Privacy Policy

1. Who we are

The controller of your personal data is SIA EKOSPA (reg. No. 40103478709), trading as Vilma Candles, Krišjāņa Barona iela 28, Rīga, LV-1011, Latvia.

For anything about your data, write to info@vilmacandles.com or call +371 20223190. We are a small business and have not appointed a data protection officer, as the law does not require one for us.

2. What we use and why

We only collect what we need. For each purpose, the table shows the data, the legal reason under Article 6 GDPR, and how long we keep it.

Why	What data	Legal basis	How long
Taking, packing and delivering your order	Name, delivery and billing address, email, phone, the candles you ordered, order number	Performing our contract with you (Art. 6(1)(b))	As long as needed for the order and any return or complaint, then as accounting records (below)
Payment	Payment status and amount. Card and bank details are entered on the secure page of Montonio or Stripe; we never see or store your full card number or internet bank login	Contract (Art. 6(1)(b))	As accounting records
Invoices and bookkeeping	Name, address, order and payment details	Legal obligation under Latvian accounting and tax law (Art. 6(1)(c))	5 years after the end of the financial year, or longer if the law requires
Your customer account, if you create one	Name, email, password (stored encrypted), order history, saved addresses	Contract (Art. 6(1)(b))	Until you delete the account or ask us to
Answering your questions by email, phone, WhatsApp or social media	Your name, contact details and what you write	Our legitimate interest in replying to you, or steps before a contract (Art. 6(1)(f) / (b))	Up to 2 years after the conversation ends
Newsletter	Email, name, language, whether you open our emails	Your consent (Art. 6(1)(a))	Until you unsubscribe (link in every email)
Reminding you about an unfinished order	Email address and the candles in your basket, saved when you type your email at checkout	Our legitimate interest in helping you finish your order (Art. 6(1)(f)); you can object at any time, and every reminder has an unsubscribe link	Up to 30 days
Website statistics	Pages visited, device and browser, approximate location, how the page is used	Our legitimate interest in understanding and improving the shop (Art. 6(1)(f)); you can object at any time	Up to 14 months
Advertising and measuring our ads	Cookie and device identifiers, pages visited, purchases	Our legitimate interest in measuring and improving our ads (Art. 6(1)(f)); you can object at any time	As long as the cookie lasts, at most 2 years
Keeping the website safe and working	IP address, browser, technical logs	Our legitimate interest in a secure website (Art. 6(1)(f))	Short-term technical logs, as kept by our hosting provider
Legal claims and requests from authorities	Only the data concerned	Legal obligation or legitimate interest (Art. 6(1)(c) / (f))	Until the matter is closed

You do not have to give us any data to browse the site. To order, we need your name, address and email, because without them we cannot deliver the candle or send the invoice. We do not make decisions about you by automated means, and we do not sell your data.

3. Who we share it with

We share data only with companies that help us run the shop, and only what each one needs. They process it on our instructions under a data processing agreement, unless noted as an independent controller.

Montonio — payments by internet bank, card and BLIK. Montonio is also an independent controller for fraud prevention and its own legal duties.
Stripe — card and other payments. Stripe is also an independent controller for fraud prevention and its own legal duties.
Cloudflare — website hosting, security and delivery of the pages.
Zone Media (zone.ee) — our email.
Brevo — newsletter sending, only if you subscribed.
Swotzy — preparing shipping labels.
Couriers (Omniva, DPD, Latvijas Pasts, GLS and their partners abroad) — your name, address, phone and email, to deliver the parcel. For deliveries outside the EU, the parcel details also go to customs.
Google — Google Analytics, Google Ads and the map on our Visit us page.
Microsoft Clarity — website statistics.
Meta (Facebook, Instagram, WhatsApp) — advertising measurement, and messages if you contact us there.
Anthropic — an AI service that helps us translate your messages and draft our replies. Every reply is checked by a person before it is sent, except automatic order-status answers.
Telegram — our internal team chat, where we see the messages you send us on Facebook, Instagram or WhatsApp.
Elfsight — shows our Google reviews on the home page.

We give data to authorities such as the State Revenue Service, or to our legal and accounting advisers, only when Latvian or EU law requires it or to defend a legal claim.

4. Data outside the EU

Some of the companies above are based in the United States or work with teams outside the European Economic Area. When data leaves the EEA, it is protected by the EU–US Data Privacy Framework where the company is certified, or by the European Commission's Standard Contractual Clauses (Art. 45 and 46 GDPR). When you order a delivery to a country outside the EU, we pass your delivery details to the couriers and customs there because it is necessary to deliver your order (Art. 49(1)(b)).

5. Cookies

Cookies are small files saved in your browser. We use three kinds:

Kind	Examples	What it does	Can you refuse?
Necessary	Cart, sign-in, security cookies; Stripe's `__stripe_mid`, `__stripe_sid`	Make the cart, checkout and account work and protect payments from fraud	No — the site cannot work without them
Statistics	Google Analytics `_ga`, `_ga_*`; Microsoft Clarity `_clck`, `_clsk`	Show us which pages are used, so we can improve the site	Yes — see below
Marketing	Meta `_fbp`; Google Ads `_gcl_au`	Measure our ads and show you relevant ones on other sites	Yes — see below

You can block or delete statistics and marketing cookies in your browser settings at any time, turn off Google Analytics with Google’s opt-out browser add-on, and limit ad tracking in your Facebook and Google account settings. You can also object to this use of your data by writing to info@vilmacandles.com.

6. Your rights

Under the GDPR you can ask us, free of charge:

to see the data we hold about you and get a copy (access);
to correct data that is wrong or incomplete;
to delete your data, unless we must keep it by law, for example invoices;
to restrict how we use it while a question is sorted out;
to receive the data you gave us in a common digital format, or have it sent to another company (portability);
to object to processing based on our legitimate interest — and you can always object to direct marketing, after which we stop;
to withdraw your consent at any time. This does not affect what was done before you withdrew it.

Write to info@vilmacandles.com. We may ask you to confirm who you are. We answer within one month; if a request is complex, we may extend this by up to two more months and will tell you why.

If you think we have not handled your data properly, please tell us first so we can put it right. You also have the right to complain to the Latvian Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv, or to the data protection authority in the EU country where you live or work.

7. Other things to know

Security

The website uses encrypted connections (HTTPS), payments are handled by Montonio and Stripe, and access to order data is limited to the people who need it to fulfil your order.

Children

Our shop is not meant for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Links to other websites

Our site links to other sites, such as Instagram, Facebook and map services. They have their own privacy policies, which we do not control.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the latest version. If a change is significant, we will make it clearly visible on the site.