Privacy Policy

GENERAL INFORMATION

This privacy policy (hereinafter - the Privacy Policy) of SIA "Setauto" (hereinafter - the Company) aims to inform users about the processing of personal data and the rights of the user as a data subject. The information provided in this Privacy Policy is relevant when visiting the website setauto.lv (hereinafter - the website) and using its services, regardless of the type of user device (computer, smartphone, tablet, or other).

The holder of personal data processed on the website is SIA "Setauto", legal address: Latvia, Salaspils, Institute Street 2, LV-2169 Email: SETAUTO.INFO@GMAIL.COM +371 20422223, +371 25299299.

Please note that SIA "Setauto" provides intermediary services for the sale of goods owned by third parties (sellers). SIA "Setauto" is not responsible for the legality and security of the user's personal data processing if they are processed by the sellers according to their own rules. If users have questions regarding their personal data processing and exercising their rights, they should contact the seller of the goods.

Please read this Privacy Policy carefully as it contains important information about the processing of personal data and user rights.

It is hereby confirmed that the collection of personal data from website visitors will be carried out in accordance with the requirements of the current European Union and Latvian Republic legal acts and the guidelines of supervisory authorities. Technical and organizational measures appropriate to the risk level of processing website visitors' personal data will be used during the processing to protect the collected data from loss, unauthorized use, and alteration.

The website and its services are intended for individuals aged 16 and older. Persons under the age of 16 must obtain permission (consent) from their parents or other legal representatives before using the website and its services.

MAIN TERMS USED IN THE PRIVACY POLICY

Personal data – any information related to a physical person (data subject) whose identity is known or can be directly or indirectly identified using personal data such as name, surname, personal code, postal address, email address, network identifier, etc.

Processing – any action or set of actions performed with personal data (collection, recording, use, acquaintance, storage, disclosure, etc.).

Other terms used in the Privacy Policy are understood according to their definitions established in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter - Regulation (EU) 2016/679), as well as in the Latvian Republic's "Personal Data Protection Law" and other legal acts.

PURPOSES OF PERSONAL DATA PROCESSING, TYPES OF PROCESSED PERSONAL DATA, AND CONDITIONS FOR LEGALITY OF PERSONAL DATA PROCESSING

To ensure convenient access to the Company's services, registration on the website, and user account administration, the Company processes the name, surname, phone number, email address, IP address, and authentication data, as well as other mandatory user data. Personal data processing is carried out based on the conclusion and execution of the contract for using the website in accordance with Article 6, Part 1, point b of Regulation (EU) 2016/679.

For concluding and executing a purchase agreement, informing the user about the order execution progress, issuing an invoice, and accounting, the Company processes the name, surname, address, phone number, email address, information about ordered goods, invoice data, chosen delivery method, and other information about contract execution, payment information, and other mandatory user data. Personal data processing is carried out based on the conclusion and execution of the contract for using the website and complying with legal requirements in accordance with Article 6, Part 1, points b and c of Regulation (EU) 2016/679.

For direct marketing purposes (newsletters and showing advertisements to website visitors, surveys (gathering opinions) about goods and services), the Company processes the email address and/or phone number, information about completed orders, IP address, search data on the website, and other mandatory user data. Personal data processing is carried out based on the user's consent in accordance with Article 6, Part 1, point a of Regulation (EU) 2016/679 and on the Company's legitimate interests in accordance with Article 6, Part 1, point f of Regulation (EU) 2016/679 and Article 69, Part 2 of the Latvian Republic's "Electronic Communications Law". Consent to personal data processing for direct marketing purposes is valid if given by a person aged over 16.

To respond to a user's request sent to the Company through the website, the Company processes the name, contact information, request and response content, IP address, and other information related to the request. Personal data processing is carried out based on the user's consent in accordance with Article 6, Part 1, point a of Regulation (EU) 2016/679.

To ensure service quality and preserve evidence of communication that may have legal consequences, the Company records telephone conversations on service lines whose numbers are published on the Company's website. Personal data processing is carried out based on the user's consent and on the Company's legitimate interest in objectively resolving disputes with clients during telephone conversations in accordance with Article 6, Part 1, points a and f of Regulation (EU) 2016/679 and Article 69, Part 2 of the Latvian Republic's "Electronic Communications Law".

To publish and advertise its activities, the Company may process and publish on its website and its social media pages users' portraits and reviews about the Company's activities, as well as other personal data that the user agrees to provide for these purposes. Personal data processing is carried out based on the user's consent in accordance with Article 6, Part 1, point a of Regulation (EU) 2016/679.

To ensure user access to the website and the receipt of information society services, as well as to analyze and improve the website and its services, and display advertisements, SIA "Setauto" processes personal data of website visitors obtained through cookies. Detailed information on the use of cookies is provided in the section "Why and what cookies are used by the Company". Personal data processing collected through cookies is carried out based on the user's consent and in accordance with the Latvian Republic's "Electronic Communications Law".

