Privacy Policy

1. Data controller

The controller of your personal data is:

• SIA Master supply
• Registration number: 40203225208
• VAT number: LV40203225208
• Registered address: Vesetas iela 32 - 15, Rīga, LV-1013, Latvia
• Shop / pick-up: Bukultu iela 7a, Rīga, LV-1005, Latvia
• Email: info@oil24.lv
• Phone: +371 20209784

We have not appointed a data protection officer. Privacy questions and requests go to info@oil24.lv.

2. What personal data we collect

Depending on how you use the Website, we may process:

• Identity and contact data: first name, last name, email address, phone number, country.
• Account data: password (stored only as a one-way hash), account type (individual or legal entity), and a login token kept in your browser.
• Company data (legal-entity buyers): company name, legal address, registration number, EU VAT number.
• Order data: products, quantities, prices, VAT, coupons, delivery method, parcel-locker choice, payment method, order status, and related identifiers (including Stripe payment identifiers and carrier barcodes when a shipment is created).
• Guest cart data: a guest cart identifier stored in your browser, linked to the products you add before checkout or sign-in.
• Technical data: IP address, device and browser type, and server logs generated when you use the Website.
• Analytics and advertising data (only if you consent): pages viewed, approximate location derived from IP, device identifiers, and similar data collected by Google Analytics and the Meta Pixel.

We do not store full payment card numbers. Card payments are handled by Stripe. We do not collect special-category data (health, biometric, and similar) and we do not use automated decision-making that produces legal or similarly significant effects.

3. Why we process data and the legal basis

We process personal data only for the purposes and on the legal bases below (GDPR Article 6).

• Creating and managing your account, showing your cart and orders, and authenticating you — performance of a contract (Art. 6(1)(b)).
• Taking and fulfilling orders (including guest checkout), delivery via Unisend or Omniva lockers or shop pick-up, payment by card or VAT invoice, receipts and invoices, coupons, and customer service about an order — performance of a contract (Art. 6(1)(b)).
• Issuing VAT invoices, keeping accounting records, and meeting tax and commercial-law duties — legal obligation (Art. 6(1)(c)), including the Latvian Accounting Law and VAT rules.
• Securing the Website, preventing fraud and abuse, and keeping server logs — legitimate interests (Art. 6(1)(f)) in running a secure shop and protecting our rights.
• Google Analytics (measuring how the Website is used) — consent (Art. 6(1)(a)).
• Meta Pixel (measuring visits and showing or measuring ads) — consent (Art. 6(1)(a)).

We do not currently send marketing emails. If we introduce them later, we will do so only with a separate, optional consent, which you can withdraw at any time.

Providing identity, contact, delivery, and (where relevant) company data is necessary to conclude and perform a purchase contract. If you do not provide it, we cannot complete the order. Analytics and advertising tools are optional; refusing them does not stop you from using the shop.

4. Who receives the data

We do not sell personal data. We share it only with persons who need it to provide the shop, deliver goods, take payment, or meet legal duties. Recipients act as processors on our instructions, or as independent controllers where the law requires it (for example a payment institution or a tax authority).

• Stripe (Stripe Payments Europe, Limited and related Stripe companies) — card payments.
• Unisend / LP Express (Lithuania) — parcel-locker delivery, labels, and tracking when you choose Unisend.
• Omniva — parcel-locker delivery, labels, and tracking when you choose Omniva.
• Resend — sending transactional email (order receipts and VAT invoices).
• DigitalOcean — hosting the Website, API, database, and product images. Servers and object storage are in Frankfurt, Germany.
• Google Ireland Limited / Google LLC — Google Analytics, if you consent.
• Meta Platforms Ireland Limited / Meta Platforms, Inc. — Meta Pixel, if you consent.
• Competent authorities (for example the State Revenue Service or a court) when we are legally required to disclose data.

People who work for SIA Master supply may access orders and accounts only as needed to operate the shop. We do not use an external accountant or other outside service that sees customer data, except the providers listed above.

5. Transfers outside the EEA

Your order data is stored in the European Union (DigitalOcean, Frankfurt). Some providers are established in, or may access data from, countries outside the European Economic Area, in particular the United States:

• Stripe, Resend, DigitalOcean (US parent), Google, and Meta.

