Privacy Policy

Last updated: 20 October 2026

Lawood respects your privacy and is committed to protecting the personal data processed in connection with the operation of the Lawood online store, order processing, customer service and use of the website.

This Privacy Policy explains what personal data Lawood may process, the purposes and legal bases of processing, who may receive the data, how long it is retained and what rights you have.

This Privacy Policy applies to personal data processing associated with the Lawood online store and related communication, orders, payments, deliveries, customer support, analytics, social media and marketing activities.

Lawood processes personal data only for specific and legitimate purposes and only to the extent necessary to achieve those purposes.

1. Data Controller and Contact Information

The entity responsible for processing personal data in connection with the operation of the Lawood online store and related services is:

SIA Lawood Base

Registration number: 40103821243
VAT registration number: LV40103821243
Registered address: Rīgas iela 14-11, Ropaži, Ropažu pag., Ropažu nov., LV-2135, Latvia
Email: [email protected]
Telephone: +371 20577992

SIA Lawood Base is the data controller for personal data processing carried out in connection with its business activities, the Lawood online store, order processing, customer service and other business-related operations.

If you have questions about the processing of your personal data, wish to exercise your data subject rights or submit a privacy-related request, you can contact us using the email address or telephone number provided above.

2. What Personal Data Does Lawood Process?

Depending on how you use the Lawood online store and communicate with us, Lawood may process the following categories of personal data:

• Identification data — first name, surname and other information required to identify a customer.
• Contact information — email address, telephone number and other information necessary for communication.
• Delivery information — delivery address, parcel locker or other collection point details and delivery-related data.
• Order data — information about ordered products, sizes, quantities, prices, order numbers, order statuses and order-related communications.
• Payment and invoicing data — information required to prepare invoices, identify payments and maintain accounting records.
• Customer communication data — information you provide when contacting Lawood by email, telephone, Tawk.to chat, WhatsApp, social media or other communication channels.
• Customer account data — if you use a customer account feature or such a feature is introduced in the future, data necessary to create and maintain the account may be processed.
• Review data — if you submit a product or service review, we may process your name, review content, rating, photographs and any other information you choose to provide.
• Social media data — if you contact Lawood or interact with its social media profiles, we may process information you make publicly available or send to us, such as usernames, comments, reactions and messages.
• Technical and usage data — information about your device, browser, IP address, access times, pages visited and other technical activities, insofar as such data is collected through the Lawood website and its technological solutions.
• Marketing data — if you consent to marketing communications or use Lawood marketing features, information necessary to send communications and evaluate their effectiveness may be processed.
• Age or identity information — where age or identity verification is required for a particular product, service or legal requirement.
• Information necessary to protect rights and legitimate interests — including communications, transactions or dispute-related circumstances where necessary to assess claims or protect legal rights.

Lawood processes only the personal data necessary for the relevant purpose. The amount and type of data processed may vary depending on the circumstances.

3. Why and on What Legal Basis Does Lawood Process Personal Data?

Lawood processes personal data only for specific, clearly defined and lawful purposes.

Depending on the circumstances, the legal basis for processing may be:

• performance of a contract or steps taken at your request before entering into a contract;
• compliance with a legal obligation;
• Lawood's legitimate interests;
• your consent.

An appropriate legal basis is applied to each processing activity. The Latvian Data State Inspectorate (DVI) states that personal data processing must be supported by at least one of the legal bases provided for in the GDPR.

Order Placement and Contract Performance

Personal data is processed to receive and process orders, prepare and deliver products, communicate with customers about orders, process payments and carry out other activities necessary to fulfil purchases.

Legal basis: performance of a contract or steps taken at your request before entering into a contract.

Orders That Have Not Been Completed

If a customer begins placing an order and provides information necessary for its fulfilment but does not complete the order, Lawood may, in certain circumstances, use the information provided to clarify the order status, contact the customer about completing the order or resolve a technical problem that prevented completion.

Such communication is not used for direct marketing unless an appropriate legal basis exists.

Orders by Telephone or Other Communication Channels

If a customer places an order by telephone, email, WhatsApp, social media or another communication channel offered by Lawood, we process the information necessary to receive, arrange, charge for and deliver the order and communicate with the customer.

Invoicing, Accounting and Other Legal Obligations

Personal data is processed to prepare and retain invoices, maintain accounting records and comply with tax requirements and other legal obligations applicable to Lawood.

Legal basis: compliance with a legal obligation.

Accounting document retention periods are determined by applicable legislation. Lawood does not apply one general retention period to all customer data.

