Privacy Policy

1. Manager and contact details

The controller (in some cases the processor) of the personal data processing is a limited liability company "SIA PRADA MARFA" (hereinafter - the Company), unified registration No. 40203336062, registered office at Riga, Ausekļa iela 16 - 1, LV-1010.

The contact details of the company for personal data processing issues is marfa@marfahairbar.lv. In cases where the Company processes your personal data, you have the right to ask questions related to the processing of your personal data by sending a request to the contact information provided or by contacting us personally at the Company's office in Riga, Ausekļa iela 16 - 1, LV-1010.

2. Purposes of the processing of personal data

When processing personal data, the Company complies with the laws and regulations in force in the Republic of Latvia, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter - the Regulation), as well as other laws and regulations in the area of privacy and personal data processing. 

The Company's Data Protection Policy applies to all processing of personal data carried out by the Company. This data protection policy explains how the Company processes personal data of natural persons and how it ensures the exercise of the data subject's rights in relation to matters concerning the protection of personal data. 

The Company processes personal data received directly from the data subject (i.e. the person who provided the personal data) or indirectly (through corporate customers). Personal data received indirectly is only processed if the Company needs to process the personal data in order to provide a service within the scope of a contractual obligation.

Purposes of the processing of personal data:

• For the provision of services under contractual obligations. Personal data is processed only to the extent necessary for the conclusion of the contract and the performance of the contractual obligations. The legal basis for the processing is the performance of the contract (Article 6(1)(b) of the Regulation).
• for recruitment and management - to ensure the conduct of the recruitment competition and the protection of your legal interests insofar as recruitment is concerned. Legal basis for processing - performance of a legal obligation to which the Controller is subject (Article 6(1)(c) of the Regulation, Labour Law).
• For the processing of transaction data in accordance with the Accounting Act. In this case, all of your data protection rights may apply, with the exception of the right to erasure, the right to object and the right to data portability. Legal basis for processing - performance of a legal obligation to which the Controller is subject (Article 6(1)(c) of the Regulation).
• To improve customer service - The purpose of processing Personal Data is to enable the Company to evaluate any objections or comments you have made about customer service, so as to prevent future recurrences and improve customer service. Personal data is processed only to the extent necessary to identify the nature of the improvements to be made. In the further improvement of the Company's services and the achievement of its objectives, this personal data is not used. The legal basis for the processing is the legitimate interests of the Controller (Article 6(1)(f) of the Regulation).
• For the online shop, including setting up an account/profile on marfahairbar.lv. The purposes of the processing of personal data are related to the provision of the Online Shop service. The online shop processes personal data for the preparation, conclusion and administration of the distance contract (invoicing, delivery, communication). The legal basis for the processing is the performance of a contract (Article 6(1)(b) of the Regulation), the data subject's consent (Article 6(1)(a) of the Regulation), the performance of a legal obligation (Article 6(1)(c) of the Regulation) attributable to the Controller.
• For the provision of information to state administration authorities and subjects of operational activity in the cases and to the extent specified in external regulatory enactments. Legal basis for processing - performance of a legal obligation imposed on the Controller (Article 6(1)(c) of the Regulation).

In order to ensure the data subjects' right to privacy, the Company respects the principles of confidentiality and strictly limits the disclosure of personal data. Only persons authorised by the Company are entitled to modify and process personal data. After none of the circumstances specified in this paragraph exist, the personal data of the data subject shall be erased or destroyed, or transferred to a public archive for storage, in accordance with the requirements of the laws and regulations. 

3. Categories of recipients of personal data

The Company does not transfer personal data to third parties, except in the cases provided for in the regulatory enactments. Personal data cannot be accessed in third countries (i.e. countries outside the European Union and the European Economic Area).

