Updated on 24 September 2026.

This policy explains how SIA Bumbierkoks processes personal data when you visit bumbierkoks.lv, use our contact form or contact us about the services presented on the website. It also covers subsequent correspondence about your enquiry. It is not a policy for all company processing activities and does not cover employee data or the full processing of client contracts, accounting records and supplier documentation.

1. Who is responsible for your data

The data controller is SIA Bumbierkoks, registration number 40003764565, address: Zvanu iela 13-4, Riga, Latvia.

For questions about personal data or to exercise your rights, contact [email protected]. Our contact person for data protection matters is Gatis Poikāns.

2. What data we process and why

Correspondence and requests for a quotation

When you submit our contact form, we process the name, email address and message you provide, together with the time of the communication. If you email us directly, we also process any attachments you send and subsequent correspondence. We use this information to understand and answer your enquiry and, where relevant, prepare a quotation.

If you are an individual asking us to prepare a quotation or take other steps before entering into a contract with you, the legal basis is Article 6(1)(b) of the General Data Protection Regulation (GDPR). For general questions and correspondence with a business representative, the basis is Article 6(1)(f) — our legitimate interest in responding to enquiries and managing business communications.

Name and email address are required fields in the contact form. Providing data is voluntary, but we cannot reply without the necessary contact details. Please include only information relevant to your enquiry. We do not use email addresses received through enquiries to send newsletters or marketing emails.

Website operation and security

When you visit the website, the web server and security tools process technical information such as your IP address, the requested page or resource, the time of the request, browser information and detected security events. We use it to deliver pages, resolve errors and identify and limit fraudulent requests, bots and attacks.

We use Cloudflare and Wordfence security tools. The contact form is protected by Cloudflare Turnstile, which evaluates technical browser and connection signals. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in maintaining a secure, available website and protecting communications.

We use necessary cookies to remember your language and cookie preferences. The basis for the related personal data processing is Article 6(1)(f) GDPR — our interest in operating the website in accordance with your choices. Processing information needed to demonstrate consent is based on Article 6(1)(c) in conjunction with the obligation in Article 7(1) GDPR. Details about cookies are available in our cookie policy.

Website statistics

We load Google Analytics 4 only with your consent. It processes information about pages viewed, the timing of visits and interactions, your browser, device, approximate location, visit source and cookie-related identifiers. We use these statistics to understand website use and improve its content. The legal basis is Article 6(1)(a) GDPR — your consent.

Google Signals and user-provided data collection are disabled, and the GA4 property is not linked to a Google Ads account. Sending advertising personalisation signals is disabled in the website's Google Analytics configuration. The Google account allows data use for aggregated, de-identified business insights and access by technical support where needed. Additional sharing through the “Google products & services” option is disabled.

Rights requests and legal claims

If you make a data protection request, we process the information needed to assess it and respond. The basis is Article 6(1)(c) GDPR, to fulfil our GDPR obligations. Where particular correspondence is needed to establish or defend a legal claim, we may process the necessary information under Article 6(1)(f) — our legitimate interest in protecting our rights.

3. Who may receive or access the data

Authorised personnel and service providers may access data to the extent needed for the relevant task:

• Website and email infrastructure providers — to operate the website, deliver messages and provide technical maintenance.
• Google Ireland Limited and its subprocessors — to process Google Analytics statistics. Google Analytics data protection information.
• Cloudflare, Inc. — for content delivery, security and Turnstile checks. Website requests, including contact form submissions, pass through Cloudflare's network. Cloudflare processes Turnstile signals on our behalf and also acts as a separate controller when improving its bot-detection service. Turnstile privacy information.
• Defiant, Inc. (Wordfence) — for website security and threat detection, which may involve processing request and security-event data. Wordfence data processing terms.
• GoDaddy.com, LLC (ManageWP) — for remote website management and maintenance, which can involve access to website data. ManageWP privacy information.

We may also provide data to competent authorities where required by an applicable legal obligation, and to legal advisers where necessary to assess or defend a specific claim.

4. Processing outside the European Economic Area

Using these international services may involve processing data outside the European Economic Area, including in the United States. The providers' data transfer terms provide for mechanisms recognised by the European Commission: an adequacy decision, including the EU–US Data Privacy Framework where applicable to the certified recipient, or European Commission Standard Contractual Clauses.

The applicable mechanisms are described in Google's international transfer information, the Cloudflare Data Processing Addendum, the Wordfence Data Processing Addendum and the ManageWP service and data processing terms. You can request information about the services we use and a copy of the applicable safeguards by emailing [email protected].

5. How long we keep data

We retain correspondence and quotation enquiries that do not become part of a client matter for no more than 12 months after the last communication, then delete them. If correspondence becomes necessary for an existing contract, a statutory obligation or a specific dispute, we retain the relevant part for the period needed for that purpose. This does not justify keeping all enquiries indefinitely.

Google Analytics: the event-data retention setting is 2 months and the user-data retention setting is 14 months. The user-data period resets when new activity occurs. These settings do not apply to standard aggregated reports. Analytics cookie lifetimes are described separately in the cookie policy.

Technical and security logs: website request logs are automatically rotated each day, keeping five previous archives and the current log — normally about six days in total. The Wordfence traffic log has limits of 30 days and 2,000 entries. Some web server operation logs follow a longer replacement cycle, up to approximately five weeks. These periods concern logs on our server, not all security data independently retained by service providers. Information needed to investigate an incident or defend a claim may be retained until the matter is resolved and the applicable claims period has ended, subject to an assessment of its necessity.

6. Cookie choices and withdrawing consent

You can accept or reject optional cookies in the cookie banner and change your choice at any time through “Cookie settings” on the website. Withdrawing consent to statistics stops further loading of Google Analytics in that browser and removes Analytics cookies accessible to the website. If you also want previously collected personal data deleted, you can send us a separate request.

Withdrawing consent does not affect the lawfulness of processing carried out on the basis of valid consent before its withdrawal. You can still use the website and contact form if you reject statistics. For details, see our cookie policy.

7. Your rights

Subject to the conditions in the GDPR, you have the right to:

• obtain information about processing and access your personal data;
• request correction of inaccurate data;
• request deletion or restriction of processing where the relevant legal conditions apply;
• receive data you have provided in a structured, machine-readable format and request its transfer to another controller where processing is automated, based on consent or a contract, and the data portability conditions are met;
• object, on grounds relating to your particular situation, to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent.

Send requests to [email protected]. If we have reasonable doubts about the requester's identity, we may ask for proportionate additional information to verify it. We respond without undue delay and within one month at the latest. If the complexity or number of requests makes an extension of up to two further months necessary, we will explain the extension and its reasons within the first month.

You may complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija) — www.dvi.gov.lv, email [email protected], Elijas iela 17, Riga, LV-1050, Latvia — or another competent supervisory authority. You do not have to contact us first to exercise that right.

8. Automated decisions and external links

In the processes described here, we do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated bot and security checks protect the website and contact form. If they prevent you from sending a message, you can email [email protected] directly.

The website links to external services, including Facebook and Instagram. Following these links takes you to another provider's website, where that provider's privacy information applies.

9. Changes to this policy

We update this policy when website features, service providers or processing practices change. The current version and its date are available on this page. If a new processing purpose requires consent, we will request it separately.