permitted marketing/cookie technologies. |
| Recommendation and AI-interaction data | Text or selections you submit to recommendation/AI features, the resulting recommendations, and related interaction data. | Directly from you and from the provider supporting the feature. |
| Derived or inferred data | Preferences or likely interests inferred from interactions with the store, where this functionality is enabled and legally permitted. | Derived from order, usage, preference and interaction data. |
Special-category data (Art. 9 GDPR)
EVAR does not seek to collect special categories of personal data (for example, health or medical information) as part of ordinary browsing, shopping or marketing. Please do not enter medical conditions, diagnoses, allergies, medication information or other sensitive information into free-text recommendation or AI fields unless EVAR has expressly asked for that information and provided a specific privacy notice and lawful basis. However, if special-category data is provided to us where it is not required for the relevant service, EVAR may delete, restrict or otherwise cease processing that information where appropriate and permitted by law. If special-category data is nevertheless provided in a customer-service, product-safety or legal-claims context, we will process it only where a valid condition under Article 9 GDPR applies and only to the extent necessary.
4. Why we use personal data and our legal bases
| Purpose | Data typically involved | Legal basis |
|---|---|---|
| Provide the website, cart, account and requested store functionality | Account, identity/contact, device and usage data | GDPR Art. 6(1)(b) where necessary to provide a service requested by you or take pre-contractual steps; Art. 6(1)(f) for strictly necessary operational and security functions where appropriate. |
| Process and fulfil orders, payments, delivery, returns, exchanges and refunds | Identity/contact, order, transaction and payment-related data | GDPR Art. 6(1)(b) - performance of the purchase contract and steps taken at your request before entering into it. |
| Meet accounting, tax, consumer, product-safety and other legal obligations | Order, transaction, invoice, complaint and relevant contact data | GDPR Art. 6(1)(c) - compliance with legal obligations. |
| Customer support and relationship management | Identity/contact, order and communications data | GDPR Art. 6(1)(b) where support relates to an order/contract; otherwise Art. 6(1)(f) - our legitimate interest in responding to enquiries and maintaining customer relationships. |
| Prevent fraud, misuse and security incidents; protect rights and systems | Account, transaction, device, usage and security data | GDPR Art. 6(1)(f) - legitimate interests in security, fraud prevention, abuse prevention and protection/defence of legal rights; Art. 6(1)(c) where law requires processing. |
| Newsletter and promotional communications | Contact, marketing preference and engagement data | GDPR Art. 6(1)(a) where consent is required. Consent can be withdrawn at any time. For existing customers, EVAR may use the Latvian existing-customer exception for similar products where all statutory conditions are met, together with Art. 6(1)(f), and always provides a simple opt-out. |
| Analytics, advertising and non-essential tracking | Device, usage, marketing and inferred data | Consent under GDPR Art. 6(1)(a) where required, together with the applicable cookie/ePrivacy rules. Non-essential cookies or similar technologies are not activated before valid consent where consent is required. |
| Personalised product recommendations and AI-assisted responses requested by you | Recommendation/AI interaction data, preferences and relevant usage/order data | GDPR Art. 6(1)(b) where the feature is provided at your request as part of the service; otherwise Art. 6(1)(f) for proportionate personalisation that does not require consent. Any non-essential tracking feeding the feature remains subject to cookie-consent rules. |
| Establish, exercise or defend legal claims; handle disputes | Relevant identity/contact, transaction, communications, security and evidentiary data | GDPR Art. 6(1)(f) - legitimate interest in protecting legal rights; where special-category data is involved, an applicable Art. 9 condition is also required. |
| Respond to privacy-rights requests and regulator/law-enforcement requests | Identity, request, verification and relevant underlying data | GDPR Art. 6(1)(c) - compliance with legal obligations; Art. 6(1)(f) for record-keeping and defence of compliance where appropriate. |
Legitimate interests. Where we rely on Article 6(1)(f), our interests may include operating and improving the store, customer service, network and account security, fraud prevention, internal administration, proportionate personalisation, direct marketing to existing customers where permitted by law, and the establishment or defence of legal claims. We balance these interests against your rights and reasonable expectations and do not use Article 6(1)(f) where your interests or fundamental rights override ours.
5. When providing data is required
Certain data is necessary to enter into or perform a purchase contract, for example your name, contact details, delivery information and the information necessary to complete payment. If you do not provide required data, we may be unable to process or deliver an order, create an account feature you requested, or respond to a request. Marketing consent and non-essential cookie choices are optional and are not a condition of purchasing goods.
6. Cookies and similar technologies
EVAR uses cookies and similar technologies to operate the store, remember your shopping cart and preferences, maintain security, and, where you have given your consent, analyze website traffic, improve our services and support marketing activities.
Strictly necessary cookies are used where required for the operation, security and essential functionality of the Store and checkout. These cookies do not require your consent where their use is necessary to provide a service you have requested.
