Privacy policy

The controller of personal data is SIA "Elama", registration no. 40103512445, registered address: "Priežkalni 2", Jumpravas pag., Ogres nov., LV-5022. For data protection matters contact elama@elama.lv, phone +371 26556099.

This policy applies to the processing of personal data in the Divinol online shop (divinol.lv, divinol.ee), the customer portal and in communication with us.

• Account data: first and last name, email, phone, password (stored in hashed form by the authentication provider).
• Order data: delivery and billing address, ordered products, payment status, invoices.
• Business data: company name, registration and VAT number, registered address, contact person.
• Communication data: messages and requests sent via the contact form, the B2B form or the oil finder form (including a licence plate or VIN if you provide it).
• Technical data: IP address, browser information and server logs needed for the operation and security of the website.

• Fulfilling orders, delivery, maintaining your account and the customer portal — conclusion and performance of a contract (GDPR Art. 6(1)(b)).
• Compliance with accounting and tax requirements, keeping invoices — legal obligation (Art. 6(1)(c)).
• Answering questions and requests, verifying B2B customer details — pre-contractual steps and our legitimate interests (Art. 6(1)(b) and (f)).
• Website security, fraud prevention and technical maintenance — legitimate interests (Art. 6(1)(f)).
• Newsletters — consent (Art. 6(1)(a)), which you may withdraw at any time.

We share data only with service providers needed to run the website and fulfil orders, and only to the extent necessary:

• Supabase — database and user authentication; data is stored in the European Union (Frankfurt, Germany).
• Netlify — website hosting and content delivery network.
• Email service provider — sending order confirmations and notifications.
• Payment service provider — processing card payments; we do not see or store card details.
• Delivery partners (parcel locker operators, couriers, freight carriers) — to deliver your order.
• Accounting service providers and public authorities — where required by law.

We do not sell personal data and do not use it for automated decision-making.

Some service providers (e.g. the hosting service) may process technical data outside the European Economic Area. In such cases data protection is ensured by a European Commission adequacy decision (e.g. the EU–US Data Privacy Framework) or standard contractual clauses.

• Account data — while the account is active or until you request deletion.
• Orders, invoices and related data — 5 years in accordance with the Latvian Accounting Law.
• Enquiries — up to 2 years after the last communication, unless related to an order.
• Newsletter subscription — until consent is withdrawn.
• Server logs — short-term, only as long as needed for security.

You have the right to access your data, rectify it, request erasure or restriction of processing, object to processing based on legitimate interests and receive your data in a portable format. Where processing is based on consent, you may withdraw it at any time.

Send requests to elama@elama.lv — we will reply within one month. If you believe your data is processed unlawfully, you may lodge a complaint with the Data State Inspectorate of Latvia (www.dvi.gov.lv).

We only use cookies and browser storage that are necessary for the website to work:

• shopping cart — keeps the products in your cart in your browser;
• authentication — maintains your session in the customer portal;
• delivery country (market) — remembers the selected country for price and VAT calculation (up to 1 year);
• cookie choice — remembers your choice in the cookie notice.

No analytics or marketing cookies are used without your consent. You can delete or block cookies in your browser settings, but the cart and sign-in may then not work.

Data is transmitted in encrypted form (HTTPS/TLS). Access to the database is restricted by user permissions — each customer sees only their own orders and invoices, and full access is limited to authorised staff.

We may update this policy if our services or legal requirements change. The current version is always published on this page, and the date of the last update is shown at the top of the page.