GDPR data subject rights

This page is about the rights the General Data Protection Regulation gives you over your own data, and about how to use them here. It tells you what to write, where to send it, what happens next and how long it takes. What we collect and why is on our privacy policy page; this page does not repeat it.

These rights belong to people, including the person who orders on behalf of a company. A name, an e-mail address and a phone number are personal data even when the invoice goes to a firm (Article 4(1)). Data about the company itself — its name, registration number, VAT number — is not personal data. One exception matters here: where the buyer is a sole trader, the business details are usually that person's own data as well, and everything on this page applies to them too.

The shop is addressed to business buyers, and prices and terms are set for them. If a consumer nevertheless buys from us, the rights the law gives consumers apply to that purchase in full. Data protection does not change either way: the rights below are the same for everyone.

The page covers this website and the orders placed through it. It applies to you whether you have bought from us, written to us, or only read these pages. It takes effect on 19 August 2026.

Ten things you can ask for. Each has its own section below, which says what it means on this site in particular.

• Be informed — know what we do with your data, in plain words (Article 13).

• Access — get a copy of the data we hold about you (Article 15).

• Rectification — have what is wrong or incomplete corrected (Article 16).

• Erasure — have data deleted where we have no reason left to keep it (Article 17).

• Restriction — have us freeze a record and stop using it while something is disputed (Article 18).

• Portability — get the data you gave us back in a machine-readable file (Article 20).

• Object — stop processing that we base on legitimate interests (Article 21).

• Not be subject to a decision made by machine alone, including profiling (Article 22).

• Withdraw consent, where processing rests on consent (Article 7(3)).

• Complain to a supervisory authority (Article 77), go to court (Articles 78 and 79) and claim compensation for damage (Article 82).

Not every right reaches every situation. Where the law obliges us to keep a record, erasure gives way; where we hold data we cannot connect to any person, access has nothing to return. We say so in the section concerned rather than at the end.

You have the right to know who holds your data, for what, on what legal ground, who else receives it and how long it stays. That information is on our privacy policy page.

Five details on the order form are ones we cannot work without: your name, e-mail address, phone number, city and street address. Without them we cannot accept the order or deliver it, and the form will not send. Company, VAT number, country, postcode and the comment box are optional — the VAT number matters only if the invoice is to be made out to a company. Nothing else about you is asked for anywhere on this site: there is no account to open and no registration.

The data in an order is what you typed into the order form. If we ever want to use it for a new purpose, we will tell you before we start, not afterwards (Article 13(3)).

You can ask for a copy of the personal data we hold about you. For a buyer that is the order record: name, e-mail address, phone number, delivery address, postcode, country, company and VAT number if you gave them, your comment, the items and quantities, the totals and VAT rate, the status of the order and the dates. The record also holds a technical network address captured when the order was sent; because the site sits behind a proxy, that is the proxy's address and not yours. Alongside the order there may be our correspondence with you and the accounting documents for the sale.

There is no payment on this site: you pay by bank transfer against an invoice, so no card details and no bank credentials ever pass through these pages. Your name as payer and the account the money came from do appear in the bank record and in our accounting, and you can ask for a copy of those as well.

With the copy we tell you what we use the data for, who has received it, how long we expect to keep it, and where the rights on this page come from.

Your confirmation e-mail carries a link to the order status. The page behind that link shows the order number, the current status, the items with quantities and line totals, and the total — and nothing else. The link is the key to the order, so keep the e-mail to yourself and do not forward it on. For anything wider — the full record, the recipients, the retention — ask us.

Site statistics are the one place where we cannot help you, and it is fairer to say so than to pretend. We count page views with open-source software installed on the same platform that runs this shop, in Finland; no analytics company receives anything. It sets no cookies, it stores no IP address, and the identifier it calculates groups browsers rather than people. Article 11(2) covers exactly this case: where we cannot identify you, Articles 15 to 20 do not apply — unless you can give us information that lets us find you in that data, and then they apply again. We will not refuse a request on that ground without showing you why we are unable to identify you (Article 12(2)).

If a name is misspelled, a phone number wrong, an address out of date or a detail missing, tell us and we will put it right. Quote the order number if it concerns an order.

