1. Controller
IZSOLI.LV SIA, reg. No. 40203782559, registered address Avotu iela 4-34, Rīga, LV-1011. Email for data protection matters: privatums@izsoli.lv. Telephone: +371 25290292 (8:00-19:00).
No data protection officer has been appointed, as the Platform's activities do not meet the criteria of Article 37 of the General Data Protection Regulation. Please send all questions to the email address above.
2. What data we process
2.1. Account data: first name and surname or company name, email, telephone, password in encrypted form, language, account type (buyer / private seller / trader).
2.2. Identification and tax data (for sellers): personal identity number or registration number, taxpayer identification number and its issuing country, VAT registration number, country of residence, address, bank account number and account holder name.
2.3. Transaction data: bids, purchases, sales, prices, commissions, invoices, payouts, refunds, complaints, communication with the other party to the transaction.
2.4. Delivery data: delivery address, choice of parcel locker, tracking number.
2.5. Payment data: payment amount, time, status, payment method, payment identifier. We do not receive or store full payment card numbers; card data is processed by the payment service provider.
2.6. Content data: item descriptions, photos, reviews and ratings.
2.7. Technical data: IP address, device and browser type, pages visited, actions on the Platform, cookie and browser local storage identifiers, login times. If you have given analytics consent, also session recordings (mouse movements, clicks, scrolling) in which input fields and personal data are masked.
2.8. Staff activity log: when content, orders or settings are changed in the administration panel, we record the staff member's account, the time of the action, the IP address and the browser string. This log relates only to Platform staff, not to Buyers or Sellers.
2.9. Customer support data: correspondence, call requests, complaint materials.
3. For what purposes and on what legal basis
- Creating and maintaining an account — Legal basis: performance of a contract (GDPR 6(1)(b)) · Main data: account data
- Enabling transactions, accepting payment on the seller's behalf, payouts — Legal basis: performance of a contract · Main data: transaction, payment, delivery data
- Preparing invoices and accounting documents — Legal basis: legal obligation (6(1)(c)) · Main data: transaction and identification data
- Reporting to the Valsts ieņēmumu dienests (State Revenue Service) (DAC7) — Legal basis: legal obligation · Main data: identification, tax and transaction data
- Prevention of money laundering, sanctions screening — Legal basis: legal obligation · Main data: identification data
- Handling complaints and disputes — Legal basis: performance of a contract and legitimate interests (6(1)(f)) · Main data: transaction and communication data
- Fraud prevention, security, account blocking — Legal basis: legitimate interests · Main data: technical and transaction data
- Establishing the origin of changes in the event of an incident — Legal basis: legitimate interests (GDPR 6(1)(f)) · Main data: staff activity log
- Service improvement and statistics — Legal basis: legitimate interests · Main data: technical data in aggregated form
- Marketing and newsletters — Legal basis: consent (6(1)(a)) or legitimate interests for existing customers regarding similar goods · Main data: email, transaction history
- Personalised advertising and analytics using cookies — Legal basis: consent · Main data: cookie data
- Bringing and defending legal claims — Legal basis: legitimate interests · Main data: all relevant data
If you do not provide account and identification data, we cannot enable you to use the Platform; if you do not provide tax data, we are not allowed to make payouts.
4. Automated decision-making
4.1. To prevent fraud, the Platform automatically checks transactions against risk indicators (unusual bidding patterns, multiple registrations, failed payments). The result may lead to a transaction being suspended or an additional check.
4.2. In such a case, you have the right to request human intervention, express your point of view and contest the decision by writing to privatums@izsoli.lv.
4.3. We carry out profiling for marketing purposes only with your consent.
5. Who we share data with
5.1. The other party to the transaction. Once a transaction is concluded, the seller receives the buyer's name, delivery address and the contact details needed to deliver the item. The buyer is shown the seller's identity and, if the seller is a trader, its company details.