Customer Service and Communication

Personal data is processed to answer customer enquiries and communicate about orders, returns, warranties, exchanges, deliveries, payments and other matters related to Lawood services.

Complaints, Disputes and Legal Matters

Personal data may be processed to review customer claims, protect Lawood's legal interests, prevent fraud and resolve potential disputes.

Legal basis: Lawood's legitimate interests and, where applicable, compliance with a legal obligation.

Website Operation and Security

Technical data may be processed to ensure website functionality and information security and to prevent misuse and technical disruptions.

Analytics and Website Improvement

Lawood may use analytics tools to understand how visitors use the website, improve its functionality and usability, and analyse website performance.

Where consent is required for particular analytics activities, processing is based on that consent.

Advertising and Personalised Marketing

Lawood may use advertising and marketing tools to display advertisements, measure advertising campaign performance and, where applicable, show personalised advertising.

Where consent is required, such processing takes place only after your consent has been obtained.

Marketing Communications

If Lawood offers email, SMS or other marketing communications, personal data is used to send those communications in accordance with applicable requirements.

Legal basis: your consent, where required for the particular marketing activity, or another basis permitted by applicable law.

Unsubscribing from direct marketing does not affect communications necessary to fulfil an order, such as order status, payment or delivery notifications.

Social Media

Lawood uses social media platforms, including Facebook, Instagram and TikTok, to provide information about products and news, communicate with customers and conduct marketing activities.

If you contact Lawood through social media, comment on or react to publications, participate in competitions or send us messages, we may process the information necessary for the relevant communication or activity.

Social media platforms may independently process personal data under their own terms and privacy policies.

Competitions, Promotions and Other Activities

If Lawood organises competitions, prize draws, promotions or other customer activities, personal data may be processed to organise and administer the activity, identify participants, contact winners, award prizes and comply with related legal obligations.

The rules of a particular competition or promotion may provide additional information about personal data processing.

Publishing Reviews

If you submit a review of a product or Lawood service, the information provided may be used to publish the review and improve customer experience in accordance with the review submission conditions.

Where consent is required to publish a particular review or other content, Lawood publishes it only after obtaining that consent.

Age and Identity Verification

If Lawood offers products or services subject to statutory age restrictions, it may process personal data necessary to verify the purchaser's identity and age.

Such data is processed only to the extent necessary to provide the relevant product or service and comply with legal requirements.

Lawood does not collect and retain dates of birth merely for storage purposes where they are not necessary for the relevant product or service.

4. To Whom May Lawood Disclose Personal Data?

To operate the Lawood online store and provide order fulfilment, payments, deliveries, customer service, website functionality, analytics and other services, personal data may be disclosed or made accessible to relevant service providers only to the extent necessary to provide the service.

Depending on the service, data may be disclosed or made accessible to:

• website infrastructure and IT service providers used by Lawood;
• payment service providers, including EveryPay, ePay and other payment providers available in the Lawood online store;
• delivery and courier service providers;
• accounting and financial service providers;
• customer communication and support service providers, including Tawk.to;
• analytics, advertising and website usage analysis providers, including Google, Meta and Microsoft;
• social media platforms when their features are used;
• review and customer experience service providers, where such features are used;
• insurers, lawyers, auditors and other professional advisers where necessary to protect Lawood's rights, interests, property or operations;
• public authorities, law enforcement agencies, courts and other institutions where disclosure is required or permitted by applicable law.

Lawood does not disclose more personal data than is necessary to provide the relevant service, fulfil a legal obligation or protect its legitimate interests.

The specific recipient and amount of data disclosed depend on the service and circumstances.

5. How Long Does Lawood Retain Personal Data?

Lawood retains personal data only for as long as necessary to achieve the relevant processing purpose or comply with statutory obligations.

Different categories of personal data and processing purposes may have different retention periods.

• Order and purchase data — retained for as long as necessary to fulfil the order and purchase agreement and resolve purchase-related matters.
• Invoices, accounting and transaction documents — retained for periods prescribed by applicable law.
• Customer communication data — retained for as long as necessary to address the relevant enquiry, order, complaint, warranty or other matter.
• Incomplete order data — may be retained for as long as necessary to assess an order or customer request, investigate a technical problem or resolve other justified order-related matters.
• Customer account data — where accounts are provided, retained while the account is active or another legal basis justifies retention.
• Marketing data — retained until the marketing purpose is achieved, consent is withdrawn or another legal basis for processing ceases to apply.
• Technical, analytics and advertising data — retention depends on the service, its settings, the processing purpose and user choices.
• Competition and promotion data — retained for as long as necessary to organise the activity, award prizes, comply with legal obligations and handle potential claims.
• Data needed for legal claims, disputes or protection of rights — may be retained until the matter is resolved or the applicable limitation period expires.

