No products in the basket.
PROMETAL GROUP SIA | www.prometals.lv
1. General provisions
1.1. This Privacy Policy (hereinafter – the Policy) sets out how PROMETAL GROUP SIA obtains, uses, stores, protects and otherwise processes the personal data of natural persons in connection with the website www.prometals.lv (hereinafter – the Website), the online store, quote requests, the sale of goods, the manufacture of custom metal products and the provision of other company services.
1.2. Personal data controller:
- Name: PROMETAL GROUP SIA (hereinafter – the Company or the Controller)
- Registration number: 40103251863
- VAT number: LV40103251863
- Legal address: Vidzemes iela 5A, Ogre, LV-5001, Latvia
- E-mail: [email protected]
- Phone: +371 650 71 498
1.3. The Policy applies to visitors of the Website, customers of the online store, persons submitting quote requests, users of customer accounts, contact persons of the Company's customers and business partners, and other natural persons who contact the Company.
1.4. Personal data is any information relating to an identified or identifiable natural person. Processing of personal data includes the collection, recording, structuring, storage, use, disclosure, erasure of data and other operations performed on personal data.
1.5. The Company processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter – GDPR), the Personal Data Processing Law, the Law on Information Society Services and other applicable laws and regulations of the Republic of Latvia and the European Union.
1.6. The Company processes personal data only for specific, explicit and legitimate purposes, observing the principles of data minimisation, accuracy, storage limitation, integrity and confidentiality.
1.7. Information about the cookies used on the Website is available in a separate Cookie Policy:
https://prometals.lv/sikdatnu-politika/
2. Categories of personal data and sources
2.1. Depending on the services used, the Company may process the following categories of personal data.
2.1.1. Quote requests
When using the “Send an idea” or “Request a quote” forms, the following may be processed:
- first name, last name;
- e-mail address;
- phone number, if provided;
- company name, if the request is submitted on behalf of a company;
- description of the request;
- information about the product or service of interest;
- attached drawings, sketches, photographs and technical documentation;
- date and time the request was submitted;
- technical data on the form submission, to the extent it is recorded.
Attached documents may be in DWG, DXF, STEP, PDF, JPG, PNG, ZIP or other supported formats indicated on the Website.
2.1.2. Contact form and communication
When contacting the Company, the following may be processed:
- first name, last name;
- e-mail address;
- phone number;
- subject and content of the message;
- correspondence history;
- attached documents;
- other information the person voluntarily provides during communication.
2.1.3. Customer account
When registering and using a customer account, the following may be processed:
- first name, last name;
- e-mail address;
- data required for authentication;
- saved billing and delivery addresses;
- order history;
- technical records of account activity.
Passwords are not stored in plain text. Appropriate technical protection measures are used.
2.1.4. Online store orders
When placing and fulfilling orders, the following may be processed:
- first name and last name;
- e-mail address;
- phone number;
- billing and delivery address;
- company name, registration number and VAT number, if the order is placed on behalf of a company;
- information about the ordered goods, their quantity and price;
- selected delivery method and delivery location;
- order status and history;
- invoice and payment information.
2.1.5. Payments
In connection with the payment of orders, the Company may process:
- payment identifier;
- payment amount;
- payment date;
- payment method;
- payment status;
- information related to refunds.
Full bank card details and online banking authentication data are processed by the relevant payment service provider. The Company does not receive or store such authentication data.
2.1.6. Contact persons of legal entities
When cooperating with companies, the following may be processed:
- contact person's first and last name;
- position;
- work e-mail address;
- work phone number;
- name of the represented company;
- communication and documents related to the cooperation.
2.1.7. Marketing
If the Company carries out electronic direct marketing, the following may be processed in accordance with the applicable legal basis:
- first name;
- e-mail address;
- information on giving and withdrawing consent;
- information about the notifications sent;
- message open and link click statistics, if such tracking is carried out lawfully.
2.1.8. Website technical data
When visiting the Website, the following may be processed:
- IP address;
- browser and device technical data;
- date and time of the visit;
- server log entries;
- security event data;
- cookie identifiers and related information.
2.2. Personal data is mainly obtained from the person themselves, from documents they submit or during the use of the Website.
2.3. In certain cases, personal data may also be obtained from the company the person represents, from business partners or from publicly available registers, if there is a legal basis for doing so.
2.4. Drawings, photographs or other documents attached to a quote request may contain data of third parties. The person is asked not to submit more personal data than is necessary to evaluate the specific request.
2.5. The Company does not intentionally collect special categories of personal data referred to in Article 9 of the GDPR, such as health information, and does not provide services directly to children. If such information is submitted unnecessarily, the Company may request its removal or delete the information concerned in compliance with the requirements of the law.
