Privacy Policy

1. Definitions

1.1. Controller (personal data controller) – SIA “KANAKS”, registration No. 45403034175, VAT No. LV45403034175, registered address: Akadēmijas laukums 1 – 1, Riga, LV-1050, Latvia. Telephone: +371 22336465, email: info@nanogo.lv.

1.2. Customer (data subject) – a natural person who visits the Online Store, registers, makes a purchase or submits a notice of withdrawal from a contract.

1.3. Online Store – the Controller’s online shop at https://nanogo.lv.

1.4. Personal data – any information relating to an identified or identifiable natural person (data subject).

1.5. Processing – any operation or set of operations performed on personal data (collection, recording, storage, alteration, use, disclosure, erasure, etc.).

1.6. Cookie – a small text file stored on the Customer’s device when visiting a website.

1.7. Direct marketing – activities intended to offer goods or services and/or obtain the Customer’s opinion about them.

1.8. Withdrawal form – the Online Store’s electronic form enabling the Customer to give notice of withdrawal from a distance contract: https://nanogo.lv/atteikties-no-liguma/ .

2. General provisions

2.1. This Privacy Policy establishes the principles and procedures applied by the Controller when processing personal data in connection with the Customer’s use of the Online Store.

2.2. Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR), the Personal Data Processing Law of the Republic of Latvia and other applicable legislation.

2.3. The Controller processes personal data in accordance with the following principles:

2.3.1. lawfully, fairly and transparently in relation to the data subject;
2.3.2. data are collected for specified, explicit and legitimate purposes;
2.3.3. processing is adequate, relevant and limited to what is necessary for those purposes;
2.3.4. data are accurate and kept up to date;
2.3.5. data are retained no longer than necessary for the purposes of processing;
2.3.6. data are protected by appropriate technical and organisational measures.

2.4. By making a purchase or registering with the Online Store, the Customer acknowledges having read this Privacy Policy.

2.5. The Controller may amend this Privacy Policy. The current version is always available in the Online Store.

3. Purposes, legal bases and scope of personal data processing

3.1. Order fulfilment (e-commerce)

Purpose: placing and paying for orders, delivering goods and providing customer service.

Legal basis: Article 6(1)(b) GDPR (performance of a contract).

Data processed: first and last name, email address, telephone number, delivery address, IP address, payment information (bank account, payment method) and purchase history.

Retention period: 5 (five) years from the last purchase or last login to the Online Store.

3.2. Direct marketing

Purpose: sending news, offers and promotions.

Legal basis: Article 6(1)(a) GDPR (Customer’s consent).

Data processed: first and last name, email address and telephone number.

Retention period: until consent is withdrawn or 5 (five) years from the last login.

3.3. Accounting and tax obligations

Purpose: preparing and retaining accounting documents.

Legal basis: Article 6(1)(c) GDPR (legal obligation).

Retention period: in accordance with Latvian legislation (up to 10 years).

3.4. Operation and improvement of the Online Store

Purpose: ensuring the website’s technical operation and security, fixing errors and improving user experience.

Legal basis: Article 6(1)(f) GDPR (Controller’s legitimate interests) for technical operation and security. Where consent is required for analytics or marketing technologies, processing is based on Article 6(1)(a) GDPR and takes place only after such consent has been obtained.

Data processed: IP address, device and browsing data, technical log data and data from cookies or similar technologies in accordance with the Customer’s cookie preferences.

3.5. Withdrawal from a distance contract (withdrawal form)

Purpose: receiving, registering and reviewing the Customer’s notice of withdrawal, sending confirmation of receipt, administering returns and refunds, and handling possible legal claims.

Legal basis: Article 6(1)(c) GDPR (legal obligation to enable the exercise of consumer withdrawal rights under the Consumer Rights Protection Law and Cabinet Regulations on distance contracts) and Article 6(1)(f) GDPR (Controller’s legitimate interests in establishing, exercising or defending legal claims). Separate consent is not required for this processing.

Data processed: first and last name, email address, telephone number (if supplied), order or invoice number, goods covered by the withdrawal and its extent, date of receipt (if supplied), additional information provided by the Customer, notice number, submission date and time, processing status and correspondence about the notice. If the Customer submits the form while logged in, the notice is linked to the Customer’s account and relevant order.

The IP address is used solely for temporary (up to 1 hour) rate limiting of excessive form submissions and is not stored with the notice.

Recipients: hosting and email service providers (section 4.1.3); for refunds, the payment service provider (section 4.1.2); for returns, the delivery service provider (section 4.1.1).

Retention period: 3 (three) years after the notice has been fully processed (refund issued, notice rejected or case closed). Notices that are still being processed are not deleted. Accounting documents relating to refunds are retained in accordance with section 3.3.

The withdrawal form is not the only way to withdraw from the contract. An unequivocal notice may also be sent to info@nanogo.lv or submitted by another method specified in the Terms and Conditions.

