Privacy policy

1. Who We Are (Data Controller)

CA CREATIVE SIA is the data controller responsible for your personal data.

Company details:
Registration number: 40203260345
Registered address: Audeju iela 15 – 4, Riga, LV-1050, Latvia

2. Personal Data We Collect

We may collect the following categories of personal data:

• Identity and contact data: full name, company/brand name, email address, phone number, job title
• Account and subscription data: username, password (hashed), subscription plan, billing information, payment history
• Project and design request data: information you provide in design briefs, project descriptions, target audience details, references, uploaded files (images, logos, text, etc.)
• Technical data: IP address, browser type and version, device information, operating system, time zone, Platform usage data (e.g., login times, pages visited)
• Communication data: messages, emails, support tickets, feedback you send us
• Marketing and preferences data: your preferences regarding marketing communications, how you heard about us

3. How We Collect Your Data

We collect data in the following ways:

• Directly from you when you register, submit design requests, make payments, contact us, or fill out forms
• Automatically through cookies, server logs, and analytics tools when you visit our website or use the Platform
• From third parties (e.g., payment processors for transaction details)

4. Purposes and Legal Basis for Processing

We process your personal data for the following purposes and legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR): to provide our design services, manage subscriptions, process payments, deliver designs, and communicate about projects
• Legitimate interests (Art. 6(1)(f) GDPR): to improve our services, maintain Platform security, prevent fraud, analyze usage trends, display client work in our portfolio (with your right to object), and send essential service-related communications
• Legal obligations (Art. 6(1)(c) GDPR): to comply with tax, accounting, and other legal requirements in Latvia/EU
• Consent (Art. 6(1)(a) GDPR): for direct marketing emails (you can withdraw consent at any time)

5. Sharing Your Personal Data

We do not sell your personal data. We may share it with:

• Payment processors and banks (for transaction processing)
• Third-party service providers (e.g., cloud hosting, analytics tools like Google Analytics, email service providers)
• Professional advisors (accountants, lawyers)
• Public authorities when legally required

All third-party processors are bound by GDPR-compliant data processing agreements.

6. International Data Transfers

Some of our service providers are located outside the EEA (e.g., United States). In such cases, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other GDPR-approved transfer mechanisms

7. Data Retention

We retain your personal data only for as long as necessary for the purposes outlined above:

• Active subscription/project data: during the subscription period + up to 12 months after termination (for potential reactivation or disputes)
• Financial/tax data: up to 10 years (as required by Latvian law)
• Marketing data: until you withdraw consent
• Technical/log data: up to 12-24 months

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right to access (request a copy of your data)
• Right to rectification (correct inaccurate data)
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object (e.g., to direct marketing or processing based on legitimate interests)
• Right to withdraw consent (where processing is based on consent)

To exercise any of these rights, please contact us at [insert your contact email]. We will respond within one month (extendable by two months in complex cases).

You also have the right to lodge a complaint with the Latvian Data State Inspectorate[](https://www.dvi.gov.lv/en/) or your local supervisory authority.

9. Cookies and Tracking Technologies

We use cookies and similar technologies on our website and Platform to improve user experience, analyze usage, and for essential functionality.

10. Security

We implement appropriate technical and organizational measures to protect your personal data from unauthorized access, loss, misuse, or alteration. However, no method of transmission over the internet is secure.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on our website with a revised effective date. Where changes are material, we will notify you via email or a notice on the Platform at least 30 days in advance.