Analytics, advertising, marketing and other non-essential cookies or similar technologies are used only where required consent has been obtained. You can accept or decline non-essential cookies through our cookie banner and can change or withdraw your consent at any time through the Store’s cookie or privacy settings. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Detailed information about the specific cookies and similar technologies currently used by the Website, including their purpose, provider and retention period, is available through the Website’s cookie banner and cookie/privacy settings. Those controls also allow users to accept or reject non-essential cookies and, where applicable, change or withdraw their consent at any time.
7. Electronic marketing
We send marketing emails and other electronic commercial communications for example the Dispatch newsletter only where permitted by applicable law. As a general rule, we will send such communications only where you have given your prior consent.
Where permitted by Latvian law, we may also send marketing communications to existing customers about similar EVAR products or services using an email address obtained in connection with a previous purchase, provided that the applicable legal requirements are met and you have not objected to receiving such communications.
You may unsubscribe from marketing communications at any time using the unsubscribe option included in each marketing message. We may retain a limited record of your opt-out request to ensure that we continue to respect your preference and to demonstrate compliance with applicable legal requirements.
8. Personalisation, AI tools and automated decision-making
EVAR may provide product-selection, search, recommendation or AI-assisted features. These features may use information you actively submit, along with permitted store-interaction data, to generate recommendations or responses. They are intended to assist your shopping experience, not to make decisions producing legal effects or similarly significant effects about you.
EVAR does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects within Article 22 GDPR. If this changes, we will provide the additional information and safeguards required by law before such processing is used.
9. Who receives personal data
We disclose personal data only where reasonably and objectively necessary for the purposes described above, subject to appropriate contractual, organisational and legal safeguards. Recipient categories may include:
Shopify and Shopify group entities that host and operate the commerce platform and related services;
payment service providers, acquiring banks and financial institutions;
delivery, courier, fulfilment and returns providers, including suppliers, distributors, brand partners and dropshipping partners that may dispatch products directly to you;
IT, cloud, security, customer-support and technical service providers;
analytics, advertising and marketing providers, but only where the relevant processing is lawful and, where required, consent has been obtained;
professional advisers such as accountants, auditors, insurers and legal counsel;
public authorities, regulators, courts or law-enforcement bodies where disclosure is legally required or justified; and
parties involved in a contemplated or completed corporate transaction, subject to appropriate confidentiality and legal safeguards.
If you provide personal data relating to another person, for example a delivery recipient, you should ensure that you are authorised to provide that information and, where appropriate, inform that person about this Privacy Policy. Please provide only the personal data necessary for the relevant purpose.
Some recipients act as processors on our documented instructions; in those cases we use data-processing terms meeting Article 28 GDPR. Other recipients, such as certain payment providers, delivery companies, banks, public authorities or Shopify for specific independent purposes, may act as separate controllers and process data under their own privacy notices. A data-processing agreement is not used merely because data is disclosed; the recipient’s legal role depends on who determines the relevant purposes and means of processing.
10. Shopify e-commerce platform
EVAR is powered by Shopify. For personal data processed by Shopify on EVAR’s behalf in connection with the ordinary operation of the Store, EVAR acts as the data controller and Shopify acts as a data processor in accordance with Shopify’s applicable Data Processing Addendum.
Shopify may process personal data necessary to provide the e-commerce platform and related services, including information relating to your use of the store, customer account functionality, orders, checkout and other Store interactions.
Certain Shopify services or enhanced features may involve Shopify processing personal data for purposes independently determined by Shopify. Where this occurs, Shopify may act as an independent data controller for that specific processing activity and is independently responsible for complying with applicable data protection requirements. Further information can be accessed below
More information: Shopify Consumer Privacy Policy
Shopify privacy requests: Shopify Privacy Portal
11. International transfers
Because EVAR operates across the European Union, personal data may be processed by delivery, fulfilment, supplier or other service partners located in other EU/EEA Member States. Such processing remains subject to the GDPR. Some service providers or business partners may also process personal data outside the European Economic Area (“EEA”). Where personal data is transferred to a country for which the European Commission has issued an adequacy decision, we may rely on that decision. Otherwise, we use an applicable transfer mechanism under Chapter V GDPR, such as the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required when personal data is transferred outside the EEA.
Shopify states that it uses approved Binding Corporate Rules for certain transfers involving EEA personal data and Standard Contractual Clauses or other recognised transfer mechanisms where applicable. You may contact us for further information about the safeguards relevant to a particular transfer and, where legally available, how to obtain a copy of them.