A wrong delivery address is worth a phone call as well as an e-mail: while the goods are still with us the fix takes a minute, and after they leave it takes a great deal longer. The call already counts as a request; send the correction in writing too, so that it is recorded and we can show what was changed and when.

Where a detail has already gone into an accounting document, the correction is recorded alongside it rather than replacing it — your data still gets corrected, but the original entry stays visible. Where we have already passed on a detail that turns out to be wrong, we tell the recipient about the correction as well, unless that proves impossible or would take disproportionate effort (Article 19).

You can ask us to delete your data, and where nothing obliges us to keep it, we will. An enquiry that led nowhere, a message thread, an order that was never confirmed and produced no accounting entry — those we can remove on request.

A completed purchase is different, and the reason is not our preference. Article 17(3)(b) sets the right aside where processing is necessary to comply with a legal obligation, and Latvian accounting law is such an obligation. Under Section 28 of the Accounting Law (Grāmatvedības likums), source documents must be kept for not less than five years, and accounting registers for ten. The invoice and the bookkeeping entries for your purchase stay with us for that time, and a deletion request cannot shorten it.

The order record in the shop is not the same thing as the invoice. We keep it while it is needed to carry out the order and for as long as a claim about that sale can still be brought, and in no case longer than accounting law requires for the documents behind the sale; we delete it once nothing above requires us to keep it. Ask us, and we will tell you what is still holding your record.

Two practical notes. The database is copied every night and roughly the last two weeks of copies are kept, so a record deleted today can still sit inside a backup until that copy is overwritten in turn; we do not use backups to bring deleted data back into use. And your shopping basket never needed a deletion request at all: it is held by your own browser, we do not see it until you send the order, and clearing your browser's site data removes it.

Restriction is the pause button. If you tell us that a detail is wrong, or that you believe we have no good reason to hold something, you can ask us to freeze that record while the question is settled. We then store it and do nothing else with it — no further use, no passing it to anyone — except with your agreement or where it is needed to establish or defend a legal claim.

The right also works the other way round. If we would otherwise delete data that you still need for a claim of your own, you can ask us to keep it instead and hold it frozen. When a restriction is about to be lifted, we tell you before it happens, so the news does not reach you afterwards (Article 18(3)).

Portability covers the data you provided yourself, processed by automated means, on the basis of a contract or of consent. On this site that means your order records. Ask, and we send them to you as a structured, machine-readable file that you can open or hand to someone else. If you want the file sent straight to another company instead, say so; we will do it where that is technically feasible (Article 20(2)).

Two boundaries. Portability covers what you typed, not what we worked out afterwards, so internal notes and the handling history of an order stay with us. And receiving the file does not mean we lose our copy: portability does not touch what accounting law obliges us to keep. If you want deletion as well, ask for it separately and read the erasure section first.

You can object at any time to processing that we base on legitimate interests. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the data is needed to establish or defend legal claims. Tell us what you are objecting to and, if you can, why it affects your situation — a specific objection gets a specific answer instead of a form reply.

Where we process your data to carry out your order, or because the law requires us to keep a record, an objection has nothing to act on: those grounds are not legitimate interests. In that case tell us what is actually wrong, and we will look at correction, restriction or erasure instead.

Audience measurement is the one thing on this site that runs on legitimate interests rather than on your order. If you object to it, the objection is accepted — and here is what that does and does not mean in practice. We cannot pick your visits out of the statistics and remove them, because nothing in there is tied to you. What does stop the measurement in your own browser is blocking the script: it is served from this domain, any content blocker will stop it, and ordering works exactly the same afterwards. The site does not currently act on the browser's "Do Not Track" setting.

Article 21(2) gives an unconditional right to object to direct marketing. This site has none to object to: no newsletter, no subscription box, no account. If you ever get an offer from us and do not want another, one line by e-mail stops it for good.

We make no decisions about you by automated means that produce legal effects or similarly significantly affect you, and we do not profile you. Nothing here scores you, sorts you into groups, shows you a different price from the next visitor or decides anything about you on its own. The catalogue is the same for everyone who opens the page.

