PRIVACY POLICY

Last updated: [01.10.26]

This Privacy Policy explains how Verus Vires ("we", "us", "our") collects, uses, stores and protects personal data when you visit or use our website https://verusvires.com, purchase products from us, contact us, or otherwise interact with our online store.

We are committed to processing personal data lawfully, fairly and transparently in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Latvian data-protection legislation.

1. Who We Are

The controller responsible for your personal data is:

Trading/brand name: Verus Vires
Address: brivibas gatve 367-21
Email: verusvires.com@gmail.com
Website: https://verusvires.com

For privacy-related questions or requests concerning your personal data, you can contact us at:

verusvires.com@gmail.com

We will update this section once our business has been formally registered and the legally required business information is available.

2. What Personal Data We Collect

Depending on how you interact with our website, we may collect the following categories of personal data.

2.1 Information you provide when placing an order

When you purchase a product, we may collect:

• first and last name;
• billing address;
• delivery address;
• email address;
• telephone number, where provided or required for delivery;
• order details;
• products purchased;
• product size and quantity;
• payment-related information;
• order value;
• shipping information;
• information you provide when requesting a return or refund.

We do not normally receive or store your complete payment-card number when payment is processed by a third-party payment provider.

2.2 Information you provide when contacting us

If you contact us by email, contact form or another available communication method, we may collect:

• your name;
• email address;
• telephone number, if provided;
• order number;
• the contents of your message;
• attachments or photographs you voluntarily provide; and
• any other information you choose to provide.

2.3 Information collected automatically

When you visit our website, certain technical information may be collected automatically, depending on your browser, device and cookie settings.

This may include:

• IP address;
• browser type;
• device type;
• operating system;
• approximate location derived from IP address;
• language settings;
• pages visited;
• referring website;
• date and time of visits;
• interactions with the website;
• technical information concerning your session; and
• information concerning cookies and similar technologies.

Some of this information may constitute personal data under applicable law.

3. How We Use Personal Data

We process personal data only for specific and legitimate purposes.

Depending on the circumstances, we may use your personal data to:

1. process and fulfil orders;
2. process payments;
3. arrange delivery;
4. communicate with you about your order;
5. provide customer support;
6. process returns, refunds and warranty/legal-guarantee claims;
7. respond to enquiries;
8. maintain records required by law;
9. comply with accounting, tax and other legal obligations;
10. prevent fraud and misuse;
11. maintain the security of our website and systems;
12. improve our website, products and services;
13. analyse website usage where legally permitted;
14. send marketing communications where you have provided the required consent or where another lawful basis permits it;
15. manage subscriptions to our newsletter or marketing communications;
16. remember your preferences where appropriate; and
17. exercise or defend legal claims where necessary.

We will not process your personal data for purposes incompatible with the purposes described in this Privacy Policy unless we provide the information required by law before carrying out such further processing.

4. Legal Bases for Processing

Under the GDPR, we must have a lawful basis for processing personal data.

Depending on the processing activity, we may rely on the following legal bases.

4.1 Performance of a contract

We process information that is necessary to enter into or perform a contract with you.

For example:

• processing your order;
• delivering your products;
• processing payments;
• communicating with you about your purchase;
• handling returns and refunds; and
• providing customer support relating to your order.

4.2 Legal obligation

We may process personal data where processing is necessary for compliance with a legal obligation.

Examples may include:

• accounting;
• tax reporting;
• maintaining legally required business records;
• responding to lawful requests from competent authorities; and
• complying with consumer-protection obligations.

4.3 Consent

Where required by law, we process personal data on the basis of your consent.

This may include certain:

• marketing emails;
• non-essential cookies;
• analytics technologies;
• advertising technologies; or
• other optional technologies.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

4.4 Legitimate interests

Where permitted by the GDPR, we may process personal data because the processing is necessary for our legitimate interests or those of a third party, provided that those interests are not overridden by your fundamental rights and freedoms.

Possible legitimate interests include:

• maintaining website security;
• preventing fraud;
• protecting our legal rights;
• managing and improving our services;
• understanding how our website is used;
• communicating with existing customers where permitted by applicable law; and
• defending legal claims.

Where we rely on legitimate interests, we consider the relevant interests and the rights and freedoms of the affected individuals.

The GDPR requires an appropriate legal basis to be identified for personal-data processing.

5. Shopify

Our online store is powered by Shopify.

Shopify provides the e-commerce infrastructure that allows us to operate our online store, including functions relating to:

• website hosting;
• shopping carts;
• checkout;
• order management;
• customer information;
• payment processing integrations;
• security;
• analytics and related services.