SIA "Setauto" may also process personal data for other purposes if necessary for legitimate business activities, compliance with accounting, taxation, and other legal requirements, and protection against claims, lawsuits, and the protection of SIA "Setauto" legitimate interests.

If personal data processing is carried out based on the user's consent, the data subject has the right to withdraw their consent at any time: for this, they must contact SIA "Setauto" through any of the contacts provided in the Privacy Policy, and in the case of personal data processing for direct marketing purposes, they should choose the appropriate settings in the user account or follow the opt-out link in the email. Please note that withdrawing consent does not affect the legality of data processing carried out based on consent before its withdrawal.

WHERE SIA "SETAUTO" OBTAINS PERSONAL DATA FROM

The Company processes personal data provided by the user during registration on the website and using its services, as well as data generated during the user's stay on the website (date and time of entry, viewed pages, etc.). The collected data includes information about the user, user device, or use of the website content.

The Company may receive personal data from third parties: payment service providers (e.g., about a user's payment), social network service providers (e.g., about the user's login to the website using their "Facebook" account), and other persons as permitted by applicable legal acts.

The user may refuse to provide the Company with certain personal data, but in such a case, some website functions or services may be limited (e.g., refusal to provide contact information will prevent the Company from responding to the user's request; refusal to provide data necessary for concluding a purchase agreement will prevent the Company from concluding the contract and fulfilling the user's order).

TO WHOM THE COMPANY DISCLOSES USERS' PERSONAL DATA

The Company undertakes not to disclose users' personal data to any unrelated third parties, except in the following cases:

• user consent to the disclosure of personal data;
• disclosure of the user's personal data to the Company's partners providing delivery services or other ordered services. These service providers receive the user's personal information only to the extent necessary for the provision of the specific service;
• disclosure of the user's personal data to the seller of the purchased goods to ensure the proper execution of the order;
• disclosure of the user's personal data to tax, law enforcement authorities, and other state authorities in the manner prescribed by the legal acts of the Latvian Republic.

The Company may disclose users' personal data or provide access to them to its service providers (companies providing newsletter services, accounting services, technical maintenance of information systems, hosting, data storage, etc.). Service providers process personal data on behalf of SIA "Setauto" and in accordance with its instructions.

The Company may disclose users' personal data to third countries outside the European Union and the European Economic Area. The Company discloses personal data to third countries only to the extent necessary to ensure the provision of its services and if at least one of the following conditions is met:

• the European Commission decision on an adequate level of data protection in the third country;
• the conclusion of a contract with the data recipient in accordance with the European Commission's approved standard contractual clauses ensuring appropriate data protection measures;
• the necessity to disclose personal data to fulfill a contract with the user (e.g., delivery of goods to the specified address) or to implement pre-contractual measures at the user's request (i.e., the application of Article 49, Part 1, point b of Regulation (EU) 2016/679).

PERSONAL DATA STORAGE PERIODS

Personal data storage is carried out within the following periods:

• For user account administration purposes: 5 years after the last login to the account;
• For concluding and executing purchase agreements, accounting: during the contract term and 10 years after its termination;
• For request administration and response purposes: 2 years after the request submission date;
• For direct marketing purposes: 5 years from the moment of consent or until the user's consent is withdrawn or the user objects to personal data processing;
• For ensuring service quality and communication evidence preservation that may have legal consequences (telephone conversation recordings): 1 month;
• For the Company's activity publication and advertising purposes: as long as there is a need to publish information (reviewed for relevance at least once every 2 years) or until the user's consent is withdrawn.

Personal data processing collected through cookies is carried out during the cookie's validity period.

Upon expiration of the specified periods, the data is deleted without the possibility of recovery or transferred to the state archive if such an obligation is stipulated for SIA "Setauto" by legal acts.

ENSURING PERSONAL DATA SECURITY

During personal data processing, SIA "Setauto" implements the necessary organizational and technical security measures to protect personal data from accidental or unauthorized disclosure or other illegal processing. The choice of data protection measures is made considering the data processing risk level.

DATA SUBJECT RIGHTS

The user, as a data subject, has the following rights, which are exercised to the extent established by Regulation (EU) 2016/679:

• The right to know (receive information) about the processing of their personal data;
• The right to access their personal data and receive a copy;
• The right to request correction of inaccurate personal data;
• The right to request restriction of personal data processing;
• The right to request deletion of personal data;
• The right to withdraw consent to personal data processing;
• The right to object to personal data processing at any time. In case of personal data processing for direct marketing purposes, the data subject has the right to object to personal data processing without specifying the reasons for the objection. In case of personal data processing based on Article 6, Part 1, point f of Regulation (EU) 2016/679 (for the purpose of legitimate interests protection), the user must specify the reasons related to the specific objection case;
• The right to data portability.