When a retention period ends and no other legal basis justifies continued retention, Lawood takes the necessary steps to delete or anonymise the data.

Lawood periodically reviews whether continued retention remains necessary and justified.

Minimum retention periods applicable to accounting documents are established by the Latvian Accounting Law.

6. Transfers of Personal Data Outside the European Economic Area

Certain service providers and technological solutions used by Lawood may be located outside the European Economic Area (EEA) or use infrastructure outside the EEA. Consequently, personal data may in some cases be transferred or made accessible outside the EEA.

This may concern website, IT infrastructure, cloud, payment, customer communication, analytics, advertising and other service providers, including Google, Meta, Microsoft and Tawk.to, insofar as the relevant service involves processing outside the EEA.

Where personal data is transferred outside the EEA, Lawood ensures that the transfer complies with applicable data protection requirements and is carried out only where an appropriate transfer mechanism under the GDPR exists.

Depending on the service and recipient, this may include a European Commission adequacy decision, the European Commission's Standard Contractual Clauses or another appropriate safeguard provided for by the GDPR.

Further information about specific providers' processing activities and international data transfers may be available in their privacy policies and other documentation.

7. Personal Data Security

Lawood implements appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Where appropriate, these measures include:

• restricting access to authorised persons;
• passwords and other access controls;
• security measures for information systems and technological solutions;
• protection of personal data during transmission and storage, to the extent supported by the technologies used;
• security solutions provided by technical systems and service providers;
• measures to prevent unauthorised access to or use of personal data;
• data recovery and business continuity measures where necessary.

Lawood regularly assesses the suitability of its technical and organisational security measures and improves them where necessary.

Despite these measures, no electronic transmission or storage system can guarantee absolute security.

8. Data Subject Rights

You have rights concerning the personal data processed by Lawood under applicable data protection legislation.

Depending on the circumstances, you have the right to:

• receive information about the processing of your personal data;
• request access to your personal data and obtain a copy;
• request correction of inaccurate, incomplete or outdated data;
• request deletion of personal data where the legal conditions for erasure are met;
• request restriction of processing where the applicable legal conditions are met;
• object in certain circumstances to processing, including processing based on Lawood's legitimate interests;
• object to the use of your data for direct marketing;
• withdraw consent at any time where processing is based on consent;
• in certain circumstances, receive your data in a structured, commonly used and machine-readable format and request its transmission to another controller where data portability requirements are met;
• not be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you, except where permitted by law.

Not all rights are absolute. In certain circumstances, Lawood may be entitled or required to continue processing data, for example to fulfil legal obligations, perform contracts or defend legal interests. The Latvian Data State Inspectorate explains that data subject rights must be exercised in accordance with the relevant processing activity and GDPR conditions.

9. How to Exercise Your Data Subject Rights

To exercise your rights, contact Lawood:

Email: [email protected]
Telephone: +371 20577992

Lawood may request additional information to verify the requester's identity and protect personal data from unauthorised disclosure.

Lawood responds to valid data subject requests within the period prescribed by applicable law.

Where a request is complex or numerous requests have been received, the response period may be extended in cases permitted by law, and you will be informed accordingly.

10. Withdrawal of Consent

Where personal data processing is based on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You may withdraw consent by contacting [email protected] or using the unsubscribe or consent management option provided by the relevant service or communication channel, where available.

Withdrawal of consent does not necessarily result in deletion of all personal data. Where another legal basis permits continued processing, such as compliance with a legal obligation, performance of a contract or protection of legal interests, Lawood may continue processing the relevant data on that basis.

10. Withdrawal of Consent

Where personal data processing is based on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You may withdraw consent by contacting [email protected] or using the unsubscribe or consent management option provided by the relevant service or communication channel, where available.

Withdrawal of consent does not necessarily result in deletion of all personal data. Where another legal basis permits continued processing, such as compliance with a legal obligation, performance of a contract or protection of legal interests, Lawood may continue processing the relevant data on that basis.12. Right to Lodge a Complaint

If you believe that Lawood processes personal data contrary to applicable data protection legislation, you have the right to contact Lawood first so that we can assess the situation and, where necessary, remedy a potential violation.

You also have the right to lodge a complaint with a supervisory authority.

