PRIVACY POLICY

Last updated: 18 August 2026

This Privacy Policy describes how personal data of users of the Bernumode online store, available at https://bernumode.lv/ (the “Website”), is collected, processed and protected.

We take the protection of personal data seriously and process personal data in accordance with applicable legislation, including Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), the laws and regulations of the Republic of Latvia concerning personal data protection, and other applicable legal requirements.

1. Data Controller

The controller of personal data is:

SIA “MSG Center”
Registration number: 40103237802
Legal address: Rīga, Mārcienas iela 1-68, LV-1035, Latvia
Online store: Bernumode.lv
Website: https://bernumode.lv/
Email: info@bernumode.lv

For questions concerning the processing of personal data, users may contact us at:

info@bernumode.lv

If applicable law requires the appointment of a Data Protection Officer (DPO), the relevant contact details will be published on the Website.

2. Personal Data We May Process

Depending on how the user interacts with Bernumode, we may process the following categories of personal data.

2.1. Customer data

• first and last name;

• email address;

• telephone number;

• delivery address;

• billing address, if different from the delivery address;

• order information;

• selected delivery method;

• information necessary to process payments;

• order history;

• information relating to returns, exchanges, complaints and customer enquiries.

2.2. Account data

If a user creates an account on the Website, we may process:

• first and last name;

• email address;

• telephone number;

• saved addresses;

• order history;

• data necessary for authentication and account security.

Passwords are stored in a protected form and should not be stored in plain text.

2.3. Data provided when contacting us

When a user contacts us by email, contact form, telephone or another available method, we may process:

• name;

• contact details;

• content of the communication;

• attached documents or images;

• information necessary to handle the enquiry.

2.4. Technical data

When visiting the Website, the following data may be collected automatically:

• IP address;

• date and time of the visit;

• browser and operating system information;

• device type;

• browser language;

• technical connection information;

• information about pages visited;

• information about actions taken on the Website;

• technical logs.

The amount of automatically collected data depends on the Website configuration, technical services used and the user's consent to non-essential cookies.

3. Purposes of Processing Personal Data

Personal data may be processed for the following purposes:

1. processing, confirming and fulfilling orders;

2. delivering purchased goods;

3. processing payments;

4. communicating with customers regarding their orders;

5. processing returns, exchanges and complaints;

6. providing customer support;

7. creating and maintaining user accounts;

8. maintaining order history;

9. fulfilling accounting, tax and other legal obligations;

10. complying with requirements of public authorities and supervisory bodies;

11. ensuring the security of the Website and information systems;

12. preventing fraud and misuse;

13. handling customer enquiries and resolving disputes;

14. improving the Website and its functionality;

15. statistical and analytical purposes where the required consent has been obtained;

16. sending marketing communications where an appropriate legal basis exists;

17. using cookies and similar technologies in accordance with this Privacy Policy and the Cookie Policy.

4. Legal Bases for Processing Personal Data

We process personal data only where an appropriate legal basis under the GDPR exists.

Depending on the circumstances, the legal basis may be:

4.1. Performance of a contract

Processing is necessary to enter into or perform a contract with the user, including:

• processing an order;

• confirming an order;

• delivering goods;

• processing payments;

• processing returns;

• fulfilling the seller's warranty and other obligations.

4.2. Compliance with a legal obligation

Processing is carried out where necessary to comply with legal requirements, including:

• tax and accounting requirements;

• document retention obligations;

• requests from public authorities;

• other statutory obligations.

4.3. Legitimate interests

In certain cases, processing may be based on the legitimate interests of SIA “MSG Center”, provided that such interests do not override the rights and freedoms of the user.

Such purposes may include:

• ensuring Website security;

• preventing fraud;

• protecting information systems;

• establishing, exercising or defending legal claims;

• improving customer service;

• conducting business communications;

• ensuring the stable operation of the online store.

When relying on legitimate interests, we take into account the rights and reasonable expectations of users.

4.4. User consent

Where consent is required for a particular processing activity, it will be requested separately.

Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

5. Ordering and Order Processing

To place an order, the user must provide the information necessary to perform the contract.

Depending on the selected purchase and delivery method, this may include the user's name, telephone number, email address and delivery address.

