Privacy policy

• Your order. At checkout: name, email, phone, delivery method and country, parcel locker or address (street, city, postcode), whether to gift-wrap, and your notes. With them we keep the items, prices, payment method and status, and the language of the page. Purpose: to make and carry out the contract (GDPR Article 6(1)(b)), and afterwards to keep the records accounting law requires (Article 6(1)(c)).
• Payment. Card payments are handled by Stripe; we receive only the payment status, the amount and Stripe's payment reference, never card details. For a bank transfer we see the payer's name, account and the amount on our bank statement.
• Withdrawal. In the "Withdraw from a purchase" form: order number, name, email, the items, your reason (if you give one), the language and the time. To spot abuse we also keep a hash derived from your IP address (never the address itself). Purpose: to receive and confirm your withdrawal as the law requires (Article 6(1)(c)); the hash rests on our legitimate interests (Article 6(1)(f)).
• Messages. Through the contact form or by email: name, email, phone (if you give it) and the message. Purpose: to answer you (Article 6(1)(b) or (f)).
• Cart. The cart cookie holds only a random identifier; the list of items in the cart is kept with it. Until you order, it is not linked to your name.
• Technical data. When you open the site, the hosting and network providers (Render, Cloudflare) process your IP address and request data to deliver the page and protect it against attacks (Article 6(1)(f)).

• Render (Render Services, Inc.): hosting of the site; servers in Frankfurt, EU.
• Supabase (Supabase, Inc.): the database and the storage of product photos; Frankfurt, EU.
• Cloudflare (Cloudflare, Inc.): DNS for the domain, the network the site is delivered through, and sending order and contact emails (Cloudflare Email Service).
• SiteGround (SiteGround Spain S.L., Spain): the info@dunense.com mailbox where your messages arrive.
• An accounting service provider, if one is engaged: only the order and payment data the bookkeeping needs.

• Stripe (Stripe Payments Europe, Limited, Ireland), for card payments: the amount, your email and the card details you enter on Stripe's page. Stripe processes some data (for example to prevent fraud) as a controller in its own right; see Stripe's privacy policy.
• Omniva, Venipak or Latvijas Pasts, depending on the delivery you choose: name, phone, email and the parcel locker or address, to deliver your parcel.
• Banks, for bank transfers.
• Public authorities, only where the law requires it (for example the State Revenue Service).

Our data is stored in the EU. Render, Supabase, Cloudflare and Stripe belong to groups based in the United States, so access from outside the EEA is possible, for example for technical support. Such transfers are protected by the EU–US Data Privacy Framework and/or the European Commission's standard contractual clauses.

• Orders, their payments, withdrawals and complaints: 5 years, because Article 28 of the Latvian Accounting Law requires source documents to be kept for at least five years. Then we delete them.
• Messages: until the matter is settled and the message is no longer needed; if it concerns an order, together with the order.
• Copies of sent emails (order confirmations and notices): 90 days, so they can be resent if delivery fails.
• Technical logs at Render and Cloudflare: briefly, under those providers' terms.
• Cart: the cart cookie lasts 60 days.

You may ask for access to your data and a copy of it, its correction or deletion, restriction of processing and data portability, and you may object to processing based on our legitimate interests. Data the law requires us to keep cannot be deleted before its period ends. Write to info@dunense.com; we answer within one month.

If you think your data is handled wrongly, you may complain to the Latvian Data State Inspectorate: www.dvi.gov.lv.

We use only technically necessary cookies. See the cookie policy.

If this policy changes, the new version is published on this page. This version applies from 16 November 2026.