The supervisory authority responsible for personal data protection in Latvia is:

Datu valsts inspekcija (Latvian Data State Inspectorate)

Blaumaņa iela 11/13-15
Rīga, LV-1011
Latvia

Website: www.dvi.gov.lv

The Data State Inspectorate is Latvia's supervisory authority for personal data protection.

13. Automated Decision-Making and Profiling

Lawood does not currently make decisions about customers based solely on automated personal data processing, including profiling, that produce legal effects or similarly significantly affect them.

Analytics, advertising, marketing and other technological solutions used by Lawood may, in certain circumstances, involve automated processing or profiling, for example to analyse website use, assess advertising campaign effectiveness or provide personalised advertising.

Such processing does not in itself produce legal effects or similarly significant effects on customers.

If Lawood introduces automated decision-making or profiling that produces such effects in the future, it will provide information about the nature, purpose and consequences of the processing and the customer's rights before processing begins, in accordance with applicable law.

14. Cookies and Similar Technologies

The Lawood website may use cookies and similar technologies to:

• ensure website functionality;
• remember user preferences;
• improve website usability;
• analyse website visits and activity;
• provide advertising and marketing features;
• support external services used by Lawood.

Some cookies may be necessary for the technical operation of the website or to provide features specifically requested by users.

Other cookies, including analytics, advertising, marketing or other cookies requiring consent under applicable law, are used only after the relevant consent has been obtained.

Lawood may use cookies and similar technologies associated with services provided by Google, Meta, Microsoft, Tawk.to and other technology and service providers.

Users may manage their cookie preferences where relevant cookie management tools are available on the Lawood website. They may also adjust cookie settings in their browsers.

Detailed information about the cookies used by Lawood, their types, purposes, retention periods and third parties is or will be provided in a separate Cookie Policy.

15. Providing Personal Data and Placing Orders

Certain personal data must be provided for Lawood to receive, process and fulfil orders.

This information may be required to:

• identify the customer;
• communicate about the order;
• prepare an invoice;
• receive and identify payments;
• arrange delivery;
• fulfil other order-related obligations.

If a customer does not provide the personal data necessary for order fulfilment, Lawood may be unable to accept, process or fulfil the order or provide the requested service.

The amount of data required depends on the order, payment method, delivery method and other relevant circumstances.

Information not necessary for an order or other service may be provided voluntarily.

Customers are not required to consent to processing unrelated to order fulfilment, such as direct marketing, in order to purchase from the Lawood online store where such processing requires consent.

16. Personal Data of Minors

The Lawood online store is not specifically intended for children. Lawood does not knowingly collect children's personal data for purposes unrelated to providing a particular service or fulfilling an order.

If a minor places an order, requirements concerning the minor's legal capacity to enter into contracts and, depending on the circumstances, the involvement of a parent or legal representative may apply.

If Lawood becomes aware that personal data has been collected from a child in a manner or for a purpose inconsistent with applicable law, it takes the necessary measures to delete or otherwise process the data in compliance with legal requirements.

Age-Restricted Products

Where Lawood offers products that may only be purchased or received by persons of a certain age, it may verify age and, where necessary, identity in accordance with the product and applicable law.

In such cases, the date of birth, age or other information necessary for identity or age verification may be requested, but only to the extent necessary to meet the relevant requirement.

17. Communication with Lawood and Customer Support

Lawood may use various communication channels for customer service, including:

• email;
• telephone;
• Tawk.to live chat;
• WhatsApp;
• social media;
• other communication solutions used by Lawood.

When contacting Lawood, the personal data voluntarily provided during communication may be processed, including names, email addresses, telephone numbers, order information and message content.

Lawood uses Tawk.to to provide live chat. Tawk.to may process information provided during conversations and certain technical information necessary for the service to function.

If a customer voluntarily provides their name, email address, telephone number or other information in Tawk.to chat, that information may be processed to facilitate communication and customer support.

Lawood does not use customer communication data for purposes unrelated to the communication or other lawful purposes described in this Privacy Policy unless another legal basis exists.

18. Payments and Payment Service Providers

The Lawood online store may offer different payment methods provided by Lawood or external payment service providers.

To facilitate the selected payment method and identify the payment, Lawood may process order and payment information, including:

• order number;
• payment amount;
• payment status;
• payment date;
• payer information insofar as necessary to identify the payment and fulfil the order.

Where an external payment service provider processes payments, the data required to complete the payment is transferred to that provider.

Lawood does not store complete payment card details where payment processing and storage are handled by an external provider. In such cases, card data is processed within the payment service provider's system.

19. Delivery and Order Fulfilment

To fulfil orders and deliver products, Lawood may process:

• the recipient's first name and surname;
• telephone number;
• email address;
• delivery address;
• selected parcel locker or collection point details;
• other information required for the chosen delivery method.