3. Purposes and legal basis for processing personal data
3.1. Personal data is processed for the following purposes and on the following legal bases provided for in Article 6(1) of the GDPR.
3.1.1. Preparing quotes
Purpose: to evaluate received requests, drawings and technical documentation, calculate costs, and prepare and send commercial offers.
Legal basis:
- Article 6(1)(b) of the GDPR – steps taken at the request of the data subject prior to entering into a contract, where the person is a potential party to the contract;
- Article 6(1)(f) of the GDPR – the Company's legitimate interests in communicating with contact persons of legal entities and preparing commercial offers.
3.1.2. Communication and handling of enquiries
Purpose: to answer received questions, process contact requests and ensure communication.
Legal basis: Article 6(1)(f) of the GDPR – the Company's legitimate interests in responding to received requests. Where the communication relates directly to the conclusion or performance of a contract, point (b) may apply.
3.1.3. Providing the customer account
Purpose: to create and maintain the customer account and ensure authentication and account functionality.
Legal basis: Article 6(1)(b) of the GDPR – performance of a contract.
3.1.4. Order fulfilment
Purpose: to accept, process, manufacture and deliver orders, handle payments and communicate about the order.
Legal basis:
- Article 6(1)(b) of the GDPR – performance of a contract where the data subject is a party to the contract;
- Article 6(1)(f) of the GDPR – legitimate interests in fulfilling orders placed on behalf of legal entities;
- Article 6(1)(c) of the GDPR – compliance with the relevant legal obligations.
3.1.5. Accounting and taxes
Purpose: to prepare and keep accounting documents, issue invoices, ensure tax records and compliance with legal requirements.
Legal basis: Article 6(1)(c) of the GDPR – compliance with a legal obligation.
3.1.6. Claims, right of withdrawal and disputes
Purpose: to handle claims, ensure Consumer rights, process returns of goods and refunds, and resolve disputes.
Legal basis: Article 6(1)(b), (c) or (f) of the GDPR, depending on the specific processing purpose and situation.
3.1.7. Production quality and traceability
Purpose: to maintain production documentation, control quality, ensure product traceability and meet applicable technical or certification requirements.
Legal basis:
- Article 6(1)(c) of the GDPR, where keeping specific documentation results from an applicable legal obligation;
- Article 6(1)(f) of the GDPR – the Company's legitimate interests in ensuring quality control, traceability and proof of performance of contractual obligations.
3.1.8. Direct marketing
Purpose: to send commercial notifications, company news and offers.
Legal basis: Article 6(1)(a) of the GDPR – consent of the data subject, or, in other cases permitted by law, the relevant legal basis, in compliance with the requirements of the Law on Information Society Services.
Commercial notifications about similar goods or services may be sent to existing customers only if all conditions of the exception provided for in the relevant law are met, including the option to opt out of further notifications easily and free of charge.
3.1.9. Website operation and security
Purpose: to ensure the technical operation of the Website and the security of systems, prevent misuse and protect the Company's information systems.
Legal basis: Article 6(1)(f) of the GDPR – the Company's legitimate interests in ensuring the security and continuity of IT systems, as well as other legal bases where applicable to the specific processing.
3.1.10. Statistics and marketing cookies
Purpose: to analyse the use of the Website, improve its performance and carry out marketing activities.
Legal basis: Article 6(1)(a) of the GDPR – consent, where required for the relevant processing of personal data.
The use of cookies and similar technologies is additionally subject to the requirements of the Law on Information Society Services.
3.2. Where the processing of personal data is based on consent, the person may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
3.3. Where the processing of personal data is based on the Company's legitimate interests, the Company assesses the necessity of processing the personal data and the protection of the data subject's rights and interests.
3.4. Providing personal data may be mandatory where it is necessary to fulfil obligations laid down by law, or necessary for entering into and performing a contract. If the person does not provide the necessary data, the Company may be unable to prepare a quote, conclude a contract or fulfil an order.
3.5. The Company does not carry out decision-making based solely on automated processing, including profiling, which would produce legal effects concerning the person or similarly significantly affect them within the meaning of Article 22 of the GDPR, unless separate information about such processing has been provided and the safeguards required by law are ensured.
4. Recipients and processors of personal data
4.1. The Company does not sell personal data to third parties.
4.2. Personal data may be transferred only to the extent necessary to achieve a specific processing purpose or to comply with legal requirements.
