Privacy Policy

Effective from 6 October 2026.

1. Controller and contact details

This policy explains how I Smart SIA processes personal data through panelcraft.eu, smartmaja.lv, smartbee.lv and smarteg.lv, and in connection with orders, customer support and installation services. The same controller operates all four websites.

  • Controller: I Smart SIA, registration No. 40203423730, VAT No. LV40203423730.
  • Registered address: Komētas iela 32-4, Rīga, LV-1004, Latvia.
  • Collection point and shop: Mūkusalas iela 47, Rīga, Latvia.
  • Email: [email protected]; telephone: +371 2981 6769.

No data protection officer has been appointed. Please contact the controller directly using these details for privacy enquiries and requests concerning your rights.

2. Personal data we process

We process information necessary for the relevant purpose. Depending on the service, this may include:

  • name, email, telephone number, delivery and billing addresses, and business and representative details;
  • purchased products, services, amounts, invoices, payment status, transaction references and information needed for refunds;
  • account registration and authentication details, order history and preferences;
  • correspondence, enquiries, warranty and return documents, installation addresses and information supplied for quotations;
  • IP address, browser and device information, access times, security events, cookie identifiers and, with consent, website usage and advertising interaction data.

We obtain information from you, through website use, and from your selected payment or delivery providers, for example payment and delivery status. Please avoid sending sensitive information unless necessary for your enquiry.

3. Purposes and legal bases

We apply the General Data Protection Regulation (GDPR). The references below are to Article 6(1); each basis applies to the corresponding processing activity.

  • Taking and fulfilling orders, order communications, delivery and payment processing: entering into and performing a contract, point (b).
  • Preparing invoices and retaining accounting documents: legal obligations, point (c), including Latvia’s Accounting Law, Grāmatvedības likums.
  • Guest checkout and creating and maintaining an account you choose to open: point (b).
  • Customer enquiries, warranties, withdrawal rights, returns and refunds: point (b) for contractual responsibilities and point (c) for statutory obligations. Establishing and defending claims relies on point (f); our legitimate interest is protecting our rights and resolving disputes.
  • Newsletters and promotional messages: your consent only, point (a).
  • Google Analytics 4 analytics and Google Ads advertising measurement and personalisation: consent to the relevant cookie category, point (a).
  • Website security, preventing abusive bots and fraud, and using technical logs: point (f). Our legitimate interests are protecting websites, transactions and users’ data and maintaining service availability.
  • Preparing quotations at your request and arranging and performing installation work: pre-contractual steps and contract performance, point (b).

For legitimate-interest processing, we assess necessity and the impact on your rights. This basis does not replace consent required for advertising cookies.

4. Whether you must provide information

Information needed for an order, delivery, payment or installation is required to enter into or perform the relevant contract. Billing information may also be legally required. Without it, we may be unable to provide the service or properly document the transaction.

An account is optional when using guest checkout. Newsletter, analytics and advertising consent is voluntary; refusal does not prevent purchases. Additional information is needed only where relevant to handling your particular request.

5. Recipients

We disclose only information necessary for the task, depending on your selected service and the functionality available:

  • Payments: Stripe Payments Europe Ltd, Ireland; Paysera LT UAB, Lithuania; Montonio Finance UAB for bank payment links.
  • Delivery: AS Eesti Post / Omniva and the courier handling delivery.
  • Hosting: Hostinger, using VPS infrastructure in the European Union.
  • Content delivery and protection: Cloudflare Inc.
  • Analytics and advertising with consent: Google Ireland Ltd through Google Analytics 4 and Google Ads.
  • Email delivery: our email service provider.
  • Legally required disclosures: Latvia’s State Revenue Service (VID) and other competent authorities.

Accounting and ERP records are managed through an internal system. Authorised personnel access data for their duties. Providers may act as our processors or as independent controllers for their own statutory and service responsibilities. Data processing agreements govern processors’ obligations. We do not sell personal data.

6. Transfers outside the EEA

Cloudflare, Google and Stripe services may involve processing outside the European Economic Area, including the United States. EU hosting does not itself exclude access by support teams or subprocessors elsewhere.

Transfers rely on an applicable European Commission adequacy decision or appropriate safeguards, such as Standard Contractual Clauses and necessary supplementary measures. The EU–US Data Privacy Framework applies only where the recipient’s certification covers the transfer and the relevant adequacy decision remains valid. Contact [email protected] for details of a particular transfer and a copy of the relevant safeguards.

7. Retention

  • Order data: up to five years after fulfilment, except information required for accounting or a specific claim.
  • Invoices and other accounting source documents: at least five years, and longer where transaction traceability or applicable law requires. Certain accounting document categories have longer mandatory periods.
  • Account data: until account deletion or three years of inactivity. Deleting an account does not remove documents retained on another legal basis.
  • Information used for newsletters: until consent is withdrawn.
  • Security logs: up to 12 months; records concerning a particular incident may be retained as necessary for investigation and related claims.
  • GA4 user and event data: according to the 14-month retention setting; renewal of user-data retention depends on the configuration.
  • Correspondence, warranty, return and installation records: until the matter is resolved and obligations are fulfilled; longer only for an applicable duty or claim.

Minimal evidence of consent or withdrawal may be retained as necessary to demonstrate compliance. This does not permit further marketing. When retention is no longer justified, we delete or irreversibly anonymise data.

8. Cookies and consent choices

Only necessary cookies operate without consent, covering the basket, session, your selected language and security insofar as needed for your requested service. Analytics and marketing cookies operate only after the relevant consent.

You can withdraw consent through the cookie choices available on the website. Browser settings also allow you to block or delete cookies; blocking necessary cookies may affect the basket or account. Contact us if you need assistance. Unsubscribe from newsletters through the link in a message or by emailing [email protected]. Withdrawal does not affect the lawfulness of earlier processing.

9. Your rights

Subject to GDPR conditions, you may:

  • obtain information about processing, access your data and receive a copy;
  • correct inaccurate data and complete missing information;
  • request erasure or restriction where the relevant conditions apply;
  • receive data you provided in a structured, commonly used, machine-readable format where automated processing relies on consent or a contract;
  • object to legitimate-interest processing because of your particular situation;
  • withdraw consent at any time and object to direct marketing free of charge.

We stop direct-marketing processing when you object. Other legitimate-interest processing continues only where overriding grounds or legal claims justify it. Mandatory retention obligations may limit erasure.

10. Requests and complaints

Email [email protected] describing your request. Where necessary, we may seek proportionate additional information to verify identity. We respond without undue delay and within one month. Complexity or the number of requests may require an extension of up to two further months; we explain this within the first month. Exercising rights is normally free.

You may complain to Latvia’s Data State Inspectorate, Datu valsts inspekcija: Elijas iela 17, Rīga, LV-1050; www.dvi.gov.lv, or another competent EU/EEA supervisory authority. You need not contact us first.

11. Automation, children and changes

We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. Consent-based advertising personalisation may involve assessing interests, but does not produce such effects.

Services are not intended for children under 13. Contact us if a child has supplied personal data so we can assess its deletion.

We may update this policy when services or requirements change. The current version date appears above. Before processing for a new purpose, we will provide the necessary information and obtain fresh consent where required.

Change cookie settings

Back to top