Your personal data.

Data controller

The data controller is Little Masterpieces, SIA, registration no. 40203762815, registered address: Brīvības gatve 257–4, Rīga, LV-1006. Send privacy enquiries and requests to sveiki@maziemeistardarbi.lv.

Data we use

We process your name, email, phone number, collection or delivery details, order choices, payment records and correspondence. When digitising artwork and preparing a proof, we also process images of the materials and your chosen text, which may contain personal data about a child or other family members.

Why the data is needed

Customer contact and order details are needed to enter into and perform the contract: to communicate, prepare the proof, record payment and hand over the finished work. We cannot fulfil an order without the necessary information. Accounting documents are processed to meet legal obligations.

Data needed for website security and dispute resolution is processed in our legitimate interests in protecting the website and documenting transactions. Provide only the materials needed for your order.

Where materials contain a child’s or another person’s data, we process them to prepare the order in our and the customer’s legitimate interests in preserving the supplied artwork in the chosen product, taking account of the person’s rights and especially children’s interests. The customer contract is not itself consent to publish another person’s data. Please do not submit sensitive information unnecessary for the order.

Keeping materials for repeat orders for up to 12 months and publishing them are separate purposes requiring separate consent. Neither consent is a condition of purchase. We do not make automated decisions with legal or similarly significant effects on you.

Use of family materials

We receive materials from the customer. Provide only artwork you are entitled to use. Where materials contain a child’s data, the order must be placed by their legal representative or an authorised person. For a school, kindergarten or other organisation, we agree the parties’ responsibilities and the lawful basis for supplying children’s data and informing the people concerned before receiving the materials. An organisation’s order does not grant us advertising permission.

Before publishing artwork images or proofs on our website, social media or in advertising, we separately agree the specific materials and use with the person entitled to give permission, including the child’s legal representative where applicable. We retain a verifiable consent record, for example in email or WhatsApp correspondence.

You can withdraw consent by emailing sveiki@maziemeistardarbi.lv; refusal does not affect your order. After withdrawal, we stop further use and remove the materials from channels we control to the extent covered by the withdrawn consent. Withdrawal does not affect the lawfulness of earlier processing. We do not currently send marketing emails; order notifications are not a marketing subscription.

Who may receive data

We keep the archive of scans and proofs on the company’s physical external hard drives, accessible only to authorised Mazie Meistardarbi personnel. This is separate from website order data.

Cloudflare provides website hosting, order-data storage and automated order emails. The email provider also processes correspondence, as does the WhatsApp provider if we communicate through WhatsApp. The bank and any accounting service we use receive payment and accounting data to the extent necessary.

If you pay by card, Apple Pay or Google Pay, we provide Stripe with your email address, order and payment identifiers, payment amount and an item or payment description to process the payment. You enter payment details on Stripe’s checkout page; we do not store the full card number or security code. Stripe also processes data needed for payment security and its own legal obligations under its privacy policy: https://stripe.com/privacy.

A service provider involved in producing the order receives only the files and information needed for production. Omniva or the selected carrier receives the contact and address details needed for delivery. We also disclose data to authorities where required by law. Such disclosure does not authorise recipients to use children’s artwork in their own advertising.

Data retention

We keep artwork scans, working proofs and their copies while fulfilling the order and for up to 90 days after you receive the finished order. After fulfilment, retention is based on our legitimate interests in investigating order quality and correcting potential errors. At the end of this period we delete them from our backups as well. For a cancelled order, this period starts when the cancellation settlement is completed.

Only with your separate consent do we keep files for repeat orders for up to 12 months from receipt of the finished order. You can withdraw consent earlier. Without consent or following withdrawal, the standard 90-day period applies; if it has already ended, we delete the files except for evidence needed for a specific unresolved claim. Consent to file retention is not consent to publication.

Proof videos and images sent during correspondence may also be present in our email and WhatsApp records. The same 90-day or separately agreed 12-month periods apply to these copies under our control. We may retain written proof approval separately from the image or video itself. We cannot delete copies received on the customer’s own device.

We retain order details and approval correspondence during fulfilment and for 2 years after receipt of the finished goods to handle claims; for a cancelled order, the 2 years start when the cancellation settlement is completed. If an unresolved claim arises within that period, we retain only the data needed for that matter until it is concluded. This may include the relevant proof; it does not extend retention of all other files.

We retain invoices and other accounting source documents for at least 5 years and longer where required by statutory transaction-traceability obligations. Artwork scans are not accounting records. Deleting archive files does not remove your right to report non-conforming goods.

Technical records needed to investigate a security incident or dispute are retained until that investigation and related claims are concluded, with restricted access and limited data. You can contact us about deletion of your order files or the applicable retention period.

International services

Website, payment, email, messaging and international delivery services may involve processing outside the European Economic Area. Such transfers require an applicable GDPR mechanism: a European Commission adequacy decision, standard contractual clauses with any necessary supplementary safeguards, or another mechanism applicable to the particular situation. You can ask us for information about recipients and safeguards relevant to your order.

Data in your browser

Your cart is stored in your browser for later visits. During order submission, entered order details, including contact information, are stored in the browser session so the submission result can be checked after an interruption and duplicate orders avoided. You can remove these through your browser’s site-data settings; this may clear your cart and prevent order recovery.

See our cookie policy for storage names, purposes and durations.

Website statistics and privacy choices

Only after your consent do we collect counts of public page views, navigation between pages, scroll depth and active viewing-time thresholds. This helps us understand useful content and improve the website. Statistics consent is not required for a purchase. Accept and decline options are equally accessible.

Our statistics system does not store visitor or session identifiers, IP addresses, search phrases, full URLs with query parameters, form content or screen recordings. Cart, order, payment and administration pages are excluded. We store only aggregate daily counters for predefined public page paths in Cloudflare D1 for up to 90 days. Technical processing necessary for site operation and security is independent of this choice.

Your choice is valid in this browser for 180 days, so we do not ask on every page. After expiry we stop using it and delete the entry when the website next checks it. You can withdraw consent at any time using “Privacy choices” in the footer or on the cookie policy page and selecting “Decline”. Further statistics collection in this browser stops immediately. Previously collected aggregate totals cannot be attributed to an individual visitor. Clearing browser site data also removes the saved choice.

Your rights

Subject to the General Data Protection Regulation, you may request access, correction, deletion, restriction of processing and data portability. You may also object to processing based on legitimate interests. Deletion is not always possible, for example where a legal obligation requires retention.

Write to sveiki@maziemeistardarbi.lv. We normally respond to a request within one month; if an extension is needed in the circumstances permitted by the Regulation, we explain it within that period. You may complain about personal data processing to Latvia’s Data State Inspectorate at www.dvi.gov.lv.