Privacy policy
tulz.lv
Effective Date: August 7, 2025
Last Updated: August 7, 2025
The purpose of this Privacy Policy is to provide natural persons – clients of SIA “DATICA” (hereinafter also referred to as “data subjects,” “clients,” or “users”), who rent devices via the website www.tulz.lv, with information about the purposes, scope, protection, retention period, and rights related to the processing of their personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter – GDPR).
1. Who processes personal data?
The controller of personal data is the Latvian-registered company – legal entity: SIA DATICA, registration number 40103473078 (hereinafter also – tulz.lv or the Controller), legal address: Murjāņu iela 1A, Rīga, LV-1024, Latvia, service address: Nometņu iela 64, Rīga, LV-1002, Latvia.
Additional information regarding data processing can be obtained at: info@tulz.lv.
2. What personal data is collected?
2.1 Identification data:
2.1.1 name;
2.1.2 surname;
2.1.3 personal identity code (collected only for identity verification via SmartID and eParaksts, as well as fraud prevention).
2.2 Contact information:
2.2.1 phone number;
2.2.2 email address.
2.3 Account and transaction data:
2.3.1 order history;
2.3.2 saved payment methods (tokens only);
2.3.3 login information.
2.4 Payment data:
2.4.1 masked card number (PAN);
2.4.2 Stripe transaction token.
2.5 Identity verification data:
2.5.1 name, surname, and personal identity code from SmartID and eParaksts.
2.6 Video surveillance:
2.6.1 CCTV recordings at parcel lockers (for security and fraud prevention; data is retained for up to 30 days, access granted only to authorized employees);
2.6.2 video image of a person, including appearance, behavior, movement, location, recording time and date.
2.7 We do not collect GPS or live location data.
3. Legal basis for processing
3.1 Conclusion and performance of a contract (e.g., provision of rental services, payment processing);
3.2 Fulfillment of legal obligations (e.g., accounting, tax calculation and payment, responding to requests from competent authorities, handling consumer complaints, compliance with data protection requirements);
3.3 Protection of legitimate interests (e.g., ensuring security, fraud prevention, providing evidence, analytics, sales promotion, service improvement, video surveillance);
3.4 Consent (receiving news and offers, marketing);
3.5 Where processing is required by law or necessary for contract conclusion, tulz.lv cannot provide rental services without the required personal data.
4. Use of personal data
4.1 Registration, maintenance, and verification of user accounts, including communication;
4.2 Rental management and locker access;
4.3 Payment processing;
4.4 Accounting and tax compliance;
4.5 Fulfillment of requests from competent authorities;
4.6 Ensuring consumer rights (handling complaints, providing responses);
4.7 Compliance with security requirements, including CCTV;
4.8 Marketing, advertising, service improvement, analytics;
4.9 Protection of lessor’s interests and legal matters (e.g., debt recovery, damage claims);
4.10 Processing of video surveillance data to prevent, detect, and prove criminal acts.
5. Data retention
5.1 Personal data is stored as long as there is a legal basis.
5.2 Accounting documents: 5 years.
5.3 Transaction data: 10 years.
5.4 CCTV recordings: 30 days; longer if required for investigation or legal proceedings (until conclusion).
5.5 We do not store full card data or ID documents.
6. Data security
6.1 SSL/HTTPS encryption is applied to data transfers.
6.2 Secure login methods are used:
6.2.1 email and password;
6.2.2 Google or Facebook;
6.2.3 SmartID or eParaksts.
6.3 Access rights are granted only to authorized employees for their duties, and all access is logged.
7. User (data subject) rights (under GDPR)
7.1 Right to access personal data;
7.2 Right to rectify inaccurate data;
7.3 Right to request deletion (subject to legal requirements);
7.4 Right to restrict or object to processing;
7.5 Right to withdraw consent (e.g., for marketing);
7.6 Requests for data access or deletion can be submitted via info@tulz.lv;
7.7 Right to submit a complaint to the Controller;
7.8 Right to lodge a complaint with the Data State Inspectorate of Latvia (Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv).
8. User consent
8.1 Where processing is based on consent, users have the following rights:
8.1.1 to choose which data to provide;
8.1.2 to withdraw consent at any time by submitting a written or electronically signed request, in person, or via designated links (e.g., in commercial messages or cookie banners).
9. Recipients of personal data
9.1 State and municipal authorities (as required by law).
9.2 Courts and law enforcement authorities.
9.3 Legal service providers.
9.4 Auditors and accountants.
9.5 Banks and payment service providers.
9.6 Marketing service providers (as specified in the cookie policy).
9.7 Other partners where necessary to perform specific functions, provided appropriate data protection guarantees are in place, including:
9.7.1 Stripe – for payment processing (within the EU/EEA or outside under EU Standard Contractual Clauses);
9.7.2 SmartID and eParaksts – for identity verification (within the EU/EEA).
9.8 Analytics tools process anonymized data only.
9.9 Users have the right to obtain information on which third parties their data has been shared with (unless disclosure is prohibited by law).
10. Cookies and tracking
10.1 Our website uses cookies:
10.1.1 functional cookies (essential for site operation);
10.1.2 analytics cookies (to improve usability);
10.1.3 marketing cookies (for advertising and retargeting).
10.2 For more information, please refer to our cookie policy at tulz.lv.
11. Age restriction and service area
11.1 Services are available only to persons 18 years or older.
11.2 Services are currently available only in Latvia.
11.3 If expanded to other EU countries, this policy will be updated.
12. Policy updates
12.1 This policy may be updated to reflect changes in services or legislation.
12.2 Users will be informed of changes by publishing the updated policy on the website and, if necessary, via email or other communication channels.