3.6. Provision of personal data and automated decision-making

3.6.1. Data marked as mandatory for placing an order or submitting the withdrawal form are necessary to conclude and perform the contract or to process the withdrawal notice. If these data are not provided, the Controller cannot process the order or form. The Customer may still withdraw by the alternative methods described in section 3.5.

3.6.2. The Controller does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on the Customer (Article 22 GDPR).

4. Disclosure of personal data to third parties

4.1. To the extent necessary for the relevant purpose, the Controller may share the Customer’s personal data with:

4.1.1. Delivery service providers: Latvijas Pasts, Omniva, Unisend – for delivery and returns;
4.1.2. Payment service provider: Montonio Finance UAB (registration No. 305205122, Konstitucijos pr. 7, Vilnius, Lithuania, compliance@montonio.com, https://montonio.com/lv/) – for processing payments and refunds;
4.1.3. IT service providers: hosting, email and analytics providers – for website operation;
4.1.4. Public authorities: where and as required by Latvian law.

4.2. The Controller does not disclose personal data to third parties without a lawful basis.

4.3. Where personal data are transferred outside the European Economic Area (EEA), the Controller ensures appropriate protection under Chapter V GDPR.

5. Rights of the data subject

5.1. The Customer has the following rights as a data subject:

5.1.1. Right of access (Article 15 GDPR) – to obtain confirmation of whether personal data are processed and to receive a copy;
5.1.2. Right to rectification (Article 16 GDPR) – to request correction of inaccurate data;
5.1.3. Right to erasure (Article 17 GDPR) – to request deletion of data where no lawful basis for processing remains;
5.1.4. Right to restriction (Article 18 GDPR) – to request restricted processing in certain cases;
5.1.5. Right to data portability (Article 20 GDPR) – to receive data in a structured, commonly used and machine-readable format;
5.1.6. Right to object (Article 21 GDPR) – to object to processing based on legitimate interests, including direct marketing;
5.1.7. Right to withdraw consent – at any time, without affecting the lawfulness of processing before withdrawal.

5.2. To exercise these rights, the Customer should email info@nanogo.lv . The Controller responds without undue delay and within one month of receiving the request. This period may be extended by a further two months where necessary due to complexity or number of requests, with notice within the first month (Article 12(3) GDPR). The Controller may request proof of identity before fulfilling the request.

5.3. If the Customer believes their rights have been infringed, they may lodge a complaint with the Data State Inspectorate (DVI), Elijas iela 17, Riga, LV-1050, Latvia; telephone +371 67223131; website: www.dvi.gov.lv .

5.4. The Controller may refuse to erase data submitted through the withdrawal form during the retention period specified in section 3.5 where the data are necessary to comply with a legal obligation or establish, exercise or defend legal claims (Article 17(3)(b) and (e) GDPR). The Customer will be informed accordingly.

6. Direct marketing

6.1. The Customer may voluntarily consent to receiving direct marketing communications (news, offers and promotions).

6.2. The Customer may withdraw consent to direct marketing at any time:

6.2.1. by emailing info@nanogo.lv with a request to withdraw consent;
6.2.2. by clicking the “Unsubscribe” link in any marketing email.

6.3. After consent is withdrawn, the Controller stops processing personal data for direct marketing. The Customer will continue receiving messages about order fulfilment and withdrawal notices, as these are not direct marketing.

7. Cookies

7.1. The Online Store uses cookies to operate the website, improve user experience and analyse visitor statistics.

7.2. Types of cookies used:

7.2.1. Necessary cookies – support essential functions, security, login, shopping cart and language selection. Where a cookie is strictly necessary to provide a requested service, separate consent is not required.
7.2.2. Analytics cookies – help analyse website traffic and usability. They are used only with the Customer’s consent where applicable law requires it.
7.2.3. Marketing cookies – are used to measure advertising performance, show personalised content or advertising and analyse user interactions. They are used only with the Customer’s consent where applicable law requires it.

7.3. The Customer may change or withdraw consent for non-essential cookies at any time using the cookie consent management tool available on the website. Withdrawal does not affect the lawfulness of processing before withdrawal.

7.4. Disabling necessary cookies in browser settings may affect the functionality of the Online Store.

7.5. Detailed information on the cookies used by the Online Store, their purposes, retention periods and providers is available in the Cookie Policy .

8. Personal data security

8.1. The Controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, accidental or unlawful destruction, alteration, disclosure or other unlawful processing.

8.2. The Customer is responsible for keeping their Online Store account credentials (email and password) secure and must not disclose them to third parties.

9. Final provisions

9.1. This Privacy Policy is drawn up and applied in accordance with the GDPR and Latvian law.

9.2. The Controller may amend this Privacy Policy. Changes take effect upon publication in the Online Store.

9.3. For enquiries, contact telephone +371 22336465 or email info@nanogo.lv .