An order placed here is a request, not a transaction that closes itself. A person at our shop reads it and confirms availability, delivery and the final figures, so the decision that matters is human from the outset. The e-mail that arrives immediately after you send the order is a receipt with a link to the order status, not a decision about you. Because nothing here falls under Article 22(1), the safeguards attached to that article — demanding human review of a machine's decision, contesting it — have nothing to attach to on this site. This page carries the date it took effect; if any of this changes, the text and that date change with it.

Where processing rests on your consent, you may take that consent back at any time, and it must be as easy to withdraw as it was to give. Withdrawal works forwards only: it does not make unlawful the processing that happened before it.

On this site we do not ask for consent anywhere, so today there is nothing for you to withdraw. There are no cookies and no cookie banner, no newsletter to subscribe to and no account to open. The audience measurement sets no cookies, stores no IP address and cannot be linked to a person; we run it on legitimate interests, not on consent, which is why the previous section is the one that applies to it. Order data is processed to carry out the order and to satisfy accounting law — again different grounds, which withdrawing consent does not reach.

Consent can still arise between us in ordinary correspondence — you might ask us to keep your details on file for future quotations, or agree that we contact you when an item comes back into stock. If you want that to stop, one line by e-mail is enough: name what you agreed to and say you are taking it back. We will confirm, stop, and delete whatever was being kept on that basis alone.

We check that a request comes from the person the data is about. Sending someone's order details to a stranger who asked politely would itself be a breach, so the check protects you, not us.

Usually it is invisible: the address you write from matches the address on the order, and that is the end of it. Where it does not match — you changed provider, or a colleague writes on your behalf — Article 12(6) lets us ask for the further information we need to confirm who you are. What we ask for is small and specific: the order number, the date, the delivery address on the order, the items ordered. Things that only the person behind that order would know. We ask straight away rather than at the end of the month, so the extra step costs as little time as possible.

We do not ask for a scan of a passport or an identity card for a request like this, and you should be cautious with any shop that does. We do not create an account for you either. If someone acts for you, we need something in writing from you to say so before we hand anything over.

We answer without undue delay and in any event within one month of receiving your request. Article 12(3) allows that period to be extended by two further months where the request is complex or where several arrive at once. We will not use the extension silently: if we need it, you get a message inside the first month saying so and why.

The answer costs nothing. Article 12(5) requires information and action on your rights to be provided free of charge, and we do not charge for a copy of your data, a correction, a deletion or an export. Two narrow exceptions exist, and both would have to be justified by us rather than assumed: a request that is manifestly unfounded or excessive, in particular because it repeats, may carry a reasonable fee based on our administrative costs or be refused, and the burden of showing that it is manifestly unfounded or excessive rests on us. Separately, Article 15(3) allows a reasonable fee for further copies of the same data after the first one.

If we decide not to act on your request, you will not be left guessing. Article 12(4) obliges us to tell you within one month why not, and to point out that you can complain to the supervisory authority and seek a judicial remedy. We will give the actual reason.

A request sent electronically gets an electronic answer in a commonly used format, unless you ask us for something else.

The shop itself stays inside the European Union. The pages of this site are served from a data centre in Germany, and the platform that stores the orders runs in Finland. Both are under the same Regulation as we are.

Every request to this site passes through the proxy of our content delivery and security service on its way to us, and that includes the order form when you send it — so the contents of your order are visible to that company in transit. Its standard terms incorporate a data processing addendum by reference, and that addendum applies the European Commission's standard contractual clauses to any transfer of personal data outside the European Economic Area. The requests we tested were handled at its Warsaw location, inside the EU; which of its locations serves you depends on where you are.

One step goes further out. The confirmation e-mail is sent through a mail provider established in Switzerland, so your address, your name and the contents of your order pass through it. Switzerland is covered by a European Commission adequacy decision — Decision 2000/518/EC of 26 July 2000 — which the Commission reviewed on 15 January 2024 and left in force. An adequacy decision means the transfer needs no additional contractual safeguards, and your rights travel with the data.

Nothing on these pages is embedded from another company: fonts, images, styles and scripts are all served from this domain, and there is no advertising, no social button, no chat window and no map embedded in a page. The one address in the footer is an ordinary link to a map service, which opens in a new tab — following it takes you to that company's site, as any external link would. Wherever data goes, you exercise the rights on this page with us: a transfer is never a reason for us to answer you with less.