Data necessary for delivery may be disclosed to couriers, parcel locker operators and other delivery service providers used by Lawood.

The amount of data disclosed depends on the delivery method. Lawood provides only the data necessary to deliver the relevant order.

To enable order tracking and delivery status notifications, Lawood or the delivery provider may use customer contact information, such as a telephone number or email address.

Delivery providers may also process the personal data received under their own terms and privacy policies.

20. Reviews and Customer-Submitted Information

Where the Lawood website or other channels offer the possibility to submit:

• reviews;
• comments;
• ratings;
• photographs;
• other customer-provided materials,

Lawood may process the information customers choose to submit.

Before submitting a review or other publicly accessible content, customers should consider whether it contains another person's personal data or information they do not wish to make public.

Lawood may use submitted content for the purpose for which it was provided, such as publishing reviews, improving customer experience or evaluating product and service quality.

21. Social Media

Lawood uses social media platforms, including Facebook, Instagram and TikTok.

Through social media, Lawood may:

• publish information about products and services;
• communicate with customers;
• respond to comments and messages;
• organise competitions and promotions;
• publish customer-submitted content where an appropriate legal basis exists;
• use advertising and marketing features.

When you communicate with Lawood through social media, the information you provide may also be accessible to the relevant platform.

Social media platforms also process personal data as independent controllers under their own privacy policies and terms.

22. Direct Marketing and Advertising

Lawood may process customer personal data for direct marketing and advertising, including sending information about:

• products;
• special offers;
• discounts;
• news;
• promotions;
• other Lawood offers.

Electronic commercial communications are sent only where an appropriate legal basis exists under applicable law.

You may object to the use of your personal data for direct marketing at any time.

Lawood may use technologies provided by external advertising, analytics and marketing service providers to display advertising, evaluate campaign effectiveness or, where applicable and supported by an appropriate legal basis, provide personalised advertising.

23. Personal Data Breaches

If Lawood identifies a personal data breach, it assesses the nature, extent, potential consequences and risks to individuals' rights and freedoms and takes the necessary steps to address the breach and mitigate its effects.

Where a breach may pose a risk to individuals' rights and freedoms, Lawood acts in accordance with applicable legal requirements, including notifying the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, where required.

Where a breach is likely to result in a high risk to individuals' rights and freedoms, Lawood also informs the affected individuals without undue delay where required by applicable law.

Lawood documents identified personal data breaches and the measures taken in accordance with applicable requirements. The Latvian Data State Inspectorate states that controllers' breach notification obligations are established by Article 33 of the GDPR.

24. Data Protection Officer

Lawood has not currently appointed a separate Data Protection Officer (DPO), as its current personal data processing activities do not fall within the circumstances in which appointment is mandatory under applicable law.

For questions about personal data processing, exercising your rights or other privacy-related matters, please contact Lawood using the contact details in this Privacy Policy.

If Lawood's operations or processing activities change in the future so that appointing a DPO becomes mandatory or appropriate, Lawood will assess the need for such an appointment.

25. Changes to This Privacy Policy

Lawood may periodically update or amend this Privacy Policy to reflect changes in its operations, services and technologies, personal data processing activities or applicable legislation.

The current version is always available on the Lawood website.

Where changes are material and applicable law requires specific notification, Lawood takes the necessary steps to inform customers.

The date of the latest update is indicated at the beginning or end of the Privacy Policy.

26. Scope of This Privacy Policy and Contact Information

This Privacy Policy applies to personal data processing carried out by Lawood in connection with:

• operation of the Lawood online store;
• use of the website;
• order processing;
• product sales;
• payments;
• delivery;
• customer service;
• communication;
• social media;
• analytics;
• advertising and marketing;
• other activities described in this Privacy Policy.

Where a service or technological solution used by Lawood has its own privacy policy or additional information about personal data processing, that information may supplement this Privacy Policy in relation to the specific service.

For questions about personal data processing, exercising your rights or other privacy-related matters, please contact:

SIA Lawood Base

Registration number: 40103821243
VAT registration number: LV40103821243
Registered address: Rīgas iela 14-11, Ropaži, Ropažu pag., Ropažu nov., LV-2135, Latvia
Email: [email protected]
Telephone: +371 20577992

Need Help?

If you have questions about this Privacy Policy or personal data processing, or wish to exercise your data subject rights, please contact us:

Email: [email protected]
Telephone: +371 20577992

We will be happy to assist you and provide the necessary information.