Privacy policy
With this privacy policy, SIA “SHARP” (hereinafter: SIA “SHARP” or We) informs natural persons (hereinafter: the data subject or You) of the purposes for which and the legal basis on which personal data are processed, the categories of personal data, the rights of individuals, how long data are kept, and other related information.
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: GDPR).
This privacy policy is in force from the moment it is published on Our website lieneesenvalde.com (hereinafter: the Website). We may change this privacy policy unilaterally, including to keep it in line with legal requirements or with changes in Our activities. If it changes, the updated privacy policy will be published on the Website with the date of the update.
Data controller
- Name: SIA “SHARP”
- Registration number: 40203515166
- Registered address: Krišjāņa Valdemāra iela 17-15, Riga, LV-1010, Latvia
- Phone: +37126150313
You can contact SIA “SHARP” about personal data protection by writing to liene.esenvalde@gmail.com or by sending post to the registered address.
We are also on Instagram: @lieneesenvalde. If You contact Us through a social network, Your personal data may at the same time be processed by the operator of that platform under its own terms and privacy policy.
Processing of personal data
Reserving an artwork and communication before a distance contract is concluded
- Data subjects
Prospective buyer (natural person)
- Data processed
Name, surname, phone number, e-mail address, Instagram username (if contact is through Instagram Direct Messages), information about the reserved artwork, order notes or gift details.
- Legal basis
Taking steps at the request of the data subject before entering into a contract (GDPR Article 6(1)(b)).
- Retention
Until the reservation is cancelled or a distance contract is concluded. If no purchase follows: 30 days after the last communication.
Placing and processing an order for an artwork, concluding and performing the distance contract
- Data subjects
Buyer (natural person)
- Data processed
Name, surname, personal identity code, phone number, e-mail address, Instagram username (if contact is through Instagram Direct Messages), chosen delivery method, delivery and billing address, declared residential address, information about the ordered artwork, payment details.
- Legal basis
Taking steps at the request of the data subject before entering into a contract, and performance of the contract (GDPR Article 6(1)(b)).
Providing the data needed to conclude and perform the contract is a precondition of the purchase. Without it, the order cannot be placed, processed or fulfilled.
- Retention
Until the distance contract has been fully performed, and for 2 years after it was concluded.
Preparing and sending invoices, recording payments and meeting accounting requirements
- Data subjects
Buyer (natural person)
- Data processed
Name, surname, personal identity code, e-mail address, billing or delivery address, declared residential address, payment details, information about the ordered artwork and the amount paid.
- Legal basis
Performance of the contract (GDPR Article 6(1)(b)) and compliance with a legal obligation of the controller (GDPR Article 6(1)(c); Accounting Law, Section 28, paragraph 5).
- Retention
Personal data contained in invoices and related supporting documents are kept for 5 years from the date of the transaction.
Organising and carrying out delivery
- Data subjects
Buyer (natural person) or the recipient named by the buyer
- Data processed
Name, surname, delivery method, delivery address, phone number, e-mail address, order information.
- Legal basis
Performance of the contract (GDPR Article 6(1)(b)).
- Retention
Until the ordered artwork has been delivered, and for 2 years from the date of delivery, to the extent the data are needed to resolve delivery-related matters.
- Further information
Personal data needed for delivery may be passed to a courier or another chosen delivery service provider.
Handling the right of withdrawal and returns
- Data subjects
Buyer (natural person)
- Data processed
Name, surname, personal identity code, e-mail address, information about the ordered artwork, purchase price, payment details for the refund.
- Legal basis
Compliance with a legal obligation of the controller (GDPR Article 6(1)(c); Consumer Rights Protection Law, Section 12; Accounting Law, Section 28, paragraph 5).
- Retention
Personal data related to the exercise of the right of withdrawal, the return of the artwork and the refund are kept for 5 years from the date the transaction was completed.
Handling complaints and protecting the controller's rights and legitimate interests
- Data subjects
Buyer (natural person)
- Data processed
Name, surname, personal identity code, payment details, delivery address, declared residential address, phone number, e-mail address, Instagram username (if contact is through Instagram Direct Messages), order information, content of the complaint.