5.2. Processors and service providers:
- Klix (AS Citadele banka) — Purpose: bank payments and pay later (Klix pay later) · Location: Latvia / EU
- AS Citadele banka — Purpose: card payments with a POS terminal at the pickup point · Location: Latvia / EU
- AS Inbank (Estonia), operating in Latvia through its branch AS "Inbank" Latvijas filiāle — Purpose: pay later and leasing · Location: Latvia / EU
- AS Citadele banka — Purpose: settlement account, payouts · Location: Latvia
- SIA "Omniva" — Purpose: parcel locker and courier delivery · Location: Latvia / EU
- SIA "DPD Latvija" — Purpose: parcel locker and courier delivery · Location: Latvia / EU
- DigitalOcean, LLC — Purpose: Platform servers and hosting · Location: servers in Germany (EU); company in the USA, transfer based on EU Standard Contractual Clauses
- Resend, Inc. — Purpose: email notifications and messages · Location: company in the USA, transfer based on EU Standard Contractual Clauses
- Visma Enterprise SIA (Horizon) — Purpose: accounting · Location: Latvia
- Google Ireland Ltd (Analytics, Ads, Tag Manager) — Purpose: statistics and advertising, only with consent · Location: EU / USA
- Microsoft Ireland Operations Ltd (Clarity) — Purpose: session recordings with masked data, only with analytics consent · Location: EU / USA
- Meta Platforms Ireland Ltd (Pixel) — Purpose: measuring advertising results, only with consent · Location: EU / USA
- TikTok Technology Ltd (Pixel, being introduced) — Purpose: measuring advertising results, only with consent · Location: EU / USA
- OpenAI, L.L.C. — Purpose: preparing item descriptions and content moderation · Location: USA
5.2.1. Google Ads enhanced conversions. If you have given marketing consent, after a purchase we pass your email address and telephone number to Google in hashed (SHA-256) form. Google uses them only to count how many purchases resulted from an advert. Without marketing consent, this data is not passed on.
5.3. Use of OpenAI. We use an artificial intelligence service to prepare item descriptions and moderate content. We do not pass personal data to this service; only item descriptions and photos without personal identifiers are sent. If an item photo or description contains personal data, please remove it before publishing.
5.3.1. Price comparison websites. We publish item offers on the websites salidzini.lv, kurpirkt.lv and ceno.lv. These websites receive information about the items: name, description, price, image and a link to the item page. No personal data is passed on in this data feed.
5.4. Public authorities: the Valsts ieņēmumu dienests (State Revenue Service), law enforcement authorities and courts in cases provided for by law.
5.5. Professional advisers: lawyers, auditors, debt collection service providers, where necessary.
5.6. Transfers of data outside the European Economic Area take place only on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision. You can request up-to-date information about a specific transfer by writing to privatums@izsoli.lv.
6. How long we keep data
After the retention period ends, the data is deleted or irreversibly anonymised.
7. Your rights
7.1. You have the right to:
- access your data and receive a copy of it;
- rectify inaccurate data;
- erase your data (the "right to be forgotten"), to the extent that we have no legal obligation to keep it;
- restrict processing;
- data portability in a structured, machine-readable format;
- object to processing based on legitimate interests, including direct marketing; in the case of direct marketing, processing stops without exception;
- withdraw consent at any time; withdrawal does not affect the lawfulness of processing carried out before it.
7.2. Submit your request from your account or by writing to privatums@izsoli.lv. We reply within 1 month; in complex cases the deadline may be extended by 2 months, in which case we will let you know.
7.3. We may ask for additional information to verify your identity.
7.4. If you believe that your rights have been infringed, you have the right to lodge a complaint with the Datu valsts inspekcija (Data State Inspectorate) (Elijas iela 17, Rīga, LV-1050, pasts@dvi.gov.lv, dvi.gov.lv).
8. Data security
8.1. The connection to the Platform is encrypted (TLS). Passwords are stored in an irreversibly hashed form.
8.2. Access to data is granted only to staff who need it to perform their duties, and access is logged.
8.3. Data processing agreements are concluded with processors.
8.4. The staff activity log is not used to assess staff performance. It is accessed only by persons investigating a specific incident.
8.5. If a personal data breach poses a high risk to your rights, we will inform you without undue delay.
9. Children's data
9.1. The Platform is not intended for persons under the age of 18, and we do not knowingly collect their data. If we learn that an account has been created by a minor, the account is closed.
10. Cookies
10.1. The use of cookies is governed by the Cookie Policy, available on the Platform.
11. Changes to this policy
11.1. We may amend this policy. We give notice of material changes on the Platform and by email at least 15 days in advance. Previous versions are available on the Platform.