Privacy Policy

01. Data Controller

The controller responsible for processing your personal data is:

Luna Creative SIA
Trading name: Tuvu
Registration number: 40203342995
Legal address: Pernavas street 44-13, Riga, LV-1009, Latvia
Email: info@woocommerce-181503-6592518.cloudwaysapps.com
Website: www.woocommerce-181503-6592518.cloudwaysapps.com

In this Privacy Policy, “Tuvu”, “we”, “us” and “our” refer to Luna Creative SIA.

2. Personal Data We Collect

The personal data we collect depends on how you interact with us.

2.1 Identity and contact information

We may collect:

• first and last name;
• billing address;
• delivery address;
• email address;
• telephone number;
• company name, where applicable;
• VAT or registration information, where applicable; and
• country or region.

2.2 Order and transaction information

When you place an order, we may process:

• products ordered;
• order number;
• order date;
• purchase amount;
• selected currency;
• discount codes;
• payment method;
• payment status;
• delivery method;
• shipment and tracking information;
• returns, exchanges and refunds; and
• complaints, warranty or product conformity claims.

2.3 Payment information

Payments may be processed by independent payment service providers.

Depending on the payment method, we may receive:

• confirmation that payment was successful or unsuccessful;
• transaction identification numbers;
• payment method type;
• limited payment details, such as the final digits of a payment card; and
• information necessary to process refunds or investigate suspected fraud.

Complete payment card details are normally entered directly into the payment provider’s secure system and are not stored by Tuvu.

2.4 Customer account information

If customer accounts are available, we may process:

• username or account email;
• encrypted password;
• saved billing and delivery addresses;
• order history;
• account preferences; and
• account creation and login information.

You are responsible for keeping your account credentials confidential and informing us if you suspect unauthorised access.

2.5 Communications

When you contact us, we may collect:

• your contact details;
• the content of your message;
• order or product information;
• attachments and photographs;
• customer service history; and
• information necessary to respond to your request or resolve a complaint.

Because our products are intended for caregivers and children, you may occasionally provide information concerning a child when reporting a safety issue or product complaint. Please provide only the information reasonably necessary for us to respond.

2.6 Marketing information

If you subscribe to our newsletter or agree to receive marketing, we may process:

• your name;
• email address;
• marketing preferences;
• subscription date and method;
• consent records;
• newsletter engagement information, such as email delivery, opens and link clicks, where permitted; and
• unsubscribe information.

2.7 Reviews and user-submitted content

If you submit a product review, testimonial, photograph, social media tag or other content, we may process:

• your name or chosen display name;
• review and rating;
• submitted images or videos;
• social media username;
• related product information; and
• your permission to publish or reuse the content.

We will request appropriate permission before using privately submitted photographs or testimonials for promotional purposes.

Please do not submit photographs or personal information about a child unless you are the child’s parent or legal guardian and have the legal authority to do so.

2.8 Technical and usage information

When you access the Website, we may automatically collect:

• IP address;
• device type;
• browser type and version;
• operating system;
• approximate location based on IP address;
• language and time-zone settings;
• referring website;
• pages viewed;
• date and time of access;
• interactions with Website features;
• session identifiers;
• cookie identifiers; and
• technical error, security and performance information.

Optional analytics and advertising information is collected only where required consent has been obtained.

2.9 Fraud-prevention and security information

We or our service providers may process information required to:

• verify transactions;
• prevent fraudulent payments;
• protect customer accounts;
• detect malicious Website activity;
• prevent abuse; and
• maintain Website and payment security.

3. How We Collect Personal Data

We collect personal data:

• directly from you when you place an order, create an account, complete a form or contact us;
• automatically through cookies, server logs and similar technologies;
• from payment service providers;
• from delivery and postal service providers;
• from fraud-prevention and security providers;
• from social media platforms when you contact or tag us;
• from analytics and advertising providers, where you have consented; and
• from publicly available sources where legally permitted.

4. Why We Process Personal Data

We process personal data only where we have an appropriate legal basis.

4.1 Processing necessary to perform a contract

We process personal data to:

• receive and confirm orders;
• process payments;
• prepare and deliver purchases;
• provide order updates;
• manage customer accounts;
• process returns, exchanges and refunds;
• respond to order-related questions;
• handle product conformity claims; and
• provide requested customer service.

