SIA “ROSEART” is committed to protecting the privacy and personal data of its customers and website visitors.

We process only the personal data necessary to fulfil orders, provide customer service, operate the Website and for the other purposes described in this Privacy Policy.

This Privacy Policy explains what personal data we collect, why we use it, who we may share it with, how long we retain it and what rights you have.

1. DATA CONTROLLER

The data controller is:

SIA “ROSEART”
Registration No.: 42103106890
Registered address: Baltezera iela 7–24, Riga, LV-1024, Latvia
Online store: www.infinityroze.lv
Email: info@infinityroze.lv
Phone: +371 27570057

The online store operates under the INFINITY ROZE brand.

For questions regarding the processing of personal data, you can contact us at info@infinityroze.lv.

2. PERSONAL DATA WE MAY PROCESS

Depending on how you use our Website and services, we may process:
- your first and last name;
- email address;
- phone number;
- delivery and billing address;
- company name and other company details if you provide them;
- information about products and additional options you order;
- order number, amount, delivery method and order status;
- payment status information;
- information entered in the comment field;
- customer account information if you create an account;
- information relating to your use of the loyalty programme;
- correspondence and customer support information;
- reviews, ratings, photographs or videos you submit;
- IP address and technical information about your device and browser;
- information about your use of the Website collected through cookies or similar technologies.
If an order is sent to another person as a gift, we may also process the recipient's name, phone number and delivery address provided by you solely for the purpose of delivering the order.

3. HOW WE COLLECT PERSONAL DATA

We mainly collect personal data:
- from you when you place an order;
- when you create a customer account;
- when you subscribe to newsletters or other marketing communications;
- when you participate in our loyalty or referral programme;
- when you submit a review;
- when you contact us by email, phone or through the Website;
- automatically when you use the Website and cookies;
- from payment or delivery service providers to the extent necessary to confirm payment or delivery status.

4. WHY AND ON WHAT LEGAL BASIS WE PROCESS PERSONAL DATA

4.1. Processing and fulfilling orders
We process your name, contact details, delivery address, order information and other data necessary to:
- accept and process your order;
- prepare your product;
- process payment;
- arrange delivery;
- provide order status updates;
- provide customer service.
Legal basis: Article 6(1)(b) of the General Data Protection Regulation — performance of a contract or steps taken prior to entering into a contract.
4.2. Accounting and legal obligations
We process and retain certain order and transaction information to comply with accounting, tax and other applicable legal obligations.

Legal basis: Article 6(1)(c) GDPR — compliance with a legal obligation.
4.3. Customer accounts, loyalty programme and other customer services
If you create a customer account or use our loyalty programme, we process the data necessary to provide the relevant service, for example information about your account and awarded points.

Legal basis: Article 6(1)(b) GDPR.
4.4. Customer communication and enquiries
If you contact us with a question or other request, we use the information you provide to respond and address the matter.

Depending on the nature of the request, the legal basis may be performance of a contract, compliance with a legal obligation or our legitimate interest in providing customer service and protecting our legal interests.
4.5. Marketing communications
If you have consented to receive INFINITY ROZE news, offers or other marketing communications, we may use your email address or other contact details you have provided for this purpose.

Legal basis: Article 6(1)(a) GDPR — your consent.

You may unsubscribe from marketing communications at any time by using the unsubscribe link in the relevant message or by contacting us at info@infinityroze.lv.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
4.6. Reviews
If you submit a review, rating, photograph or video for publication on the Website, we process the information you provide in order to publish and manage the review.

Where personal data is included in a review, it is published in accordance with the information and choices you provide.
4.7. Website security and fraud prevention
We may process technical information, such as your IP address and information about your use of the Website, in order to:
- protect the Website;
- prevent fraudulent activity;
- identify technical problems;
- protect our rights and the rights of our customers.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in maintaining the secure operation of our online store.

5. PAYMENTS

Online payments are provided by Maksekeskus AS / MakeCommerce.

Information required to process a payment is transferred to the relevant payment service provider.

Payment card details and online banking authentication information are entered in the payment service provider's secure payment environment.

INFINITY ROZE receives only the information necessary to confirm the status of the order and payment.

6. WHO WE MAY SHARE PERSONAL DATA WITH

We share personal data only to the extent necessary to provide the relevant service.

Recipients may include:
- online store, hosting and technical infrastructure service providers;
- payment service providers;
- delivery and courier service providers;
- accounting service providers;
- IT, cloud, email and customer communication service providers;
- analytics and advertising service providers where there is an appropriate legal basis for such processing;
- public authorities and law enforcement agencies where required by law.
Service providers processing personal data on our behalf process it in accordance with our instructions and applicable data protection laws.

Certain service providers, such as payment service providers, may act as independent data controllers in relation to information they process to comply with their own legal obligations and provide their services.

7. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

Some of the technology service providers we use may process personal data in countries outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, appropriate safeguards under the GDPR are used, such as:
- a European Commission adequacy decision;
- European Commission-approved Standard Contractual Clauses;
- other transfer mechanisms permitted by applicable law.

8. COOKIES AND SIMILAR TECHNOLOGIES

The Website uses cookies and similar technologies.

Strictly necessary cookies are used to provide functions such as:
- shopping cart functionality;
- checkout;
- security;
- remembering language and other essential settings.
Analytics, functional and marketing cookies that require consent are used only after you have given your consent.

You can select or change your cookie preferences using the cookie settings available on the Website.

Information about specific cookies, their purposes and retention periods is available in the cookie settings or the Website's Cookie Policy.

9. PERSONAL DATA RETENTION

We do not retain personal data for longer than necessary for the relevant processing purpose or to comply with applicable legal obligations.
Order and accounting information
Accounting records are retained for the period required by applicable law. Relevant supporting accounting documents are generally retained for at least 5 years.
Customer account and loyalty programme data
Data is retained while your customer account or relevant service remains active and afterwards for as long as necessary to comply with legal obligations or protect legitimate interests.
Customer communications
Correspondence and enquiry information is retained for as long as necessary to address the relevant matter and protect our legitimate interests.
Marketing data
Data is used for marketing communications until consent is withdrawn or until there is no longer a need for the relevant processing.
Cookie data
Cookie retention periods are stated in the cookie settings or Cookie Policy.

After the applicable retention period expires, personal data is deleted or anonymised unless continued retention is required by law or necessary to protect legitimate interests.

10. PERSONAL DATA SECURITY

We use appropriate technical and organisational measures to protect personal data against:
- unauthorised access;
- disclosure;
- loss;
- accidental or unlawful destruction;
- unauthorised alteration or other unlawful processing.
Access to personal data is limited to persons and service providers who require it to perform their duties.

11. YOUR RIGHTS

Under the GDPR and depending on the circumstances, you have the right to:
- receive information about the processing of your personal data;
- access your personal data;
- request correction of inaccurate or incomplete personal data;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- in certain circumstances, receive your personal data in a structured format and transmit it to another controller;
- withdraw your consent at any time where processing is based on consent.
These rights are not absolute and may be restricted in certain circumstances by applicable law.

Questions and requests relating to the processing of personal data may be sent to: info@infinityroze.lv.

Where necessary, we may request additional information to verify the identity of the person making the request.

We will respond without undue delay and generally no later than one month after receiving the request.

If you believe that the processing of your personal data does not comply with applicable data protection law, you have the right to contact the Data State Inspectorate of Latvia (Datu valsts inspekcija).

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time, for example where our services, technologies or applicable legal requirements change.

The current version of the Privacy Policy will always be available on www.infinityroze.lv.

Where appropriate, we may also inform you of significant changes by other suitable means.

Last updated: 19 October 2026.