DEIZ - Privacy Policy

1. Controller and contact

SIA GOOD MOOD, trading as DEIZ, registration no. 40203096177, registered office Glūdas iela 15 - 31, Rīga, LV-1063, Latvia, is the controller responsible for the personal data described in this policy, unless a particular third party acts as a separate controller under its own notice. Website: https://www.deiz.eu. Email for privacy rights, enquiries and complaints: sales@gmwood.lv. Telephone: +371 22812424.

This policy concerns visitors to the DEIZ site, prospective buyers, customers, optional account holders, marketing subscribers and people communicating about DEIZ products or services. It explains the types of personal data used, why we use them, who may receive them, and your rights under applicable data-protection laws.

The online store is hosted by Shopify. Shopify processes personal data when a visitor uses the store or pays through Shopify Checkout. Shopify's own notice for consumers is at https://www.shopify.com/legal/privacy/consumers.

2. Categories of personal data

Depending on how you use DEIZ, we may process: (a) identity and business/contact details, such as name, company, email, telephone number, billing and delivery address; (b) order details, requested sauna configurations, quotations, invoices, receipts and payment status; (c) communications through email, contact forms, SMS and messaging apps; (d) shipping, installation, support and warranty records, including images voluntarily provided to establish a defect; (e) optional customer-account identifiers, login/account data and order history; (f) newsletter subscription preferences, consent and withdrawal records; (g) technical and usage information, such as IP address, device/browser identifiers, cookies and consent choices; and (h) transaction security and abuse-prevention information.

Please do not send full card numbers by email or chat.

3. Payments

Website checkout. An order placed on deiz.eu through Shopify Checkout is paid in full at checkout. That card payment is processed by Shopify Payments, which is the active payment service for the store. Shopify Payments is accepting payments and receiving payouts. The card brands available through it are Visa, Mastercard, American Express, Maestro and UnionPay. Apple Pay and Google Pay are available through the same payment setup.

Card details entered in Shopify Checkout are handled in that checkout by Shopify Payments. The Shopify Payments terms require the merchant not to store payment-card account data in systems the merchant controls. This policy does not say that SIA GOOD MOOD receives or keeps the full card number.

Where a statutory consumer withdrawal requires repayment by the same means, a card payment made through Shopify Payments is repaid through Shopify Payments to that means, unless the consumer expressly agrees to another method and pays no fee.

Direct invoices. An order agreed directly with SIA GOOD MOOD, outside Shopify Checkout, is not paid through Shopify Payments. It is invoiced by SIA GOOD MOOD: a 50% advance, then the remaining 50% by bank transfer on a separate invoice. The banks that send and receive that transfer process the bank payment. SIA GOOD MOOD receives the payment information needed to match the transfer to the invoice. That bank payment is a different operation from a Shopify Payments card payment.

4. Purposes and legal bases

We process personal data on the applicable grounds under Article 6 GDPR, including:

• Contract and pre-contract requests: answering quotations, agreeing specifications, placing and fulfilling orders, invoicing, coordinating delivery and providing customer support (Article 6(1)(b), when the data subject is party to the contract or requests pre-contract action).
• Legal obligations: statutory accounting, taxation, consumer protection, product safety, recordkeeping and applicable compliance duties (Article 6(1)(c)).
• Legitimate interests, where appropriately balanced: responding to business enquiries, protecting against fraud, securing the site and systems, defending legal claims, coordinating appropriate B2B relationship data and quality improvement where lawful (Article 6(1)(f)). Individuals have a right to object to applicable legitimate-interest processing.
• Consent: voluntary marketing emails and non-essential analytics or marketing cookies where consent is legally required (Article 6(1)(a), together with applicable electronic-communications rules). Consent can be withdrawn at any time without affecting earlier lawful processing.

Shopify states that, where it uses personal data to show personalised advertisements as part of its Enhanced Services, it relies on consent, and that it may also rely on its own legitimate interests for purposes such as providing and improving its services, reporting, and security. Those are Shopify's stated bases for Shopify's own processing. They do not replace the bases above for processing by SIA GOOD MOOD.

Where data are obtained about employees of a corporate buyer, appropriate legitimate interests and other relevant legal grounds may apply instead of the individual being personally party to the company contract of SIA GOOD MOOD.

