Online store hairshop.lv · SIA "MIKS PLUS" · Version 2.0 · Effective from 03.07.2026
This Privacy Policy (the "Policy") describes how SIA "MIKS PLUS" collects, uses, stores and protects the personal data of visitors and customers of the online store www.hairshop.lv (the "Store"), as well as customers of our retail stores.
Personal data is processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR), the Personal Data Processing Law of the Republic of Latvia (Fizisko personu datu apstrādes likums), the Information Society Services Law and other applicable laws of the Republic of Latvia.
Controller: SIA "MIKS PLUS"
Registration number: 40103351370
VAT number: LV40103351370
Legal address: Rencēnu iela 10A, Rīga, LV-1073, Latvia
Phone: +371 27067730
E-mail: info@hairshop.lv
For any matters related to personal data processing, please write to the above e-mail address with the subject "Personal data".
Identification and contact data: name, surname, phone number, e-mail address, delivery address; for legal entities — company name, registration number, VAT number, legal address.
Account data: username (e-mail), password (encrypted), selected language, order history, wishlist, saved delivery addresses.
Purchase and order data: order contents, amount, selected payment and delivery method, order status, invoice data, return and complaint history.
Loyalty programme data: member status, accumulated purchase amount, applied discount level, discount usage history.
Payment data: payment confirmation received from the payment provider (Paysera), the last digits of the card or the payer's bank. We do not receive or store full payment card data.
Communication data: correspondence by e-mail, phone and messaging tools, product reviews and ratings, support requests.
Technical data: IP address, browser and device type, operating system, referral source, pages and products viewed, cookie data (see Section 6).
Marketing data: consent/refusal to receive newsletters, e-mail open and click statistics (via Mailchimp).
Fulfilment of the order and sales contract (order acceptance, payment, delivery via DPD, Omniva or Venipak, invoicing, processing of returns) — performance of a contract (Art. 6(1)(b) GDPR).
Creation and maintenance of the customer account — performance of a contract (Art. 6(1)(b) GDPR).
Loyalty programme and cumulative discounts — performance of the contract with the programme member (Art. 6(1)(b) GDPR).
Payment after receipt of goods: review of order history to offer this payment method — the seller's legitimate interest in reducing the risk of non-payment (Art. 6(1)(f) GDPR).
Accounting and tax reporting — compliance with a legal obligation (Art. 6(1)(c) GDPR; the Accounting Law of Latvia, tax legislation).
Handling complaints and protecting legal claims — legal obligation (Consumer Rights Protection Law) and legitimate interest (Art. 6(1)(c) and 6(1)(f) GDPR).
Marketing communications (e-mail newsletters, promotions, personalised offers) — your consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
Analytics and advertising (Google Analytics 4, Meta Pixel, Google Ads) — your consent to the relevant cookie categories (Art. 6(1)(a) GDPR).
Website security and fraud prevention — legitimate interest (Art. 6(1)(f) GDPR).
We share personal data only to the extent necessary for the specific purpose with the following categories of recipients:
Payment provider: Paysera LT, UAB (Lithuania) — processing of online payments and bank links.
Delivery providers: DPD Latvija SIA, Omniva SIA, Venipak Latvija SIA — recipient's name, phone, e-mail and address/parcel locker for delivery; for payment upon receipt — also the amount payable.
E-mail marketing service: The Rocket Science Group LLC (Mailchimp, USA) — subscribers' e-mail address and name.
Analytics and advertising: Google Ireland Ltd. (Google Analytics 4, Google Ads), Meta Platforms Ireland Ltd. (Meta Pixel) — pseudonymised website behaviour data, subject to your consent.
IT service providers: hosting, maintenance of the e-commerce platform (nopCommerce), backups — under data processing agreements.
State and law enforcement authorities — only in cases and in the manner prescribed by law.
All processors act under contracts compliant with Art. 28 GDPR.
On your first visit you will see a cookie consent banner where you can accept all cookies, reject non-essential ones or customise categories. Essential cookies are placed without consent because the Store cannot operate without them; all others are placed only with your consent, which you can change at any time via the cookie settings on the website.
