Privacy Policy

Effective from 26 October 2026

1. General Information

This privacy policy explains how SIA “Koko Planet” processes and protects personal data when you use the online store www.kokoplanet.lv, purchase goods or contact the company.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, or GDPR), the Personal Data Processing Law and other applicable legislation.

Personal data controller:

SIA “Koko Planet”
Registration No.: 40203778445
VAT No.: LV40203778445
Registered address: “Brīviņi”–6, Zaņa Parish, Saldus Municipality, Latvia
Email: [email protected]
Telephone: +371 20220052
Website: www.kokoplanet.lv

For questions regarding personal data processing, you can contact the company by writing to [email protected].

2. What Personal Data Is Processed?

Depending on the order and the services used, we may process:

  • First name and surname;

  • Email address and telephone number;

  • Delivery address or selected parcel locker;

  • Order number, goods purchased, quantities and order history;

  • Payment amount, status and transaction identification details;

  • Information required for invoicing;

  • Customer communications, complaints and product return requests;

  • IP address, browser and device technical data, as well as information about website operation and security.

We process only the data necessary for the specific purpose.

3. Purposes and Legal Bases for Personal Data Processing

3.1. Order Processing and Delivery

Customer data is used to receive and process orders, dispatch goods, arrange delivery and provide information about order fulfilment.

Legal basis: Article 6(1)(b) of the GDPR — performance of a contract.

3.2. Payment Processing

Payment information is used to identify and confirm payments, keep transaction records and issue refunds where necessary.

Once the relevant service has been activated, electronic payments are processed by KLIX by Citadele or another payment service provider specified at checkout.

Koko Planet does not store full payment card numbers, CVV/CVC codes or online banking passwords.

Legal basis: Article 6(1)(b) and (c) of the GDPR — performance of a contract and compliance with legal obligations.

3.3. Accounting and Tax Records

Data is processed to prepare invoices, record transactions, retain accounting documents and fulfil tax obligations.

Legal basis: Article 6(1)(c) of the GDPR — compliance with legal obligations.

3.4. Customer Service and Complaint Handling

Data is used to answer customer questions, resolve delivery issues, handle complaints, requests to exercise the right of withdrawal and claims concerning non-conforming goods.

Legal basis: Article 6(1)(b), (c) or (f) of the GDPR, depending on the nature of the request.

The legitimate interest is to provide customer service, prevent disputes and protect the company's legal interests.

3.5. Website Operation and Security

Technical data is processed to ensure the functionality of the online store and protect the website against unauthorised access, malicious requests and other security risks.

Legal basis: Article 6(1)(f) of the GDPR — the company's legitimate interests in ensuring website and information security.

3.6. Advertising and News Updates

If Koko Planet offers the option to subscribe to news updates, advertising messages are sent only where there is an applicable legal basis and the requirements for electronic commercial communications have been met.

Where processing is based on consent, consent may be withdrawn at any time.

Order confirmations, payment information and delivery information are not advertising messages.

4. Who May Receive Personal Data?

Personal data is shared only to the extent necessary to provide the relevant service or comply with legal obligations.

Online store platform

Mozello — to support online store operation, order processing and technical functions.

Payment service providers

KLIX by Citadele — once the service has been activated — and other payment service providers actually used.

Delivery service providers

Unisend, Omniva and Venipak, depending on the delivery method selected by the customer.

To arrange delivery, the recipient's first name, surname, telephone number, email address, delivery address or parcel locker details may be shared.

Accounting service providers

The company's accounting service provider, to the extent necessary for financial and tax accounting.

Technical infrastructure providers

Cloudflare and other website security, hosting and electronic communications service providers actually used.

Public and law enforcement authorities

Personal data may be disclosed to competent authorities where required by applicable legislation.

Koko Planet does not sell customers' personal data to third parties.

5. Personal Data Retention Periods

Personal data is not retained for longer than necessary for the specific processing purpose.

Accounting documents

Supporting transaction documents are generally retained for at least five years. If legislation specifies a longer period for a particular type of document, that period applies.

Order data

Order information is retained during the performance of the contract and subsequently to the extent and for the period necessary to fulfil accounting obligations, handle consumer claims and protect legal interests.