4.3. Depending on the services used, recipients of personal data may include:
| Recipient or category | Purpose of data transfer |
|---|---|
| Maksekeskus AS (MakeCommerce) | Payment processing and payment status updates |
| Omniva | Order delivery |
| Other courier and logistics service providers used | Delivery and receipt of goods |
| Hostinger | Website hosting, operation of databases and other technical systems |
| Hostinger Reach, if used | Preparing and sending marketing e-mails |
| SIA “KVIP GROUP” (Robnety) | Website development, technical maintenance and support |
| E-mail delivery service providers | Delivery of communications, order confirmations and system messages |
| Accounting and IT service providers | Accounting, information systems and technical operations |
| Production subcontractors, where their involvement is necessary | Fulfilment of the specific order |
| Google Ireland Limited and related service providers, if the relevant services are used | Providing maps, fonts or other technologies used on the Website |
| State and municipal institutions, courts and other competent authorities | Fulfilment of obligations laid down by law and protection of legal interests |
4.4. Depending on the specific service and the nature of the data processing, recipients of personal data may be personal data processors or independent data controllers.
4.5. Where a service provider processes personal data on behalf of the Company, the Company ensures a legal basis and contractual terms for the data processing in accordance with Article 28 of the GDPR.
4.6. The Company ensures that access to personal data is granted only to persons and service providers who need it to perform the relevant work or contractual duties.
4.7. Drawings and technical documentation
4.7.1. Drawings, technical specifications and other non-public technical information submitted by the customer with quote requests are used to prepare the quote, evaluate and fulfil the order, and for the lawful keeping of documentation related to the order.
4.7.2. The documentation concerned may be accessed by the Company's authorised employees and necessary IT or production service providers, subject to confidentiality, data protection and contractual requirements.
4.7.3. The Company does not publish the customer's non-public drawings and technical documentation for advertising or for purposes unrelated to fulfilling the order without an appropriate legal basis or the customer's permission.
4.7.4. This section governs the processing of personal data insofar as the documentation concerned contains personal data. Other confidentiality and intellectual property matters are governed by the terms of use and sale or by a separate contract.
5. Transfer of personal data outside the European Economic Area
5.1. Where possible, the Company uses personal data processing solutions that ensure processing within the European Union or the European Economic Area.
5.2. Some of the service providers used or their sub-processors may also process personal data outside the European Economic Area.
5.3. Where personal data is transferred to a third country within the meaning of Chapter V of the GDPR, the Company ensures an appropriate transfer basis, for example:
- a European Commission adequacy decision;
- standard contractual clauses approved by the European Commission and the necessary supplementary safeguards;
- another transfer mechanism permitted by the GDPR.
5.4. Information about the safeguards applied to a specific data transfer, and the possibility of obtaining a copy of the relevant documents or information on where they are available, can be requested by writing to [email protected], subject to the protection of trade secrets and other legally protected information.
6. Personal data retention periods
6.1. The Company stores personal data only for as long as necessary for the relevant processing purpose, compliance with legal requirements or the protection of legal interests.
6.2. Retention periods are determined taking into account the data category, processing purpose, contractual obligations, applicable laws and limitation periods for claims.
6.3. The following retention criteria apply:
| Data category | Retention period or criterion for determining it |
|---|---|
| Quote requests and attached files, if no contract is concluded | Until the evaluation of the request and the related communication is completed, and for a reasonable period afterwards, taking into account the need to protect legal interests and the Company's data retention procedure |
| Contact forms and general correspondence | Until the matter is resolved and for as long afterwards as is reasonably necessary to prove the fact of communication or protect legal interests |
| Customer account data | While the account is maintained and, after it is closed, to the extent that retention of specific data is required by law or legitimate interests |
| Orders, contracts and data related to their performance | During the performance of the contract and afterwards until the end of the applicable retention obligations and limitation periods for claims |
| Accounting and tax documents | For the periods laid down in the Accounting Law and other applicable laws, which depend on the type of document |
| Production quality and traceability documentation | In accordance with the requirements of applicable laws, specific standards and contracts, to the extent personal data needs to be kept in the documentation |
| Marketing contact information | Until consent is withdrawn or another legal basis for marketing processing ends, taking into account the need to keep information about opt-outs and proof of consent |
| Server and security logs | For as long as necessary for system security and incident investigation, in accordance with the retention policy actually applied |
| Cookies | In accordance with the periods specified in the Cookie Policy |
6.4. After the retention period ends, personal data is deleted or anonymised, except where its further retention is legally required.
6.5. If there is a legal dispute, a justified claim or a request from a competent authority, the relevant data may be kept longer, to the extent necessary and legally permissible.
6.6. Personal data may be deleted in accordance with the procedures for operating information systems and managing backup copies, observing the principle of storage limitation.
7. Rights of data subjects
7.1. Under the GDPR, the data subject has the following rights in the cases and to the extent laid down by law:
- To request access to their personal data and receive information about its processing.