Data subjects may exercise their rights by contacting SIA "Setauto" at the address: Priekuļu Street 1, office 101, Riga, Latvia, or via email at info@setauto.lv. The submission procedure is described in the following Data Subject Rights Exercise Procedure.

If the data subject believes that their rights have been violated, they have the right to file a complaint with the Data State Inspectorate (address: Brivibas Street 123, LV-1012, Riga, Latvia, website: www.dvi.gov.lv) or another data protection supervisory authority in an EU Member State of their residence or workplace (list of supervisory authorities: https://edpb.europa.eu/about-edpb/about-edpb/members_lt#member-lt). In any case, before filing a complaint, please contact SIA "Setauto" to seek a solution together.

If you have questions regarding personal data processing or have suggestions, please contact SIA "Setauto" using the above contacts.

DATA SUBJECT RIGHTS EXERCISE PROCEDURE

To exercise their rights as a data subject, the user must submit an appropriate application to SIA "Setauto" and confirm their identity. Please note that the application may not be submitted if it is possible to exercise the rights in other ways (e.g., correcting personal data in your user account on the website, opting out of direct marketing in the email, etc.).

The application should specify which of the above rights is being exercised and to what extent the data subject wishes to exercise this right.

The data subject may confirm their identity in the following ways:

• If the application is submitted electronically: the application must be sent from the email address specified by the user during registration on the website or signed with a qualified electronic signature;
• If the application is submitted in person at the SIA "Setauto" office: a personal identification document must be presented;
• If the application is submitted by mail: the application must be accompanied by a notarized copy of the personal identification document or a copy of this document certified in another manner prescribed by legal acts.

The requirement for data subject identity confirmation does not apply when the data subject requests information about personal data processing in accordance with Articles 13 and 14 of Regulation (EU) 2016/679.

If SIA "Setauto" has doubts about the data subject's identity or if it is impossible to determine the data subject's identity based on the information provided in the application, SIA "Setauto" may request additional information necessary to unambiguously confirm the data subject's identity.

When contacting SIA "Setauto", a free-form application can be submitted.

SIA "Setauto" will provide information about the actions taken in response to the application no later than within one month from the date of its receipt. If necessary, this period may be extended by another two months, considering the complexity or number of applications. In any case, within one month from the date of receipt of the application, SIA "Setauto" will inform about the extension and state its reasons.

If SIA "Setauto" refuses to satisfy the application, it will inform the user immediately, but no later than within one month from the date of receipt of the application. The data subject has the right to appeal the refusal to the Data State Inspectorate and use other means to exercise their rights.

THIRD-PARTY SITES, SERVICES, AND PRODUCTS ON THE SIA "SETAUTO" WEBSITE

The website may contain third-party advertising banners, links to their websites and services, which SIA "Setauto" does not control. SIA "Setauto" is not responsible for the security and privacy of information collected by third parties. The user must independently familiarize themselves with the privacy policies applicable to the third-party websites and services they use.

WHY AND WHAT COOKIES ARE USED BY THE COMPANY

Cookies are text files that are stored in the browser (e.g., "Internet Explorer", "Firefox", etc.) of the user's device (e.g., computer, smartphone, tablet) while using the website. These files save information about the user's behavior on the website.

When visiting the website for the first time, cookies are installed on the user's computer and subsequently used for their identification. This is a common practice on the internet that facilitates repeated visits to the website and simplifies access to the information provided.

On the Company's website, cookies are used for the following purposes:

• Ensuring website functionality and efficiency;
• Ensuring convenience of website use;
• Increasing website speed and security;
• Displaying advertisements.

Technical (mandatory) cookies are used on the website, which are necessary for providing certain website services and ensuring the ability to use the website and its functions.

Statistical cookies are used on the website: the information obtained with their help is used to improve the functionality and convenience of the website.

Marketing cookies are used on the website for displaying advertisements.

The use of mandatory cookies is carried out in accordance with the Latvian Republic's "Electronic Communications Law", and the use of other cookies - only with the visitor's consent.

Cookies are used to process the IP address and information about user behavior on the website – for example, about viewed pages, time spent on the website, etc.

In certain cases, third parties may also install cookies and use the data obtained with their help. Information about third-party cookies can be found in their privacy policies published on these third-party websites.

More detailed information about cookies used on the Company's website is provided in the table below:

This website uses cookies . We use cookies to ensure ease of use of our website, personalize content, and for marketing purposes. You can change your cookie usage preferences in the settings. More detailed information is available in the Privacy Policy.

Cookies are small text files that websites can use to improve user experience. The law states that we can store cookies on your device if they are absolutely necessary for the operation of this website. For all other types of cookies, your consent is required. This website uses different types of cookies. Some cookies are placed by third-party services displayed on our pages.

You can change or withdraw your consent to the Cookie Declaration on our website at any time.

Find out more from our Privacy Policy about who we are, how you can contact us, and how we process personal data.

Your consent applies to the following domains: setauto.lv