Customer correspondence and complaints

Correspondence is retained until the matter is resolved. If it is needed to handle a potential claim or protect rights, the retention period is determined taking into account the limitation period applicable to the relevant claim.

Technical and security data

Retention periods for technical logs and security data depend on the specific technical service, security needs and service configuration.

Data processed on the basis of consent

Such data is processed until consent is withdrawn or the relevant purpose ends, unless there is another legal basis for its continued retention.

After the applicable retention period expires, personal data is deleted or anonymised unless there is a legal obligation to retain it.

6. Cookies and Similar Technologies

6.1. What Are Cookies?

Cookies are small files that a website stores on the user's device to ensure website operation and certain functions.

6.2. Necessary Cookies

Technically necessary cookies may be used to operate the online store, including to support the shopping cart, user sessions and website security.

Separate consent is not required for the use of such cookies if they are strictly necessary to provide the service requested by the user.

6.3. Analytics and Advertising Cookies

If the online store uses analytics, advertising or other cookies requiring consent, they may only be activated after the user's appropriate consent has been obtained.

Consent must be freely given, specific and capable of being withdrawn.

6.4. Third-Party Technologies

Mozello and Cloudflare services may use technical technologies necessary for website operation, protection and request processing.

The names, purposes and lifetimes of specific cookies depend on the actual website configuration.

6.5. Managing Cookies

Users can delete or restrict cookies in their browser settings.

Blocking certain technically necessary cookies may affect the shopping cart and other online store functions.

If the website uses cookies requiring consent, users are provided with an appropriate option to give and withdraw consent.

7. Data Transfers Outside the European Economic Area

As part of the technical services used to operate the online store, personal data may be processed by or become accessible to service providers outside the European Economic Area.

In such cases, data transfers are permitted only in accordance with the requirements of Chapter V of the GDPR, for example, on the basis of a European Commission adequacy decision or by using appropriate safeguards, including standard contractual clauses.

Information about the safeguards applied to a specific data transfer can be requested by writing to [email protected].

8. Personal Data Protection

Koko Planet implements technical and organisational security measures appropriate to the risks of personal data processing.

Personal data is accessed only by persons and service providers who require access to perform their respective duties.

An HTTPS connection is used for data transmission in the online store.

9. Customer Rights

Under the GDPR and subject to the conditions for exercising the relevant rights, customers have the right to:

  • Receive information about the processing of their personal data;

  • Request access to their data;

  • Request the rectification of inaccurate data;

  • Request the erasure of data where there is an appropriate legal basis;

  • Request the restriction of data processing;

  • Object to processing based on legitimate interests;

  • Exercise the right to data portability where the conditions laid down in the GDPR are met;

  • Withdraw consent where data processing is based on consent;

  • Exercise the rights provided for in the GDPR in relation to automated individual decision-making.

To exercise your rights, write to [email protected].

We respond to requests without undue delay, generally within one month at the latest. In cases provided for in the GDPR, this period may be extended by a further two months, with the requester being informed.

If there are reasonable doubts about the requester's identity, we may request additional information to verify their identity.

10. Requirement to Provide Data

Providing the personal data necessary to place an order is a prerequisite for entering into and performing the purchase contract.

If the customer does not provide the necessary contact information or delivery details, it may not be possible to fulfil the order.

Providing data to receive advertising messages, where this option is offered on the basis of consent, is voluntary.

11. Automated Decision-Making

Koko Planet does not envisage solely automated decision-making in its customer service and order management processes that would produce legal or similarly significant effects on the customer within the meaning of Article 22 of the GDPR.

Payment service providers may carry out automated security and fraud prevention checks as part of their operations in accordance with their own terms.

12. Lodging Complaints

If a person believes that their personal data is being processed in breach of legislation, they have the right to contact the Data State Inspectorate.

Data State Inspectorate
Website: www.dvi.gov.lv
Email: [email protected]

A person may also exercise other remedies provided for in the GDPR.

13. Changes to the Privacy Policy

Koko Planet may update this privacy policy if data processing procedures, services used or legislative requirements change.

The current version of the privacy policy is available in the online store at www.kokoplanet.lv.

SIA “Koko Planet”
www.kokoplanet.lv
[email protected]
+371 20220052