Last updated: 3 November 2026.
This privacy policy explains how we process your personal data when you visit this website, fill in the enquiry form or contact us in another way. We process data in accordance with the General Data Protection Regulation (EU) 2016/679 (hereinafter, the GDPR) and the laws of Latvia.
1. Controller
The controller of your personal data is:
- Controller: SIA "D.Craft"
- Registration No.: 40203749056
- Registered address: Krasta iela 6, Tukums, Tukuma nov., LV-3101
- E-mail: info@dcraft.lv
- Phone: +371 26 268 551
If you have questions about the processing of your data, write to the e-mail address above.
2. What data we process and why
| When | What data | Why | Legal basis |
|---|---|---|---|
| You fill in the enquiry form | name, phone or e-mail, the service chosen, approximate budget, the description of your idea | to answer your question and prepare an offer or estimate | steps taken at your request before entering into a contract (GDPR Article 6(1)(b)) |
| You contact us by phone, e-mail or WhatsApp | name, contact details, the content of the communication | to reply and agree on the work | the same (point (b)) |
| We sign a contract and carry out the work | name, contact details, address of the site, invoicing details | to carry out the work, issue invoices and meet guarantee obligations | performance of a contract (point (b)) and a legal obligation (point (c)) |
| You visit the website | IP address, time of visit, browser type (server logs) | to keep the website secure and fix errors | our legitimate interests (point (f)) |
Only your name and contact details are required in the enquiry form; the other fields are optional. We do not carry out automated decision-making or profiling.
To protect the form from spam, your IP address is stored in an irreversibly transformed (hashed) form for 10 minutes and then deleted.
3. Cookies
This website does not use cookies or similar technologies (such as browser storage) for visitors, does not run visitor analytics and does not show adverts. Fonts and images are loaded from our own server, so your browser does not contact other companies while you view the site.
Technically necessary WordPress cookies are used only for site administrators when they log in to the admin panel.
If we introduce analytics or other tools that use cookies in the future, we will ask for your consent first and update this policy.
4. Who can access your data
- We ourselves: only those who need it to reply to your enquiry and carry out the work.
- The website hosting provider DigitalOcean, LLC; the server is located in Frankfurt, Germany (European Union). It acts as a processor under a data processing agreement.
- The e-mail service provider through which we receive notifications of new enquiries and correspond with you.
- If you contact us on WhatsApp, your messages are also processed by WhatsApp (Meta Platforms) under its own privacy policy.
- Public authorities: only where the law requires it.
We do not sell your data or pass it on for advertising or marketing purposes.
Some service providers are registered outside the European Economic Area (for example, in the USA). Where data is transferred outside it, this happens with the safeguards provided for by the GDPR, on the basis of a European Commission adequacy decision (the EU-U.S. Data Privacy Framework) or standard contractual clauses.
5. How long we keep data
| Data | Retention period |
|---|---|
| Enquiries from the website form | 24 months after receipt; then deleted automatically |
| Form spam | 30 days; then deleted automatically |
| Contract and invoicing data | as long as accounting and tax laws require (usually 5 years) |
| Server logs | 14 days |
| Database backups | no longer than 30 days |
If you ask us to delete your data, we do so sooner (see section 6), unless the law requires us to keep it longer.
6. Your rights
You have the right to:
- receive information about what data of yours we process, and a copy of it;
- have inaccurate data corrected;
- request the deletion of your data;
- request restriction of processing;
- object to processing based on our legitimate interests;
- receive your data in a structured, machine-readable format.
To exercise these rights, write to the e-mail address given in section 1. We will reply without undue delay and within one month at the latest. To protect your data, we may ask you to confirm your identity.
If you believe that the processing of your data breaks the law, you can lodge a complaint with the Data State Inspectorate of Latvia (www.dvi.gov.lv). We would be grateful if you contacted us first, and we will try to resolve the matter.
7. Data security
The website works only over an encrypted connection (HTTPS). Enquiries are stored in a closed admin area that only authorised persons can access. In the gallery we publish photos of our work with the clients’ knowledge and without information that would identify the client or the address; hidden data, including location (GPS) information, is removed from the photos.
8. Changes to this policy
We may update this policy, for example if our services or the law change. The current version is always published on this page; the date of the last update is given at the top.