Privacy notice

Data controller

Infinity Consciousness Europe SIA, Vēja iela 4-2, Ādaži, 2164, Latvia. Email: hello@delmaraliving.com. Telephone: +371 20 727 915.

Data we process

• Account and contact information such as name, email address and telephone number.
• Order, billing, delivery and return information.
• Messages sent to customer care.
• Necessary technical information such as IP address, session, security and server-log data.

Purposes and legal bases

• Contract and pre-contract steps (Art. 6(1)(b) GDPR): accounts, baskets, orders, payment, delivery, returns and support.
• Legal obligations (Art. 6(1)(c) GDPR): statutory accounting, tax records, and consumer product-safety requirements.
• Legitimate interests (Art. 6(1)(f) GDPR): security, fraud prevention, abuse rate limiting, and technical infrastructure defense.
• Consent (Art. 6(1)(a) GDPR): opt-in web analytics, which can be modified or withdrawn anytime.

Recipients and international transfers

We use service providers only where necessary, including Supabase (PostgreSQL database & authentication), Vercel (edge hosting & analytics), Cloudflare R2 (media storage), Stripe (payment processing), ImprovMX (inbound email forwarding), and Brevo (transactional email dispatch). All sub-processors operate under signed Data Processing Agreements with Standard Contractual Clauses (SCCs) and encryption in transit and at rest.

Security and encryption (ISO 27001 & SOC 2)

We implement technical and organizational security measures meeting ISO/IEC 27001 and SOC 2 Type II standards under GDPR Article 32: strict HTTPS/HSTS, AES-256 database encryption at rest, PostgreSQL Row Level Security (RLS), automated rate limiting against brute force/denial of service, and structured security event audit logging with automatic redaction of sensitive credentials.

Retention

We retain personal information only for as long as necessary for fulfillment and statutory legal retention periods. Financial order records are retained for up to 10 years per statutory Latvian and EU tax regulations (GDPR Art. 17(3)(b)). Profile data and addresses are permanently erasable upon your request.

Your rights & self-service tools

You have the right to access, rectify, erase, restrict, port, or object to processing of your personal data. Registered users can directly download a machine-readable JSON archive of all personal data or execute account erasure via Account → Profile & addresses. You can also write to hello@delmaraliving.com or complain to Latvia's data protection supervisory authority, Datu valsts inspekcija (dvi.gov.lv).

Security & compliance hub

For comprehensive details on our security architecture, sub-processor directory, and vulnerability disclosure policy, visit our Security & Compliance page (/compliance).