12. How long we keep personal data
We keep personal data only for as long as necessary for the purpose for which it was collected, subject to legal retention duties and the need to establish, exercise or defend legal claims. We apply the following retention rules/criteria:
| Data / record type | Retention rule or criterion |
|---|---|
| Orders, invoices and accounting evidence | At least the statutory minimum applicable to the relevant accounting document. Under the Latvian Accounting Law, other accounting source documents must generally be retained for no less than five years; longer periods may apply to particular records or where required by other law. |
| Account data | For as long as the account remains active or until deletion/closure is requested, except that transaction, compliance, fraud-prevention or legal-claim records linked to the account may be retained for their separate applicable period. |
| Customer-support, complaint, return and warranty records | For the time needed to resolve the matter and thereafter for the period reasonably necessary to comply with legal obligations and manage or defend potential claims. |
| Marketing subscription/consent records | Until consent is withdrawn or you object, plus a limited record of the consent/withdrawal or suppression status where needed to demonstrate compliance and ensure that marketing is not resumed unlawfully. |
| Cookie and similar identifiers | For the periods stated in the Cookie Policy or consent-management interface, based on the specific cookie or technology. |
| Security and fraud-prevention logs | For a limited period proportionate to security and fraud-prevention purposes, and longer only where an incident, investigation, legal obligation or claim requires it. |
After the retention period expires, your data is securely deleted, anonymized or placed beyond normal use until secure deletion is possible in accordance with our retention processes.
13. Security and personal-data breaches
We implement appropriate technical and organisational measures proportionate to the risk, including access controls, confidentiality obligations, secure transmission, supplier controls, security monitoring and incident-response procedures. EVAR maintains internal responsibilities and procedures for data protection and, where appropriate, provides relevant personnel with data-protection and privacy guidance or training.
No method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure, accordingly no system can be guaranteed to be fully secure, but we regularly review the measures appropriate to the nature of the data and processing.
If a personal-data breach is likely to result in a risk to individuals’ rights and freedoms, the controller must notify the competent supervisory authority (Datu Valsts Inspekcija) without undue delay and, where possible, within 72 hours after becoming aware of it, unless an exception applies. Where a breach is likely to result in a high risk to you, we will also communicate the breach to you without undue delay as required by Article 34 GDPR.
14. Your rights
Subject to the conditions and exceptions in applicable law, you may have the right to:
access your personal data and obtain information about how it is processed;
correct inaccurate or incomplete personal data;
request erasure of personal data ("right to be forgotten");
request restriction of processing;
receive personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted to another controller (data portability);
object at any time to processing based on legitimate interests, including profiling based on those interests; where personal data is processed for direct marketing, you have an absolute right to object to that direct marketing;
withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
not be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, except where an Article 22 exception applies with the required safeguards; and
lodge a complaint with a competent national data protection supervisory authority.
How to exercise your rights
Send your request to the EVAR privacy contact identified in Section 19 below. We may ask for information reasonably necessary to verify your identity, particularly where disclosure or deletion could affect account security or another person’s rights. We will respond without undue delay and in principle within one month of receiving a valid request. Where permitted by GDPR, that period may be extended by up to two additional months for complex or numerous requests; if so, we will inform you of the extension and reasons within the first month. Requests are generally free of charge, subject to the exceptions in Article 12 GDPR.
15. Complaints and supervisory authority
If you have concerns about our processing or any other questions about data protection and privacy, please contact us first so that we can address them. You also have the right to lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, place of work or the place of the alleged infringement as provided by Article 77 of GDPR.
In Latvia, the supervisory authority is the Datu valsts inspekcija (Data State Inspectorate), Elijas iela 17, Rīga, LV-1050, Latvia. www.dvi.gov.lv
16. Children
EVAR may sell products intended for children, but the online purchasing, account and marketing services are intended to be used by persons who are legally able to enter into the relevant transaction or by an adult acting for a child. We do not knowingly seek children’s personal data for marketing. Where processing is based on consent in connection with an information-society service offered directly to a child, the applicable national digital-consent age must be respected. In Latvia ( under the Fizisko personu datu apstrādes likums), a child may provide such consent from age 13; below that age, consent must be given or authorised by a parent or legal guardian. If you believe that a child under the age of 13 may have provided us with personal information, please contact us as specified in the Contact section of this Privacy Policy.
17. Third-party websites and services
Our Services may link to third-party websites, social-media services or external platforms. Those third parties determine their own processing activities and privacy practices. EVAR is not responsible for the privacy practices, content or data-processing activities independently determined by such third parties and you should review their privacy notices before providing personal data to them. This does not affect EVAR’s responsibility for processing carried out by EVAR or on EVAR’s behalf.
18. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in our processing activities, service providers, technology or legal obligations and without prior notice to you. However, we will publish the revised version on the website and update the “Last updated” date. Where a change materially affects the way we process personal data or applicable law requires direct notice or renewed consent, we will take the additional steps required before the change takes effect.
This Privacy Policy describes EVAR’s processing activities and data-protection practices as applicable at the time of publication. Nothing in this Privacy Policy limits any rights available to you under applicable data-protection law.
19. Contact
If you would like to exercise your privacy rights, please contact us by using this section of our Privacy Policy
|
Privacy contact Possumus SIA (“EVAR”) Email: direktore@beautyschool.lv Address: Elizabetes iela 65-2, Rīga, LV-1050, Latvia |
|---|
This policy is intended as a living document and will be regularly reviewed and updated to ensure continuous compliance with GDPR, applicable data protection laws and best practices in the e-commerce sector.