5. Orders, guest checkout and optional accounts

DEIZ intends to offer guest checkout without mandatory account creation and optional customer accounts. Account data are used to provide the customer-account features selected, including access to order information, subject to the actual Shopify implementation. Account creation is not a condition of purchase. We retain only data necessary for fulfilling orders, handling guarantees, meeting statutory requirements and resolving disputes.

6. Marketing communications

DEIZ plans to send information about new sauna models, news, special offers and promotions using Shopify's native email-marketing tools. Subscription is voluntary and based on a clear affirmative single opt-in where legally permitted. Subscription is not a prerequisite for purchasing. No pre-ticked boxes or inferred consent are used where express opt-in is required. We keep an appropriate record of consent and provide an unsubscribe mechanism in each marketing email. You may also withdraw by contacting sales@gmwood.lv. We maintain necessary suppression/unsubscribe information to honour your choice.

The website footer has a form titled DEIZ UPDATES. It asks for an email address and sends that address to the Shopify customer record with the labels prospect and newsletter. The form does not show a separate consent tick. Whether submitting it creates a marketing subscription has not been tested, so this policy does not describe that form as a completed opt-in.

DEIZ does not treat a service, warranty or quotation email as permission to send promotional newsletters. Any country-specific electronic marketing requirements take priority over the preferred single opt-in workflow.

7. Website analytics, advertising and cookies

The store uses Shopify. Shopify places cookies on www.deiz.eu, including cookies which Shopify's own cookie policy describes as analytics and marketing. The cookies observed on 17 October 2026, and the fact that the analytics and marketing cookies were set before any consent choice, are listed in the Cookie Policy.

Shopify Network Intelligence is enabled. Shopify states that it uses customer data from this store together with customer data from other merchants to produce Enhanced Services. Shopify describes those services as helping to improve products and personalisation, improve store performance, and improve advertising relevance. Shopify states that no other merchant can access this store's customer data. Activity on this store is shared with Shopify and with other parties that may be in other countries, so that Shopify can provide services that use interactions with this store, with other merchants and with Shopify.

Shopify states that a visitor who does not consent to non-essential cookies, through Shopify's cookie banner or another tool correctly connected to Shopify's Customer Privacy API, is marked so that device data from this site is not used by Shopify Network Intelligence for non-essential purposes, including advertising. The same help page states that an opt-out of sale or sharing, and a deletion request made to the merchant, are also applied to that use. Those effects depend on a working consent or opt-out control. They are not claimed as already operating on this website.

Visitors in the European Economic Area, the United Kingdom and Switzerland are offered a banner with Accept, Decline and Manage preferences. Decline is a direct choice. The choice can be changed later. The same banner is intended to be shown in checkout for those regions. On 17 October 2026, while no banner was displayed, the analytics and marketing cookies named in the Cookie Policy were set on the first response. This policy does not state that those cookies are already withheld before a choice. That result is established only by a test after the banner is displayed.

Google Analytics 4 and Meta Pixel are not connected. They must not be described as operating. If they are connected later, this policy and the Cookie Policy will be updated first, and those tools must not run before any consent the law requires.

The contact form states that the site is protected by hCaptcha and links to hCaptcha's privacy policy and terms. A separate hCaptcha cookie was not observed on the response to the contact page. When that script runs, and what it stores, is still to be confirmed. hCaptcha's notice is at https://hcaptcha.com/privacy.

The Cookie Policy describes the observed cookies and the limits of the current consent control.

8. Providers and recipients

We share only the information needed for the stated purpose. The recipients confirmed for the current website are:

• Shopify, for hosting, checkout, customer records, store analytics and, because Shopify Network Intelligence is enabled, Enhanced Services. Shopify's Data Processing Addendum describes Shopify as a processor or service provider when it follows the merchant's instructions. Shopify states that Appendix E of that addendum describes Shopify's role as a controller or business when Enhanced Services are used. This policy reports that description. It is not a separate legal opinion on Shopify's role.
• Shopify Payments, for card payments, Apple Pay and Google Pay made in Shopify Checkout, and for a repayment of such a payment through the same service.
• Banks used for a direct invoice and for the related bank transfer. Those banks are not Shopify Payments.
• hCaptcha, to the extent the contact-form protection actually runs. The script's loading was not confirmed from the page response alone.
• Shipping companies, customs agents, crane services, installers and other delivery partners, when a particular delivery or installation requires it.
• IT, email, hosting, security, bookkeeping and professional advisers, under appropriate confidentiality and data-protection terms.
• Public authorities or other parties when disclosure is required by law or is needed to establish, exercise or defend a claim.