Without the necessary identity, contact, payment and delivery information, we may be unable to fulfil an order.

4.2 Processing necessary to comply with legal obligations

We may process personal data to:

• maintain accounting and tax records;
• issue invoices;
• fulfil consumer protection obligations;
• respond to legally valid requests from authorities;
• comply with product safety and traceability requirements;
• manage recalls or safety notifications;
• investigate product safety incidents; and
• establish compliance with applicable laws.

4.3 Processing based on our legitimate interests

Where our interests are not overridden by your rights and interests, we may process personal data to:

• operate and secure the Website;
• prevent fraud and misuse;
• maintain internal business records;
• improve our products and customer service;
• respond to general enquiries;
• defend, exercise or establish legal claims;
• understand general business performance;
• manage supplier and service-provider relationships; and
• protect Tuvu, our customers and other persons.

You may object to processing based on legitimate interests as described in the “Your Rights” section.

4.4 Processing based on consent

Where required, we rely on your consent to:

• send email marketing;
• use optional analytics cookies;
• use advertising and social media cookies;
• personalise advertising;
• publish or reuse privately submitted testimonials, photographs or videos; and
• carry out another activity for which we specifically request consent.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

4.5 Processing necessary to protect vital interests

In exceptional circumstances, we may process personal data where necessary to protect the life or physical safety of a person, for example when responding to a serious product safety incident.

5. Orders, Payments and Delivery

To fulfil an order, we may share the necessary personal data with:

• payment service providers;
• banks and financial institutions;
• delivery and postal service providers;
• fulfilment or warehousing providers;
• customer support providers; and
• accounting and invoicing service providers.

Delivery providers may receive your name, delivery address, telephone number, email address, parcel information and other information required to complete delivery.

The payment and delivery provider you select may also process your personal data as an independent controller under its own privacy policy.

The providers used for a particular order will depend on the options selected at checkout and may include:

• Omniva;
• DPD;
• Unisend;
• Latvijas Pasts;
• Google Pay,
• Apple Pay.
• other relevant providers.

6. Newsletter and Direct Marketing

We will send marketing communications only where we have a valid legal basis, normally your consent.

You may unsubscribe at any time by:

• selecting the unsubscribe link in a marketing email;
• changing your communication preferences, where available; or
• contacting us at hello@woocommerce-181503-6592518.cloudwaysapps.com.

Unsubscribing from marketing does not prevent us from sending necessary service communications, such as order confirmations, delivery updates, product safety notices or responses to your enquiries.

We may retain limited suppression-list information after you unsubscribe to ensure that we respect your request.

Our newsletter provider is Mailchimp. The provider may process information about email delivery and interaction in accordance with its own privacy documentation and our agreement with it.

7. Cookies and Similar Technologies

The Website uses cookies and similar technologies.

Cookies are small files stored on your device that help the Website operate, remember preferences, understand Website use and, where permitted, support marketing.

We may use the following cookie categories:

Strictly necessary cookies

These cookies are required for essential Website functions such as:

• maintaining the shopping basket;
• remembering checkout progress;
• processing payments;
• providing Website security;
• balancing Website traffic; and
• remembering privacy choices.

Strictly necessary cookies do not require consent where they are genuinely necessary to provide a service requested by you.

Functional cookies

These cookies remember optional preferences and provide enhanced Website functions.

Analytics cookies

These cookies help us understand how visitors use the Website, which pages are visited and whether technical errors occur.

Analytics cookies are activated only after consent where required.

Advertising and social media cookies

These cookies may be used to:

• measure advertising performance;
• personalise advertising;
• limit repeated advertisements;
• connect Website activity with advertising platforms; and
• enable social media functionality.

Advertising and social media cookies are activated only after consent where required.

You can accept, reject or adjust optional cookies through the cookie consent tool available on the Website. You may change your preferences at any time.

More detailed information, including cookie names, providers, purposes and retention periods, should be available in our Cookie Policy or cookie preference tool.

8. Analytics and Advertising Services

Subject to your cookie choices, we may use services such as:

• Google Analytics 4,
• Google Ads,
• Meta Pixel,
• Pinterest Tag,
• TikTok Pixel.