Information submitted through our store may therefore be processed by Shopify and relevant service providers in accordance with their applicable privacy documentation.

We configure our Shopify store and applications so that personal data is processed in accordance with applicable data-protection requirements.

6. Payment Providers

Depending on the payment methods available at checkout, payments may be processed by third-party payment service providers.

These providers may process information necessary to:

• authenticate payments;
• prevent payment fraud;
• process transactions;
• issue refunds; and
• comply with financial and legal obligations.

Payment providers may process your personal data as independent controllers or as processors, depending on the service and processing activity.

The relevant provider's own privacy policy may also apply.

We do not intentionally store complete payment-card details on our own systems where payment processing is handled by a third-party payment provider.

7. Delivery and Shipping Providers

To fulfil your order, we may provide relevant personal data to delivery and shipping providers.

This may include:

• your name;
• delivery address;
• telephone number;
• email address;
• order number; and
• information necessary to deliver your package.

The information is provided only to the extent reasonably necessary to fulfil the delivery service.

Shipping providers may process your personal data under their own privacy policies and applicable legal obligations.

8. Service Providers and Other Recipients

We may share personal data with trusted third parties where necessary for the operation of our business.

Depending on the services we use, recipients may include:

• Shopify;
• payment service providers;
• shipping and delivery providers;
• accounting providers;
• IT and hosting providers;
• email service providers;
• customer-support providers;
• analytics providers;
• advertising providers where applicable;
• fraud-prevention providers;
• professional advisers;
• legal advisers;
• government authorities where legally required; and
• other service providers necessary to operate our business.

We do not sell your personal data as a standalone product.

We only disclose personal data where there is an appropriate legal basis and where the disclosure is necessary for the relevant purpose.

9. International Data Transfers

Some of our service providers may process personal data outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will take the measures required by the GDPR.

Depending on the circumstances, this may include:

• transferring data to a country recognised by the European Commission as providing an adequate level of protection;
• using Standard Contractual Clauses approved by the European Commission; or
• relying on another lawful transfer mechanism permitted under the GDPR.

Where required, additional safeguards will be used to protect personal data.

10. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

Cookies are small files or pieces of information stored on or accessed through your device when you visit a website.

We may use different categories of cookies, including:

Strictly necessary cookies

These cookies are necessary for the operation and security of our website.

They may support functions such as:

• shopping carts;
• checkout;
• login/session management;
• security;
• fraud prevention; and
• remembering essential preferences.

These cookies generally cannot be disabled through the website's cookie-management system where they are necessary for the requested service.

Analytics cookies

Where used, analytics cookies help us understand how visitors use our website, for example:

• which pages are visited;
• how visitors navigate the store;
• which products are viewed; and
• whether website functions are working properly.

Where consent is legally required, analytics cookies will only be activated after the relevant consent has been provided.

Marketing and advertising cookies

Where used, marketing technologies may help us:

• measure advertising;
• understand campaign performance;
• show relevant advertising; or
• measure interactions with advertisements.

Where consent is legally required, these technologies will only be activated after the required consent has been obtained.

You can manage non-essential cookie preferences through our cookie-consent mechanism where available.

11. Marketing Communications

If you subscribe to our newsletter or otherwise provide consent to receive marketing communications, we may use your email address to send you information such as:

• new product announcements;
• promotions;
• discounts;
• brand news;
• product information; and
• other marketing communications.

You can unsubscribe at any time by:

• using the unsubscribe link included in our marketing emails; or
• contacting us at verusvires.com@gmail.com.

Where processing is based on consent, withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We will not require you to consent to marketing communications as a condition of purchasing our products.

12. Transactional Emails

Even if you do not subscribe to marketing communications, we may send you service-related communications necessary to fulfil your order.

These may include:

• order confirmations;
• payment confirmations;
• shipping notifications;
• delivery updates;
• refund notifications;
• return-related communications; and
• important information concerning your order.

These communications are necessary for the performance of the contract or compliance with applicable legal obligations.

13. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Different types of information may therefore be retained for different periods.

For example:

• order and transaction information may be retained for accounting and tax purposes for the period required by applicable law;
• customer-service correspondence may be retained for as long as reasonably necessary to resolve the matter and protect our legal interests;
• marketing information may be retained until you withdraw your consent or otherwise unsubscribe, subject to applicable legal requirements;
• technical information may be retained for periods appropriate to security, analytics and operational purposes.

When personal data is no longer required, we will delete it or anonymise it where reasonably possible.