No CRM has been selected. This policy will be updated before a CRM is used. No withdrawal-form application is installed, and none is listed here as a processor.

Some of these parties decide their own purposes. Where that is so, their own notice applies as well as this one.

9. Retention and deletion

• Unsuccessful enquiries and prospect correspondence: ordinarily 24 months from the last meaningful interaction, unless a shorter period is appropriate, consent is withdrawn where relevant, an objection is successful, or a lawful reason requires a different retention period.
• Customer orders, invoices, tax and bookkeeping records: applicable mandatory Latvian retention periods, together with other periods legally required for warranties, claims and legitimate contractual purposes. SIA GOOD MOOD does not adopt a blanket policy of keeping all order histories indefinitely.
• Warranty and complaints records: for as long as reasonably necessary to investigate claims, meet legal or commercial obligations and defend legitimate interests, subject to periodic review.
• Marketing subscriptions and unsubscribe records: until subscription ends or consent is withdrawn, with limited information retained as necessary to respect the unsubscribe decision and demonstrate compliance.
• Cookies: for the periods stated in the Cookie Policy for each cookie that was actually observed. Shopify's published cookie table is used there only where it matches the observed cookie and is cited as Shopify's description.

After the applicable period, we erase or anonymise the data unless another lawful ground requires keeping it. Backups are overwritten on their own cycle. A legal hold can justify keeping a proportionate copy for longer.

10. Transfers outside the European Economic Area

Where a provider processes personal data outside the EEA, the transfer uses a mechanism required by the GDPR, such as an adequacy decision or Standard Contractual Clauses, with supplementary safeguards where they are required. Which mechanism applies depends on the provider and the transfer. Shopify states that information about activity on the store is shared with Shopify and with other parties that may be located in other countries in order to provide the services described above, including Enhanced Services. The Shopify company that receives the store's payouts is not named in this policy.

Deliveries to Norway, Switzerland and the United Kingdom may involve disclosure of the minimum necessary recipient and logistics data to the carrier, a customs agent or a local installer. Information on the applicable safeguard is available on request where the law requires it.

11. Your privacy rights

Depending on the applicable law and the circumstances, you may ask SIA GOOD MOOD for access, correction, erasure, restriction, objection, portability, and withdrawal of consent. You may object at any time to processing for direct marketing. You may complain to the Latvian Data State Inspectorate (Datu valsts inspekcija) or another competent authority, and you may seek a judicial remedy.

Send requests to sales@gmwood.lv. We may ask for a proportionate identity check. We normally respond within one month, subject to lawful extensions and exceptions. A request is generally free unless a lawful exception applies. Erasure does not require deletion of records that must be kept for accounting, legal claims or another lawful ground.

Where Shopify processes personal data for Enhanced Services, Shopify tells customers that they can withdraw consent, object, limit use for advertising, request access, or ask Shopify to erase data Shopify holds, at https://privacy.shopify.com. Shopify also states that a deletion request made to the merchant is applied to Shopify Network Intelligence. Using Shopify's portal does not by itself delete records that SIA GOOD MOOD must keep.

12. Customer-submitted pictures and portfolio publication

Images submitted for an order, warranty or support request are used for those purposes and are not automatically reused in advertising. If a customer expressly sends pictures for portfolio or publication, we seek a permission that has been explained and accepted for the intended uses. We do not publish an image that identifies a person, a home or private property without an appropriate legal basis and any permission the law requires. A copyright permission and a data-protection ground are different things.

13. Security and changes

We use access controls, provider terms and organisational measures appropriate to the data. No online transmission is free of risk. If the tools change, including a future CRM, Google Analytics 4, Meta Pixel, or a change to Shopify Network Intelligence or the cookie banner, this notice and the Cookie Policy will be reviewed. The date of a published revision will be shown. A revision will not reduce rights the law protects.

Privacy contact: sales@gmwood.lv; SIA GOOD MOOD, Glūdas iela 15 - 31, Rīga, LV-1063, Latvia.