- To request the rectification of inaccurate or incomplete personal data.
- To request the erasure of personal data where the conditions laid down in the GDPR are met.
- To request restriction of the processing of personal data.
- To object to the processing of personal data based on legitimate interests.
- To object at any time to the processing of personal data for direct marketing purposes.
- To receive personal data and transmit it to another controller, where the conditions for the right to data portability are met.
- To withdraw consent to the processing of personal data where the processing is based on consent.
- To exercise the rights provided for in the GDPR in relation to automated individual decision-making.
- To lodge a complaint with the competent data protection supervisory authority.
7.2. A person may submit a request to exercise their rights:
- by e-mail: [email protected];
- by post: PROMETAL GROUP SIA, Vidzemes iela 5A, Ogre, LV-5001, Latvia.
7.3. The Company may request additional information to verify the person's identity if there are reasonable doubts about the identity of the person submitting the request. Only the data necessary for identification is requested.
7.4. The Company provides information on the action taken without undue delay, usually no later than within one month of receiving the request.
7.5. Taking into account the complexity and number of requests, this period may be extended by a further two months, in which case the person is informed of the extension and the reasons for it within one month of receiving the request.
7.6. The right to erasure of personal data is not absolute. The Company may continue to process certain personal data where required by law or where there is another legal basis provided for in the GDPR.
7.7. Where personal data is processed for direct marketing purposes and the person objects, the processing of the personal data concerned for that purpose is stopped.
7.8. The personal data protection supervisory authority in Latvia is the Data State Inspectorate:
8. Direct marketing and commercial communications
8.1. The Company may send information about its products, services and offers if it has an appropriate legal basis and the applicable requirements for electronic commercial communications are met.
8.2. Where consent is required for sending marketing communications, the Company ensures that it is freely given, specific, informed and unambiguous.
8.3. Consent to marketing is not a mandatory condition for purchasing goods or submitting a quote request, unless there is another legal basis for the relevant processing and it is not necessary for providing the specific service.
8.4. Where the law permits sending commercial communications to existing customers about similar goods or services without separate consent, the Company does so only after all conditions of the relevant exception are met.
8.5. Every electronic marketing communication, where required by law, provides a simple way to opt out of receiving further commercial communications.
8.6. You can also opt out of marketing communications by writing to [email protected].
8.7. After an opt-out, the Company may keep the minimum information necessary to ensure that no further unwanted commercial communications are sent to the person concerned.
9. Personal data security
9.1. The Company implements technical and organisational protection measures appropriate to the risks of personal data processing, in compliance with the requirements of Article 32 of the GDPR.
9.2. Depending on the nature of the processing and the systems used, such measures include restricting access rights, secure data transfer connections, authentication solutions, data backups, system updates and access monitoring.
9.3. Personal data is accessed only by authorised persons who need access to perform their work or contractual duties.
9.4. The Company takes proportionate measures to reduce the risk of accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data.
9.5. In the event of a personal data breach, the Company assesses the incident and, where applicable, notifies the Data State Inspectorate and the persons concerned in accordance with Articles 33 and 34 of the GDPR.
10. Cookies and third-party technologies
10.1. The Website uses cookies and other similar technologies to provide its operation, user preferences, statistics or marketing functions.
10.2. Cookies necessary to provide the requested service or for the technical operation of the Website are used in accordance with the requirements of applicable laws.
10.3. Cookies and other technologies that require prior consent are used only after appropriate consent has been obtained.
10.4. If Google Maps, Google Fonts or other third-party technologies are used on the Website, the applicable personal data protection and cookie requirements are observed in their use.
10.5. The user can manage or withdraw their consent to cookies using the consent management solution available on the Website.
10.6. More information about the categories of cookies used, service providers, purposes of use and retention periods is available at:
https://prometals.lv/sikdatnu-politika/
11. Links to third-party websites
11.1. The Website may contain links to websites of other companies, business partners or social networks.
11.2. When you go to a website managed by another person, the processing of personal data there is governed by the privacy terms of that website's controller.
11.3. Where third-party content or functionality is integrated directly into the Website, the Company assesses its responsibility for the processing of the data concerned according to how it actually works technically.
12. Amendments to the Privacy Policy
12.1. The Company may update this Privacy Policy if the personal data processing processes, the services used or the applicable legal requirements change.
12.2. The current version of the Privacy Policy is published on the Website:
https://prometals.lv/privatuma-politika/
12.3. If the changes significantly affect the processing of personal data or the rights of data subjects, the Company provides appropriate notice in accordance with the law.
12.4. This Privacy Policy is effective from 16 October 2026.
