Privacy Policy

The data controller is Doride SIA, VAT LV40203502439. For any privacy-related enquiries, please contact us at rc@aquaticcreatures.com.

When you register or use the Aquatic Creatures B2B Portal, we collect:

• Identity data: first name, last name, company name, VAT number
• Contact data: email address, phone number, postal address
• Corporate gift requests: name, company, email address, phone number and the message you send us with the corporate Christmas gifts form
• Authentication data: email address and hashed password managed by Firebase Authentication
• Transaction data: orders placed, product codes, quantities, and prices
• Preference data: the portal language you choose
• Technical data: IP address, browser type, and access logs (collected automatically by the hosting infrastructure)

We process your personal data for the following purposes:

• To manage your B2B account and authenticate your access
• To process and fulfil orders placed through the portal
• To reply to the corporate gift requests sent with the form
• To send transactional emails (account activation, order confirmations) via Resend
• To comply with legal and fiscal obligations
• To maintain the security and integrity of the platform

Legal basis: contract performance (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR).

We use the following third-party services, each acting as data processors under appropriate agreements:

• Google Firebase (Google LLC) — authentication, database (Firestore), and file storage. Data may be processed in the EU or the US under Google's standard contractual clauses. Firebase Privacy
• Resend — transactional email delivery. Processes only the recipient email address and email content. Resend Privacy

Account data is retained for the duration of the business relationship and for up to 7 years thereafter to comply with accounting and tax obligations under Latvian law. Order records are kept for the same period.

Authentication logs are retained for 90 days. You may request earlier deletion subject to legal retention requirements.

Under the General Data Protection Regulation (EU) 2016/679, you have the right to:

• Access — obtain a copy of the personal data we hold about you (Art. 15)
• Rectification — correct inaccurate data (Art. 16)
• Erasure — request deletion where no overriding legal basis applies (Art. 17)
• Portability — receive your data in a machine-readable format (Art. 20)
• Objection — object to processing based on legitimate interests (Art. 21)
• Restriction — request restriction of processing in certain circumstances (Art. 18)

To exercise any of these rights, contact rc@aquaticcreatures.com. We will respond within 30 days.

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Access to the portal is authenticated and all data in transit is encrypted via HTTPS.

We use strictly necessary cookies to operate the portal. For full details, see our Cookie Policy.

This policy is governed by the laws of the Republic of Latvia and the EU General Data Protection Regulation (GDPR). You have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) at www.dvi.gov.lv.