Where that happens, we rely on appropriate safeguards under GDPR Chapter V, typically the European Commission’s Standard Contractual Clauses and, where a provider is certified, the EU–US Data Privacy Framework. You can ask us for more detail at info@oil24.lv.

6. Cookies and similar technologies

We use cookies and similar technologies (including local storage in your browser). These are not used to “identify you only as a device”: an IP address and a persistent identifier can be personal data under the GDPR.

Strictly necessary storage (no consent required) includes the login token and guest-cart identifier we keep in your browser so the shop, account, and checkout work, and any cookies Stripe needs to take a card payment securely. The login token is set to expire after 7 days. The guest-cart identifier stays until you check out, sign in (when the cart is merged into your account), or it is removed.

Google Analytics and the Meta Pixel are not necessary for the shop. They are used only if you give consent through the cookie banner. You can refuse them without affecting your ability to browse, buy, or create an account. Consent can be withdrawn at any time via Cookie settings in the footer or by changing your browser settings.

Google Analytics and the Meta Pixel load only after you accept the cookie category that includes them. If the cookie banner is not shown, we do not load those tools. If you see the banner, use it to accept or reject optional tools, or open Cookie settings later to change your choice. You can also block or delete cookies in your browser; see https://www.aboutcookies.org for general guidance.

7. How long we keep data

We keep personal data only as long as needed for the purposes above, including legal duties. We apply these periods:

• Paid orders, VAT invoices, and related accounting records: 5 years after the end of the financial year they belong to, in line with the Latvian Accounting Law for supporting documents. We may keep them longer if a dispute, audit, or other legal duty requires it.
• Unpaid or cancelled orders: until the order is cancelled and stock is restored, and then up to 12 months unless we must keep them as accounting or evidence records.
• Customer accounts: until you ask us to delete the account, or the account is clearly abandoned. After deletion we keep order and invoice data for the accounting period above.
• Guest carts: until checkout, sign-in, or they are no longer needed for the purchase. Inactive guest carts are intended to be removed within 12 months.
• Server and security logs: up to 12 months, unless needed longer to investigate an incident.
• Google Analytics and Meta Pixel data: according to those providers’ settings and until you withdraw consent; we will not keep our own extra copies beyond what those tools store.

8. Your rights

Subject to the limits in the GDPR, you have the right to:

• access your personal data and obtain a copy;
• rectify inaccurate or incomplete data;
• erase data (“right to be forgotten”) where the legal conditions are met;
• restrict processing;
• data portability, where processing is based on consent or a contract and is carried out by automated means;
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting processing that took place before withdrawal;
• lodge a complaint with a supervisory authority.

Some rights do not apply to data we must keep for invoices and tax law. We will explain if we cannot fully meet a request.

9. How to exercise your rights

Email info@oil24.lv. We may need to verify your identity. We will respond within one month, or we will tell you if we need more time (up to two further months for complex requests).

If you ask us to delete your account, we will delete the account, password, and cart. We will keep orders and invoices for the accounting period in section 7. You can also change basic profile details while signed in.

10. Security

We use technical and organisational measures appropriate to the risk, including HTTPS, hashed passwords, access limited to people who need it, and hosting in the EU. No internet transmission is completely secure. If a personal-data breach is likely to result in a risk to your rights, we will notify the Data State Inspectorate as required and, where the risk is high, we will inform you.

11. Children

The Website is intended for adults buying engine oil. We do not knowingly collect personal data from children. If you believe a child has provided data, contact info@oil24.lv and we will delete it where we are not required to keep it.

12. Changes to this policy

We may update this Privacy Policy when our processing or the law changes. The current version is always published on this page, with the effective date at the top. Material changes will be presented in a way you can notice (for example a notice on the Website or by email if we have your address for that purpose).

13. Supervisory authority

You have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija), or with the authority in the EEA country where you live or work:

• Datu valsts inspekcija
• Elijas iela 17, Rīga, LV-1050, Latvia
• Email: pasts@dvi.gov.lv
• Website: https://www.dvi.gov.lv

We sell to consumers in Latvia, Lithuania, and Estonia. You may also contact the data protection authority in Lithuania or Estonia if that is where you live.