Privacy policy

Data controller

Controller: SIA "MONOLITH BALTIC".

Registration number: 40203040239. VAT number: LV40203040239. Legal address: Dignājas iela 4-15, Rīga, LV-1004. Contact phone: +371 29395194. Email: info@monolith-baltic.eu.

Personal data we process

This policy applies to personal data about customer representatives, account users, delivery contacts and other persons who communicate with us on behalf of a legal entity.

We process identification and contact data (name, surname, email address and telephone number); company and authority data (company name, registration and VAT numbers, role and account status); legal, billing and delivery addresses, delivery contact details, goods-receiving hours and delivery instructions; account and security data (password hash, email-verification and password-reset records, session identifiers and audit records); and order and commercial data (cart and wishlist contents, products, quantities, prices, discounts, VAT treatment, order status, invoices, payment and fulfilment information, comments, references, correspondence and claims). We do not collect payment-card details because payment is made by bank transfer.

We receive data directly from you or another representative of your company, from the actions performed in the online store and, where necessary to verify a company or authority, from public registers and other lawfully available sources.

Fields marked as required are necessary to create and administer an account, verify the customer, process an order or arrange delivery. Without those data, we may be unable to approve an account, conclude or perform a contract, or deliver goods.

Purposes and legal bases

We register and administer accounts, verify companies and user authority, communicate with customer representatives, process and perform orders, arrange collection or delivery, and provide support on the basis of our legitimate interests in establishing and managing commercial relationships with legal entities (Article 6(1)(f) GDPR). Where the data subject is personally a party to a contract, Article 6(1)(b) GDPR also applies.

We issue and retain invoices and other accounting or tax records, and disclose information to competent authorities where required, to comply with legal obligations (Article 6(1)(c) GDPR).

We maintain service and account security, prevent unauthorised access and fraud, keep proportionate audit evidence, recover debts and establish, exercise or defend legal claims on the basis of our legitimate interests in protecting the service, our property and legal rights (Article 6(1)(f) GDPR).

If we request consent for an additional purpose, the request will identify that purpose and consent may be withdrawn at any time without affecting processing carried out before withdrawal. The online store currently does not use personal data for marketing or advertising profiling.

Recipients and retention

Access is limited to authorised Monolith Baltic staff and, where necessary, providers of website hosting, database and object storage, transactional email, IT support and security, carriers and logistics providers, accountants, banks, auditors, legal advisers and competent public authorities. Providers acting on our behalf may process data only under our instructions and appropriate contractual confidentiality and data-protection obligations.

We primarily use service infrastructure in the European Economic Area. If a provider processes data outside the EEA, we use an applicable adequacy decision or safeguards under Chapter V GDPR, such as the European Commission's standard contractual clauses, and supplementary safeguards where required. Information about the safeguards or a copy of them may be requested from us.

Unapproved or abandoned registration data is retained for up to 90 days after rejection or the last registration activity. Account and company-contact data is retained while the account or commercial relationship is active and for up to three years afterward, unless it forms part of records subject to a longer legal period. Order, invoice, delivery and related accounting records are retained for at least five years, or longer where required by tax, accounting, audit or legal-claim obligations. Support correspondence and claims are normally retained for up to three years after the matter is closed. Security logs not forming part of an order or legal claim are retained for up to 12 months. Data connected with a dispute, investigation or unpaid obligation may be retained until the matter is finally resolved and the applicable claim period has expired. Data is then deleted or irreversibly anonymised unless continued retention is required by law.

Cookies

The online store uses the strictly necessary mb_session cookie for a secure authenticated session and the mb_storefront_lang cookie to remember the selected language. The authentication-session cookie is retained for no more than 30 days, and the language-preference cookie for no more than one year. The storefront application does not use analytics or marketing cookies.

Your rights and contacts

Subject to the conditions and exceptions in the GDPR, you may request access to and a copy of your personal data, correction, deletion, restriction of processing or data portability, and may object to processing based on legitimate interests. You may withdraw consent at any time where consent is used. There is no solely automated decision-making, including profiling, that produces legal or similarly significant effects for online-store users.

To exercise your rights or ask a privacy question, contact info@monolith-baltic.eu. We may request information necessary to verify your identity and will normally respond within one month.

You also have the right to lodge a complaint with the Latvian supervisory authority: Datu valsts inspekcija, Elijas iela 17, Rīga, LV-1050, Latvia; email pasts@dvi.gov.lv; telephone +371 67223131; website www.dvi.gov.lv. We encourage you to contact us first so that we can address the issue promptly.