Providing the necessary information is required to enter into and perform the contract.

After placing an order, the user may receive service communications directly related to the order, such as:

• order confirmation;

• payment information;

• order preparation information;

• notification that the order has been handed over to the carrier;

• delivery information;

• return or complaint information.

Such communications are part of order servicing and are not considered marketing communications.

6. Abandoned Orders and Shopping Cart

Depending on the technical configuration of the Website, some information entered by a user during the checkout process may be temporarily stored to provide shopping cart and checkout functionality.

If separate marketing or other non-essential communication requires user consent, such communication will only be sent where an appropriate legal basis exists.

Providing an email address during checkout does not by itself constitute automatic consent to receive advertising or marketing communications.

7. Marketing Communications

We may inform users about products, promotions, discounts, new products and other Bernumode offers only where an appropriate legal basis exists.

Where consent is required, it will be requested separately.

Users may opt out of marketing communications at any time.

To unsubscribe, users may:

• use the “Unsubscribe” link contained in the marketing message;

• contact us at info@bernumode.lv.

Unsubscribing from marketing communications does not affect the user's ability to shop at the online store and does not prevent necessary service communications relating to an existing order.

8. Disclosure to Companies Involved in Order Fulfilment

To fulfil orders, personal data may be disclosed to third parties providing necessary services.

These recipients may include:

• delivery companies;

• postal operators;

• payment institutions and payment service providers;

• IT infrastructure providers;

• hosting providers;

• email service providers;

• technical support providers;

• accounting and financial service providers;

• analytical and technical service providers;

• legal, audit and other professional advisers where necessary;

• public authorities where required by law.

We disclose only the information necessary for the relevant purpose.

Where a third party processes personal data on our behalf, appropriate data processing agreements will be entered into where required.

9. Payment Data

When paying for an order, the user may be redirected to the website or payment system of the relevant payment service provider.

Depending on the selected payment method, payment data may be processed directly by the relevant payment service provider.

Where payment information is processed by an external payment provider, we do not store full bank card details unless this is necessary and provided for by the relevant payment system.

The processing of data by the payment provider is also governed by that provider's own privacy policy.

10. Delivery

Personal data necessary to deliver an order may be provided to the carrier or postal operator selected by the user.

The data provided may include:

• first and last name;

• telephone number;

• delivery address or parcel locker information;

• email address where required for notifications;

• order information necessary for delivery.

11. Cookies and Similar Technologies

The Website uses cookies and similar technologies.

Cookies may be used for:

• operating the Website;

• maintaining the shopping cart;

• authentication;

• saving user preferences;

• security;

• website analytics;

• improving Website performance;

• personalisation;

• marketing purposes.

11.1. Essential cookies

Essential cookies provide functions directly requested by the user, such as:

• shopping cart functionality;

• authentication;

• checkout;

• security;

• technical settings.

Such cookies may be used without separate consent where they are objectively necessary to provide a function requested by the user.

11.2. Analytics and other non-essential cookies

Analytics, advertising, personalisation and other non-essential cookies are used in accordance with the user's selected consent preferences where consent is required by law.

Users must be provided with the ability to accept or reject non-essential cookies.

11.3. Cookie management

Users may change their cookie preferences through the cookie management tool available on the Website.

More detailed information about specific cookies, their purposes, retention periods and providers is available in a separate Cookie Policy.

12. Google Analytics and Analytics Services

If Google Analytics or other analytics services are used on the Website, they may process technical and statistical information concerning Website visits.

Analytics tools that require user consent will only be activated after the required consent has been provided.

The specific analytics services used and categories of data processed depend on the actual configuration of the Website.

13. Transfers of Personal Data Outside the European Economic Area

We seek to process personal data within the European Economic Area (EEA).

In certain cases, our service providers may process personal data or have access to personal data outside the EEA.

Where such transfers take place, we ensure that an appropriate legal mechanism under the GDPR is in place, such as:

• an adequacy decision of the European Commission;

• Standard Contractual Clauses;

• another mechanism permitted under the GDPR.

Information concerning specific international transfers depends on the service providers actually used by the Website.

14. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected or for as long as required by applicable law.

