Version effective from 2 October 2026.

1. Personal data controller

The personal data controller is SIA “BRT”, registration No. 40103690544, Ķengaraga iela 4, Rīga, LV-1063, e-mail: info@brt.lv, phone: +371 66066527.

SIA “BRT” processes personal data to operate the e.brt.lv online store, fulfil orders, provide customer service and administer related processes.

2. Personal data processed

Depending on the person’s interaction with BRT, the following data may be processed:

• first and last name;
• company name;
• registration number and VAT number, where provided;
• address;
• telephone number;
• e-mail address;
• information about orders, goods, prices, delivery and order history;
• payment method, status and amount, and transaction identifiers provided by the payment service provider;
• account and technical authentication data;
• correspondence, enquiries, reviews, complaints and claims;
• IP address, browser and device data;
• technical logs and security data;
• information required for operation of technical cookies.

Where payment is made in an external payment environment, payment-instrument data are processed by the relevant payment service provider. BRT receives only the payment information necessary to confirm and fulfil the order.

3. Purposes and legal bases of processing

• placing, processing and fulfilling an order — entering into and performing a contract;
• arranging payment and delivery — entering into and performing a contract;
• invoicing, accounting and tax records — compliance with a legal obligation;
• handling enquiries, complaints and claims — performance of the contract and compliance with legal obligations;
• establishing, exercising or defending legal claims of BRT or the Buyer — legitimate interests;
• online-store security, prevention of misuse, maintenance of technical logs, backups and technical maintenance — BRT’s legitimate interests.

4. Data required to place an order

Data required to identify the Buyer and to place, pay for and deliver an order are necessary for entering into and performing the contract. If the Buyer does not provide the data required for a particular order, BRT may be unable to accept, process or fulfil that order. Optional data are provided voluntarily.

5. Sources of personal data

Personal data are primarily provided by the Buyer. To the extent necessary, BRT may also receive payment-status information from KLIX or the relevant payment service provider, delivery-status information from the selected carrier, and technical information generated automatically when the online store is used.

6. Recipients of personal data

To the extent necessary for the relevant purpose, personal data may be disclosed to:

• the KLIX payment solution and other service providers involved in payment processing;
• the selected carrier or delivery-service provider;
• IT, server, hosting and technical service providers;
• accounting service providers;
• lawyers and other professional advisers where necessary;
• public authorities and supervisory bodies where required by law.

Depending on the nature of the service, a recipient may act as BRT’s personal-data processor or as an independent controller.

7. Transfers outside the EEA

If a service provider used by BRT processes personal data outside the European Economic Area, the transfer will take place only where there is a legal basis under the GDPR and appropriate safeguards, such as an adequacy decision of the European Commission or applicable standard contractual clauses adopted by the European Commission.

8. Retention periods

Personal data are retained no longer than necessary for the relevant processing purpose or to comply with applicable legal requirements.

• order, invoice and accounting data are retained for the periods required by applicable law;
• account data are retained while the account is active and, after closure, only to the extent and for the period necessary to comply with legal obligations or protect legal claims;
• data relating to complaints and disputes are retained until the relevant matter is concluded and applicable limitation periods have expired;
• technical logs and security data are retained for a limited period necessary for security and incident investigation.

9. Security

BRT applies technical and organisational security measures appropriate to the nature and risks of processing. Such measures may include access-control management, encrypted connections, software updates, technical logging, backups and limiting access to personal data to persons who require it to perform their duties.

10. Data subject rights

In the cases and to the extent provided by the GDPR, a person has the right to:

• obtain information about the processing of personal data and access those data;
• request correction of inaccurate data;
• request erasure of data;
• request restriction of processing;
• object to processing;
• exercise the right to data portability;
• withdraw previously given consent where the relevant processing is based on consent;
• lodge a complaint with the Latvian Data State Inspectorate.

Requests may be sent to info@brt.lv. To protect personal data, BRT may request information necessary to verify the identity of the person making the request.

BRT will respond without undue delay and no later than one month after receiving the request. Where permitted by the GDPR, this period may be extended by up to two additional months, with the requester being informed of the extension and the reasons for it.

11. Supervisory authority

Datu valsts inspekcija (Data State Inspectorate), Elijas iela 17, Rīga, LV-1050; e-mail: pasts@dvi.gov.lv; phone: +371 67223131.

12. Cookies

Information on the use of cookies is published separately in the Cookie Policy on e.brt.lv.

13. Changes to this Policy

BRT may update this Privacy Policy if personal-data processing activities, systems used or applicable legal requirements change. The current version is published on e.brt.lv.