Privacy policy

1. Controller and processor

Data controller: SIA “FEGFE”, reg. No. 40203244016. Technical maintenance is provided by an external IT partner acting as a data processor on the controller's behalf and only on its instructions. Data enquiries: info@fegfe.lv.

2. What data we process

We process data you submit yourself and - only with your consent - site usage data:

• contact form - name, e-mail address, selected topic and message text
• review form - name, e-mail address, product, rating, review text and consent to publication; only the name (as you gave it), the rating and the text are published on the site, never the e-mail address (it is used only to contact you about the review); you can withdraw consent by writing to info@fegfe.lv
• materials request - cart contents and the contact details you provide
• payment by bank transfer - the details needed for the invoice: full name or company name, address and, for companies, the registration number and VAT number (if given); we do not ask for a personal identity number (see section 3)
• customer account - e-mail address, name, selected language, account creation, terms acceptance and last sign-in time (see section 4)
• chat - text entered during the conversation (no account required)
• with your consent - visit and purchase statistics (Google Analytics) and ad measurement (Meta Pixel), see section 6

3. Cart and payments

Cart contents are stored only in your browser (localStorage) and are not sent to a server until you submit a request (except for the measurement described in section 6, if you have consented to it). Payment card details never reach this site - online payments are handled by an external payment provider (Stripe) in its own secure environment. If you choose payment by bank transfer, we use the invoice details you provide to issue the prepayment invoice and, once payment is received, the invoice, and to send them to your e-mail; you make the transfer in your own bank, and the payer details (name, account number) reach us in our bank statement. Legal basis - performance of the contract and compliance with accounting obligations (GDPR Article 6(1)(b) and (c)).

4. Customer account

If you create a customer account, we process your e-mail address, name, selected language, and the account creation, terms acceptance and last sign-in time. To sign in, we e-mail you a one-time code valid for 15 minutes; we store only a hash of the code, not the code itself. Purpose - signing in and providing your order history and repeat downloads. Legal basis - performance of a contract (GDPR Art. 6(1)(b)). Account data is kept until the account is deleted - you can delete it yourself in your profile. Order data is kept for the period required by the Latvian Accounting Law, also after the account is deleted.

5. How we use the data

Form data is sent through the form relay of the website's technical maintainer and stored in a customer request system solely to reply to your request, agree on payment and deliver the materials. The legal basis is performance of a contract and steps taken at your request prior to entering into it (GDPR Art. 6(1)(b)), our legitimate interest in answering enquiries we receive (Art. 6(1)(f)) and compliance with accounting obligations (Art. 6(1)(c)). Data is not used for marketing and is not shared with third parties except where required by law.

6. Cookies and similar technologies

The site uses browser storage (localStorage, sessionStorage) and cookies. Optional cookies (analytics and marketing) are used only after you consent in the “Cookies” banner (Latvian Information Society Services Law, Section 7.1); until you do, the related scripts are not loaded at all. If the site shows neither the banner nor the “Cookie settings” link in the footer, these tools are currently not used.

• Necessary (always, no consent needed): cart contents (localStorage, until you empty it), your cookie choice (localStorage, 12 months), the customer account sign-in session - access token, e-mail and name (localStorage, until you sign out or the session expires), chat history (sessionStorage, until the tab is closed). The language is determined by the page address (/en/, /ru/) and is not stored.
• Analytics (only with consent): Google Analytics 4 (Google Ireland Limited) - aggregated statistics on visits, viewed products, cart and purchases (product code, price, amount). Cookies _ga and _ga_* (up to 2 years). Without consent the Google Analytics script is not loaded and nothing is sent to Google. Google Analytics does not store IP addresses; the purchase identifier is sent only in hashed form; your e-mail, name and payment details are never sent to Google.
• Marketing (only with consent): Meta Pixel (Meta Platforms Ireland Limited) - measuring the results of Facebook and Instagram ads (viewed products, add to cart, checkout start and purchase with the amount). Cookies _fbp and _fbc (90 days). Meta may link these events to your Facebook/Instagram account under its own privacy policy; for the collection and transmission of this data SIA “FEGFE” and Meta are joint controllers.
• Cloudflare Web Analytics - visit counts without cookies and without identifying users; it always works because nothing is stored on your device.
• With analytics or marketing consent, your browser keeps a short cart summary (localStorage, up to 24 hours) and hashed identifiers of recent purchases (localStorage, up to 30 days) so that a completed purchase is recorded once; they are deleted when consent is withdrawn.
• You can change your choice or withdraw consent at any time via the “Cookie settings” link in the footer. Withdrawal takes effect immediately and the related cookies are deleted. You can also delete cookies in your browser settings.

7. Service providers (processors)

Data is processed on our behalf by the following service providers, each only for its own function:

• Cloudflare - website hosting and protection, shop and chat servers, storage of customer accounts and copies of issued invoices, cookie-free visit statistics
• Supabase - database (orders, invoice details, requests) and storage of material files
• Cloudflare (Email Sending), with Resend as a backup - e-mail delivery (order confirmations with materials, invoices, customer account e-mails)
• Stripe - card payment processing
• Google Cloud (Vertex AI) - generating chat replies; processed in an EU region
• only with your consent: Google Ireland Limited (Google Analytics) and Meta Platforms Ireland Limited (Meta Pixel) - see section 6
• Some of these companies or their group companies may also process data outside the EEA, e.g. in the USA. In that case the transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework or on standard contractual clauses.

8. Data retention

Request data is kept for as long as needed to process the request and to meet accounting requirements, after which it is deleted. The details shown on invoices and prepayment invoices (full name or company name, address, registration number, VAT number, order contents and amount) are accounting source documents, so we keep them for the period required by the Latvian Accounting Law - 5 years; they remain even after a customer account is deleted.

9. Your rights

You have the right to request access to your data, its correction or deletion, to restrict processing, to receive your data in a portable format, and to object to processing. Write to info@fegfe.lv - the data controller is SIA “FEGFE”, and requests are handled by the controller, not the site's technical maintainer. If you believe your data is processed unlawfully, you may complain to the Latvian Data State Inspectorate (Blaumaņa iela 11/13-11, Riga, LV-1011, dvi.gov.lv).