Privacy Policy
1. General information
This Privacy Policy explains how SIA Archive Room processes personal data when a person uses the website archiveroom.online, creates an account, places an order, offers a piece through “Sell with us”, contacts us, or uses our services.
Data controller:
SIA Archive Room
Registration No.: 40203722850
Legal address: Indrānu iela 8 – 28, Rīga, LV-1012
Business address: Vaļņu iela 1, Rīga, LV-1050
Email: info@archiveroom.online
Last updated: 28 September 2026.
2. What data we process, why, and on what legal basis
| Activity | Data | Purpose and legal basis |
|---|---|---|
| Orders | name, email, phone, delivery and billing address, ordered items, amounts, payment status, promo code used | Performing the purchase contract (Art. 6(1)(b) GDPR); accounting and tax obligations (Art. 6(1)(c)) |
| Payments | payment status and amount; card details are entered directly into Stripe's secure form and never reach our servers | Performing the contract (Art. 6(1)(b)); fraud prevention (Art. 6(1)(f)) |
| Customer account | email, name, password (stored only as a one-way hash), saved addresses, order history | Providing the account you asked for (Art. 6(1)(b)) |
| Welcome code | a personal single-use discount code linked to your account; if you ticked the box, your consent (time and wording) to receive it by email | Providing the offer shown in your account (Art. 6(1)(b)); the email only with your consent (Art. 6(1)(a)) |
| Monthly new arrivals e-mail | your email, language, and the record of your consent (the wording you agreed to, when and where — sign-up, checkout or account); whether you unsubscribed | Your consent (Art. 6(1)(a)), which you can withdraw at any time with the link in every e-mail or in your account |
| Archive credits | your credits balance and its history (orders, purchases in our shop that staff record on your account, rewards used) | Providing the programme to your account (Art. 6(1)(b)); accounting (Art. 6(1)(c)) |
| Gift cards | the buyer's email, the recipient's name and message you choose to print on the certificate, the card's value, balance and where it was spent; the code is stored only in encrypted form | Performing the gift card contract (Art. 6(1)(b)); accounting (Art. 6(1)(c)) |
| “Sell with us” | contact data from your account, description of the piece, photos (location and camera data are removed from photos on upload), our replies and the status of the submission | Steps at your request before entering into a consignment contract (Art. 6(1)(b)) |
| Customer support | name, email, content of your messages | Answering your request (Art. 6(1)(b) or (f)) |
| Security | IP address and request counters used to block automated abuse; short-lived technical server logs | Keeping the website and your data secure (Art. 6(1)(f)) |
We send the monthly new arrivals e-mail only to people who asked for it, do not use analytics or advertising cookies, and do not sell personal data. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
3. Who processes data on our behalf
Personal data is disclosed only where necessary for the purposes above:
- Stripe Payments Europe, Ltd. (Ireland) — card payments. Stripe also acts as an independent controller for fraud prevention and its own legal obligations.
- Fly.io, Inc. (USA) — hosting of the website and database; our servers are located in Frankfurt, Germany.
- Resend (USA) — delivery of transactional emails (order confirmations, shipping updates, account emails).
- Swotzy (Latvia) and the carrier you choose at checkout (e.g. Omniva, DPD, Latvijas Pasts, Venipak, UPS) — delivery of your order; they receive your name, delivery address, phone and email.
- accounting, legal or other professional service providers bound by confidentiality;
- public authorities, where required by law.
4. Transfers outside the European Economic Area
Fly.io and Resend are US companies, so data may be accessible from the USA. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
5. How long we keep data
| Data | Retention |
|---|---|
| Orders, invoices and payment records | at least 5 years, as required by the Latvian Accounting Law |
| Customer account | until you ask us to delete it; order records then stay only for the accounting period above |
| Welcome code and email consent record | as long as the account exists (the consent record serves as proof of consent) |
| Newsletter subscription | until you unsubscribe; after that only the fact that you unsubscribed (so you are not e-mailed again) and the consent record, for up to 3 years as proof |
| Archive credits and gift cards | while the account or the card is in use, then for the accounting period above |
| “Sell with us” photos | deleted automatically 6 months after the submission is declined or closed |
| “Sell with us” submission | anonymised automatically 24 months after it is declined or closed |
| Support messages | as long as needed to handle the request, and no longer than 2 years afterwards |
| IP-based abuse counters | deleted automatically after 48 hours |
Data may be kept longer only where needed to establish, exercise or defend legal claims.
6. Your rights
You have the right to:
- request access to your personal data and a copy of it;
- request correction of your personal data;
- request deletion of your personal data and your account;
- request restriction of processing of your personal data;
- object to processing based on our legitimate interests;
- request data portability, where applicable;
- withdraw consent at any time (e.g. for the welcome-code email), without affecting processing before the withdrawal;
- lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv).
To delete your account, use “Delete account” in your account settings, or write to info@archiveroom.online from the email address linked to your account or order for any other request. We reply within one month.
7. Cookies and browser storage
We only use storage that is necessary for the shop to work. The full list is in our Cookie Policy.
8. Data security
Archive Room implements appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, loss, destruction or other unlawful processing — among others encrypted connections (HTTPS), hashed passwords, access limited to staff who need it, and automatic deletion according to the retention periods above.
9. Children
Our services are not directed at children under 16, and we do not knowingly collect their personal data.
10. Changes to this Privacy Policy
Archive Room may update this Privacy Policy from time to time. The current version, with its date, is always available at archiveroom.online.