- Legal basis
Compliance with a legal obligation of the controller (GDPR Article 6(1)(c); Consumer Rights Protection Law, Sections 12, 13 and 26.¹), and the controller's legitimate interest in protecting its rights and legitimate interests (GDPR Article 6(1)(f)).
- Retention
Until the complaint, claim or dispute is finally resolved and until the limitation period for the related claims ends: 10 years from the date the contract was concluded.
- Further information
The data may be used as evidence in a dispute or, where necessary, as the basis of a claim.
Where necessary, the data may be passed to legal service providers, courts, the Consumer Rights Protection Centre (PTAC) or other competent authorities.
General communication with enquirers, customers and partners
- Data subjects
Enquirer, customer, partner or other natural person
- Data processed
Name, surname, Instagram username (if contact is through Instagram Direct Messages), contact details (e-mail address, phone number), content of the correspondence, channel used, order information.
- Legal basis
The controller's legitimate interest in communicating and answering the data subject's questions (GDPR Article 6(1)(f)) and, where the communication concerns a possible contract, taking steps at the request of the data subject before entering into a contract (GDPR Article 6(1)(b)).
- Retention
30 days after the data subject's last communication.
Operating, maintaining and improving the Website, and analysing visit statistics and analytics
- Data subjects
Website visitor (natural person)
- Data processed
Data obtained through cookies, IP address, technical information about the device and browser, server log data, visit data.
- Legal basis
The controller's legitimate interest in running the Website and in its visits and use, in order to assess its functionality, content and user experience (GDPR Article 6(1)(f)).
For non-essential cookies: the data subject's consent (GDPR Article 6(1)(a)).
- Retention
According to the actual lifetime of each cookie as stated in the section “Website cookies”, or until consent is withdrawn (for non-essential cookies).
- Further information
You may change or withdraw Your consent to non-essential cookies at any time through the cookie settings available on the Website.
The data processed are passed to the Website's host as a data processor.
Sources of personal data
SIA “SHARP” obtains personal data mainly from You directly, when You use the Website, contact SIA “SHARP”, reserve or buy an artwork, or use other services available on the Website.
Personal data may be obtained when You place an order on the Website and when You contact Us by e-mail, phone, WhatsApp, Instagram Direct Messages or other channels. In this way SIA “SHARP” may receive and process, for example, Your name, surname, contact details, the content of the communication and information about the artwork You are interested in, have reserved or have bought.
When You buy an artwork and the distance contract is performed, SIA “SHARP” may also obtain from You the information needed to place and fulfil the order, including the delivery address and other information needed to deliver the ordered artwork.
If You use the visualisation feature on the Website, We do not process any personal data related to that image, because the image is processed only in Your browser and is not stored on the Website.
When You visit the Website, certain personal data may be collected automatically, such as Your IP address or part of it, and data about the visit. The Website may use cookies that make it work and improve its use. Information about the cookies used, their types and purposes is given in the section “Website cookies”.
Where Your consent is required for cookies (for non-essential cookies), they are used only after that consent has been given. You may withdraw Your consent or change Your choice at any time through Your browser settings or the Website's cookie settings, as described in the section “Website cookies”.
Website cookies
Cookies are small data files stored on Your device when You visit the Website.
Cookies remember Your actions and settings, which allows Us to give You the best possible experience. Without cookies, the Website may not be fully functional. The cookies We use generally do not collect any personal information.
Overall, We use cookies to make Your experience of the Website as convenient as possible and to keep it working. Specifically, We use:
- Strictly necessary cookies. These cookies are essential for using the Website, which could not be used without them. They relate to the Website's basic functions, such as protection against unauthorised requests from malicious sites. They are kept for 1 year.
- Functional cookies. These cookies make the Website work as intended. For example, We use session cookies that let the Website remember Your choices, such as Your language, and recognise You between sessions. These cookies are kept for 2 weeks.
- Analytics cookies. To improve the user experience, assess how content performs and fix technical errors, We use analytics cookies, including from third parties such as Google Analytics. These cookies collect information such as the number of visits and return visits to the Website, and are used to produce aggregated data. Depending on the cookie, it may be kept for several days or months, but no longer than 12 months.