14. Your Rights Under the GDPR

Depending on the circumstances and subject to applicable legal conditions, you have rights concerning your personal data.

These may include:

Right of access

You can request confirmation as to whether we process your personal data and, where applicable, request access to that data.

Right to rectification

You can request correction of inaccurate or incomplete personal data.

Right to erasure

You may request deletion of your personal data in circumstances provided by the GDPR.

This right is not absolute and may not apply where we are legally required or permitted to retain the data.

Right to restriction of processing

You may request restriction of processing in circumstances provided by the GDPR.

Right to object

You may object to certain processing based on your particular situation where the GDPR gives you this right.

You have an absolute right to object to direct marketing.

Right to data portability

Where the legal conditions are met, you may request certain personal data in a structured, commonly used and machine-readable format and request that it be transmitted to another controller.

Right to withdraw consent

Where we process your personal data based on consent, you may withdraw your consent at any time.

Withdrawal does not affect processing carried out before the withdrawal.

Rights concerning automated decision-making

You have rights concerning decisions based solely on automated processing, including profiling, where the requirements of the GDPR apply.

The EDPB identifies access, rectification, erasure, restriction, objection and portability among the principal GDPR data-subject rights.

15. How to Exercise Your Rights

To exercise your privacy rights, contact:

verusvires.com@gmail.com

Please provide enough information for us to understand your request and, where reasonably necessary, verify your identity.

We will normally respond to a valid request within one month.

Where permitted by the GDPR, this period may be extended by up to two additional months if the request is complex or numerous. If an extension is necessary, we will inform you within the initial one-month period.

We will not normally charge a fee for exercising your GDPR rights.

However, where permitted by law, we may charge a reasonable fee or refuse to act if a request is manifestly unfounded or excessive.

16. Right to Lodge a Complaint

If you believe that we have processed your personal data unlawfully or have otherwise violated your rights under data-protection law, you have the right to lodge a complaint with a competent supervisory authority.

As a business established in Latvia, the relevant supervisory authority is:

Datu valsts inspekcija (Data State Inspectorate)
Latvia

Website: https://www.dvi.gov.lv/

You may also have the right to lodge a complaint with the data-protection supervisory authority in another EU Member State, particularly where you live, work, or where the alleged infringement occurred.

17. Data Security

We take appropriate technical and organisational measures designed to protect personal data against:

• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure;
• unauthorised access; and
• other unlawful forms of processing.

The security measures we use may include:

• access controls;
• authentication mechanisms;
• secure connections;
• appropriate account-security measures;
• limited access to personal data; and
• security measures provided by our service providers.

However, no method of transmission or storage can be guaranteed to be completely secure.

You should also protect your account credentials and avoid sharing passwords with other people.

18. Children's Privacy

Our website is intended for general consumers and is not specifically directed at children.

We do not knowingly collect personal data from children where doing so would violate applicable law.

If you believe that a child has provided us with personal data unlawfully, please contact us at:

verusvires.com@gmail.com

If we become aware that we have collected personal data in circumstances where it should not have been collected, we will take reasonable steps to delete it.

19. Automated Decision-Making and Profiling

We do not intend to make decisions producing legal or similarly significant effects concerning you solely through automated processing unless such processing is permitted by applicable law and the required safeguards are provided.

Certain third-party services, such as fraud-prevention, analytics or advertising platforms, may use automated processes or profiling for their own purposes.

Where applicable, additional information will be provided through the relevant service or cookie-consent mechanism.

20. Third-Party Websites

Our website may contain links to websites or services operated by third parties.

Examples may include:

• social-media platforms;
• payment providers;
• delivery providers; or
• other external services.

We are not responsible for the privacy practices of third-party websites.

We recommend reviewing the privacy policy of any external website before providing personal data.

21. Social Media

If we provide links or integrations to social-media platforms, interacting with those platforms may result in personal data being processed by the relevant platform.

The social-media provider may process information independently from us and according to its own privacy policy.

We do not control how third-party social-media platforms process personal data after you leave our website.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Changes may be necessary because of:

• changes to our services;
• changes to the technologies we use;
• changes to our business;
• changes to applicable legislation; or
• guidance from data-protection authorities.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy.

Where required by law, we will provide additional notice or obtain consent before introducing a new processing activity requiring it.

23. Contact Us

If you have any questions about this Privacy Policy or how we process personal data, contact us:

Verus Vires
Email: verusvires.com@gmail.com
Website: https://verusvires.com

Address: brivibas gatve 367-21
We will use reasonable efforts to respond to privacy enquiries promptly and transparently.

Last updated: [03.10.26]