Essential cookies: shopping session, cart, authentication, selected language, storage of consent preferences. Duration — session or up to 12 months.
Analytics cookies (Google Analytics 4): anonymised visit statistics — which pages are viewed, where visitors come from, how the site is used. IP addresses are processed by Google in truncated form.
Marketing cookies (Meta Pixel, Google Ads): measuring advertising performance, remarketing — showing our ads on the Google and Meta networks to site visitors, building similar audiences.
You can also manage cookies in your browser settings and opt out of personalised advertising here: Google — adssettings.google.com, Meta — facebook.com/ads/preferences, and networkadvertising.org/choices.
Certain service providers (Google, Meta, Mailchimp) may process data on servers in the USA. Transfers are based on the European Commission's adequacy decision (EU–U.S. Data Privacy Framework) for certified companies, as well as EU Standard Contractual Clauses (SCC) with supplementary safeguards.
Order data, invoices and accounting documents — 5 years from the end of the relevant financial year (Accounting Law of Latvia).
Customer account and loyalty programme data — for as long as you use the account; after more than 3 years of inactivity, or upon your request, the account is deleted (data subject to mandatory retention is kept for the statutory period).
Marketing consent and mailing data — until consent is withdrawn; a subscription inactive for more than 3 years is deactivated.
Correspondence and complaints — up to 3 years after the matter is resolved; in the event of a dispute — until the expiry of the limitation period.
Technical logs and cookie data — according to the periods stated in Section 6 and in the cookie settings.
After the retention period expires, data is deleted or irreversibly anonymised.
Under the GDPR you have the right to:
obtain confirmation and access to your personal data (right of access);
request rectification of inaccurate or incomplete data;
request erasure of data ("right to be forgotten") where there is no legal basis for further processing;
restrict processing in the cases provided by law;
receive your data in a structured, machine-readable format and transmit it to another controller (data portability);
object to processing based on legitimate interest, and at any time — to direct marketing;
withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise your rights, send a request to info@hairshop.lv. We will respond within one month. We may ask you to verify your identity so that data is not disclosed to an unauthorised person.
If you believe your rights have been violated, you may lodge a complaint with the supervisory authority: Datu valsts inspekcija (Data State Inspectorate), Elijas iela 17, Rīga, LV-1050, phone +371 67223131, pasts@dvi.gov.lv, www.dvi.gov.lv.
Newsletters (new products, promotions, personalised offers) are sent via Mailchimp only with your consent — given at registration, at checkout or by subscribing on the website. You can unsubscribe at any time: via the "Unsubscribe" link in every e-mail, in your account settings, or by writing to info@hairshop.lv. Unsubscribing does not affect service messages about your orders (confirmation, delivery status), which are necessary for the performance of the contract.
We do not make decisions based solely on automated processing that produce legal effects for you. The cumulative discount level in the loyalty programme is calculated automatically based on your purchase amount according to the published programme terms. Segmentation for personalised offers is performed only with your marketing consent.
We apply appropriate technical and organisational safeguards: encrypted connections (TLS/SSL), hashed password storage, need-to-know access restrictions, antivirus and network protection, regular backups and software updates. Payment data is processed by a certified payment provider and is not stored on our servers.
The Store is intended for persons aged 18 and over. In Latvia, consent to data processing within information society services (e.g. newsletter subscription) may be given by a person aged 13 or over. If we become aware that we have received a child's data without appropriate consent, we will delete it.
The website may contain links to third-party websites (e.g. manufacturers, payment and delivery services, social networks). We are not responsible for their privacy policies — please review them before using such websites.
We may update this Policy. The current version is always published at www.hairshop.lv with the effective date indicated. In the event of material changes we will additionally notify registered users by e-mail or a website notice.
SIA "MIKS PLUS", Rencēnu iela 10A, Rīga, LV-1073, Latvia
Phone: +371 27067730 · E-mail: info@hairshop.lv