4. Duration of storage of personal data

The Company shall retain and process personal data for as long as either party is legally obliged to retain the data:

• All information obtained during the recruitment competition about applicants for the position of employee will be kept for a maximum period of one year in order to safeguard the Company's legitimate interests. In the event that the Company receives complaints about a particular recruitment process, all information processed during the recruitment process will be retained for as long as is necessary for that particular process.
• All information processed to improve the quality of customer service is kept only for as long as it takes to establish the nature of the improvements required, but for no longer than six months. 
• All information for the purpose of compliance with a legal obligation to which the Company is subject is kept for as long as necessary to achieve the purpose of processing personal data in accordance with applicable laws and regulations, i.e. for as long as there is a legal obligation to keep the data (e.g. in accordance with the Law on Accounting, Labour Law, Law on Audit Services, Law on Prevention of Money Laundering and Terrorist Financing, etc.);

Company the following criteria are used to determine the period of retention of personal data:

• until the time limit for storage and processing set out in external laws and regulations or until the data subject can exercise his or her legitimate interests and rights (for example, to object and/or bring legal proceedings);
• as long as the data subject's consent to the processing of personal data is valid, unless there is another lawful basis for the processing.
• until the contractual obligations have been fully fulfilled (including negotiations where a verbal contract is concluded and/or a request for service is made).

5. Cookies

The company does not use cookies on its website.

Third party cookies
The Company's website may contain third party cookies, such as Google Analytics.
Google Analytics is powered by Google Inc. (a US company), which has access to the statistical data collected by this tool. Google Inc. has signed up to the European Union (EU)-United States (US) Privacy Shield Principles, the EU-US Privacy Shield List, which confirms that the service provider adheres to the privacy standards required by the EU. This service provider is also subject to contractual obligations designed to ensure privacy.

Cookie control
The data subject may delete cookies at his or her own discretion (for more information - www.AboutCookies.org and/or www.youronlinechoices.com/lv/).

6. Data subject rights

The data subject right applies to any natural person whose personal data is processed by the Company and applies to the processing of personal data regardless of the form in which you or any other natural person has provided the personal data: on the Company's website, in the information systems provided, in paper format or by telephone. The data subject has the following rights:

• contact us if you have any questions about the administration of your data, by writing to marfa@marfahairbar.lv or in person at our office in Riga, Ausekļa iela 16 - 1, LV-1010.

• the right to access that data. If we process your data, we are obliged to provide you with free information about the processing of your data. We are obliged to verify your identity before providing you with personal data, thus ensuring that information about your data is not passed on to third parties.
• If the information held by the Company is incomplete or incorrect, you have the right to have any discrepancies in your personal data corrected.
• the right to object to the processing of personal data by the Company where there is no longer any obligation to retain it;
• the right to request the deletion of your data if the Company continues to store it after the expiry of the storage period, as well as to restrict the processing of data in certain situations and/or to obtain copies in electronic format of the information held by the Company.

You may request the exercise of this right by contacting the Company at marfa@marfahairbar.lv or in person at our office in Riga, Ausekļa iela 16-1, LV-1010, and we will comply with the corrections set out in the request to the extent that it complies with applicable laws, regulations and professional standards.

7. Policy changes

The Company may revise this privacy notice at any time to include the most up-to-date privacy terms. We will notify you of any impacting changes to the processing of personal data described in this privacy notice through the appropriate communication channel.

8. Policy and its validity

The company works to protect the privacy of your personal information. If you have any questions or comments about the administration of your personally identifiable information, please contact us by e-mail at marfa@marfahairbar.lv or in person at our office in Riga, Ausekļa iela 16 - 1, LV-1010.

This contact information may also be used to notify you of any questions you may have regarding compliance with our data protection notice.

A reply will be provided within one month of receipt of the email. If your question is complex or we receive a large number of questions, we will inform you that it will take more than one month to resolve the issue and we will address it no later than three months from when the question was first submitted.

In parallel, you reserve the right to lodge a complaint with the regulator in Latvia responsible for the protection of personal data, the Data Protection Inspectorate (http://www.dvi.gov.lv).

9. Safety

The Company shall protect the data subject's data using state-of-the-art technology, taking into account the existing privacy risks and the Company's reasonably available organisational, financial and technical resources, such as data encryption, firewalls, intrusion protection and other safeguards.

In the event of a personal data security incident, if it poses a potentially high risk to the rights and freedoms of the data subject, the Company will notify the data subject concerned, where practicable, or the information will be made publicly available on the Company's website or in any other practicable manner.

16.04.2025