With regard to cookies, You have the right to:
- refuse cookies by not giving or by withdrawing consent;
- refuse cookies by choosing the appropriate settings in Your browser;
- delete cookies already stored on Your device.
Strictly necessary cookies are used in any case, on the basis of Our legitimate interest, and do not require Your consent, because the Website cannot be used without them. The Website can be used without other cookies, although it may then work with limited functionality.
Transfer of personal data to third parties
Personal data are passed to the recipients named in this privacy policy, and in the cases and to the extent provided by law, as far as needed to achieve the purpose of the processing concerned.
Personal data may be passed to law enforcement authorities and other state and municipal authorities in the cases, manner and extent provided by law.
Marketing and advertising service providers may receive and process information about a Website visitor's interests, use of the Website and interaction with its content, in order to provide personalised advertising and commercial offers and to measure the effectiveness of marketing. Such transfer and processing take place only on the basis of the visitor's prior consent.
Information technology and website hosting providers may receive data needed for the Website's technical operation, security, analytics and improvement, including IP address, device and browser information, visit data and Website preferences. The Website is hosted by Vercel Inc., which as a data processor may receive or access information about orders placed on the Website, the personal data given when placing an order, and data to the extent needed for the Website's operation, analytics and marketing functions. This processing is based on Our legitimate interest in a secure and efficient Website and, where consent is required, on Your consent.
To analyse visits to the Website We use Google Analytics, which may process information about how the Website is used, including device, browser and visit data. Google Analytics is used on the basis of Your consent where the applicable law requires it.
Courier service providers, such as SIA “DPD Latvija”, registration number 40003393255, and other delivery providers receive only the data needed for delivery, namely the recipient's name, surname, delivery address and phone number, so that the purchased artwork can be delivered to the buyer. This transfer is necessary to perform the contract.
We choose data processors carefully and, before any transfer, assess both whether it is necessary and how much data it involves, respecting the requirements of confidentiality and secure processing. Transfers take place under written data processing agreements. Data processors act only on Our instructions and may not use Your personal data for their own purposes. We apply appropriate technical and organisational measures so that the processing and protection of Your personal data, and its transfer to data processors, comply with the applicable law.
Transfer of personal data outside the EU/EEA
Your personal data are processed mainly within the European Union (EU) and the European Economic Area (EEA). However, through certain service providers, including the Website's host (Vercel Inc.) and Google Analytics, which also have branches outside the EU, personal data may be transferred to, or made accessible from, outside the EU and the EEA.
Where personal data are transferred outside the EU and the EEA, We make sure that the service provider processes them on the basis of a European Commission adequacy decision or another transfer mechanism provided for by the GDPR, including the standard contractual clauses for transfers to third countries approved by the European Commission.
Please note that if You contact Us through Instagram or WhatsApp, the platform operator may process Your personal data under its own terms and privacy policy, possibly also outside the EU/EEA, and We are not responsible for such processing by the platform operator.
Data security and automated decision-making
SIA “SHARP” applies appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing and against accidental loss, alteration, disclosure, damage or destruction, taking into account the risks of the processing and the available technology.
In its activities, SIA “SHARP” does not take decisions based solely on automated processing of personal data, including profiling, that would produce legal effects for the data subject or similarly significantly affect them.
Rights of the data subject
In the manner provided by law, the data subject has the right to request access to their personal data, and their completion, correction or erasure, or restriction of processing; to object to the processing of personal data; the right to data portability; the right to withdraw consent; and the right to lodge a complaint with the supervisory authority, the Data State Inspectorate of Latvia (www.dvi.gov.lv), by phone +37167223131 or by e-mail at pasts@dvi.gov.lv.
The data subject or their representative has the right to request information about the processing of their data, or to complain about it, by submitting a written request to SIA “SHARP”, electronically to liene.esenvalde@gmail.com or by post to Krišjāņa Valdemāra iela 17-15, Riga, LV-1010, Latvia.
In force from: 23.09.2026. Updated: 24.09.2026.