The retention period depends on the category of data and the purpose of processing.

For example:

Order and accounting data

Retained for the period required under the applicable laws of the Republic of Latvia.

Account data

Retained until the account is deleted or for another justified period where further retention is necessary to comply with legal obligations or establish, exercise or defend legal claims.

Customer communications

Retained for as long as necessary to handle the enquiry and, where necessary, for a reasonable period thereafter.

Marketing data

Retained until consent is withdrawn or the relevant processing is discontinued, unless another legal basis for retention exists.

Technical logs

Retained for as long as necessary to ensure the security and stability of information systems.

After the applicable retention period expires, data will be deleted, destroyed or anonymised unless further retention is required by law.

15. Data Security

We implement appropriate technical and organisational measures to protect personal data against:

• unauthorised access;

• unlawful processing;

• accidental loss;

• destruction;

• alteration;

• disclosure.

Security measures may include access controls, secure connections, backups, information system protection and software updates.

However, no method of transmitting or storing information over the internet can guarantee absolute security.

16. User Rights

Under the GDPR, users have the following rights, where applicable:

• the right to access their personal data;

• the right to rectify inaccurate data;

• the right to request erasure;

• the right to restrict processing;

• the right to object to processing;

• the right to data portability;

• the right to withdraw consent;

• the right to lodge a complaint with a supervisory authority.

17. Exercising Your Rights

To exercise their rights, users may submit a request to:

info@bernumode.lv

The request should preferably include:

• first and last name;

• email address associated with the account or order;

• the requested action;

• other information that may help identify the relevant data.

To protect personal data, we may request additional information necessary to verify the identity of the requester.

18. Response Time

Requests from data subjects are handled within the time limits established by the GDPR.

As a general rule, information about the actions taken will be provided within one month of receiving the request.

Where permitted by the GDPR, this period may be extended by up to two additional months.

19. Right to Lodge a Complaint

If a user believes that their personal data is being processed in violation of the GDPR or other applicable laws, they have the right to lodge a complaint with the competent supervisory authority.

In Latvia, the competent supervisory authority is:

Data State Inspectorate (Datu valsts inspekcija)
Elijas iela 17, Rīga, LV-1050, Latvia
Website: https://www.dvi.gov.lv/

20. Minors

The Website is intended for adult purchasers and persons legally entitled to enter into the relevant contracts independently.

If a minor uses the Website or makes a purchase, such activities must comply with applicable law and, where necessary, involve the minor's legal representative.

21. Special Categories of Personal Data

We do not request users to provide special categories of personal data referred to in Article 9 of the GDPR unless such processing is necessary and lawful in a particular situation.

Users should not provide sensitive personal information through contact forms or email unless it is necessary for the relevant enquiry.

22. Automated Decision-Making and Profiling

We do not make decisions that produce legal or similarly significant effects on users based solely on automated processing unless the user has been provided with the information required by law and an appropriate legal basis exists.

If profiling or automated decision-making subject to GDPR requirements is introduced in the future, users will be provided with the information and rights required by applicable law.

23. Links to Third-Party Websites

The Website may contain links to third-party websites, social networks, payment services and other external resources.

We do not control the privacy policies of third parties.

Once a user leaves our Website, the processing of personal data is governed by the privacy policy of the relevant third-party operator.

24. Changes to this Privacy Policy

We may periodically update this Privacy Policy due to:

• changes in legislation;

• changes to the Website;

• introduction of new services or technologies;

• changes to service providers;

• changes in the way personal data is processed.

The current version of the Privacy Policy will always be published on the Website.

The date of the latest update is stated at the beginning of this document.

25. Applicable Law

This Privacy Policy is governed by applicable European Union and Latvian legislation.

If this Privacy Policy conflicts with mandatory legal requirements, the applicable legal requirements shall prevail.

26. Contact Information

For questions concerning the processing of personal data, exercising user rights, deleting data or obtaining additional information, please contact:

SIA “MSG Center”
Registration number: 40103237802
Legal address: Rīga, Mārcienas iela 1-68, LV-1035, Latvia
Online store: Bernumode.lv
Email: info@bernumode.lv

Last updated: 18 August 2026.