These providers may collect device, browsing and interaction information and may combine it with information collected through other websites or services where permitted by law.

Do not list a service in this Privacy Policy unless it is actually installed or used on the Website.

9. Social Media

Tuvu may operate profiles on social media platforms such as Instagram, Facebook, Pinterest or TikTok.

When you interact with our social media pages, both Tuvu and the relevant platform may process information about your interaction.

The platform may process personal data under its own privacy policy, including information collected through cookies and your platform account. Depending on the service, Tuvu and the platform may act as separate controllers or joint controllers for particular processing activities.

Please review the privacy settings and privacy policy of the relevant social media platform.

10. Who Receives Your Personal Data

We may disclose personal data only where necessary to:

• payment and banking providers;
• postal, courier and delivery providers;
• Website hosting providers;
• WooCommerce and WordPress-related technology providers;
• IT support, Website maintenance and cybersecurity providers;
• customer service providers;
• email and newsletter providers;
• cookie consent providers;
• analytics and advertising providers where consent has been obtained;
• accountants, auditors, insurers and professional advisers;
• public authorities where disclosure is legally required;
• courts, law-enforcement bodies and dispute-resolution authorities;
• manufacturers or product safety specialists where necessary to investigate a safety issue; and
• a potential purchaser or successor in connection with a business restructuring, merger or sale, subject to appropriate confidentiality and legal safeguards.

Service providers acting on our behalf may process personal data only for agreed purposes and under appropriate data-processing obligations.

We do not sell personal data.

12. How Long We Retain Personal Data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, consumer protection and product safety requirements.

Typical retention criteria include:

• Orders, invoices and accounting records: For the period required by applicable accounting and tax laws.
• Delivery information: For as long as necessary to complete delivery and manage related claims, then as required for order records.
• Customer account: Until the account is deleted or after 24 months of inactivity, unless information must be retained for legal reasons.
• Customer enquiries: For the duration of the enquiry and generally up to two years after resolution.
• Complaints and product conformity claims: For the duration of the claim and applicable limitation or legal retention period.
• Product safety incidents and recalls: For as long as necessary to comply with product safety, traceability and legal obligations.
• Newsletter information: Until consent is withdrawn or after 24 months without meaningful engagement.
• Marketing suppression list: For as long as necessary to respect the unsubscribe request.
• Cookie consent records: For as long as necessary to demonstrate compliance and according to the consent tool’s settings.
• Security and server logs: Normally up to 12 months, unless required longer to investigate an incident.
• Analytics and cookie data: According to the periods shown in the Cookie Policy or cookie preference tool.
• Legal disputes: Until the dispute is resolved and the relevant limitation periods have expired.

Data may be retained for a longer period where:

• required by law;
• requested by a competent authority;
• necessary for legal proceedings;
• needed to investigate fraud or a security incident; or
• necessary to manage a product safety concern.

Information that has been irreversibly anonymised may be retained and used without identifying you.

13. How We Protect Personal Data

We use reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental loss;
• alteration;
• disclosure;
• destruction; and
• other unlawful processing.

Measures may include:

• encrypted Website connections;
• access controls;
• password protection;
• software and security updates;
• backups;
• limited staff and contractor access;
• payment processing through specialised providers;
• service-provider agreements; and
• security monitoring.

No internet transmission or storage system can be guaranteed to be completely secure. If a personal data breach occurs, we will assess it and notify the Data State Inspectorate and affected individuals where required by law.

14. Your Data Protection Rights

Subject to the conditions and limitations established by the GDPR, you may have the following rights:

Right to information

You have the right to receive clear information about how we process your personal data.

Right of access

You may request confirmation of whether we process your personal data and receive a copy of that data.

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

You may ask us to delete personal data where there is no longer a lawful reason to retain it.

This right may not apply where we must retain information to comply with legal obligations or establish, exercise or defend legal claims.

Right to restriction

You may request restriction of processing in circumstances established by the GDPR.

Right to data portability

Where processing is based on consent or a contract and carried out by automated means, you may request certain personal data in a structured, commonly used and machine-readable format.

Right to object

You may object to processing based on our legitimate interests for reasons relating to your particular situation.

You have an unconditional right to object to direct marketing at any time.

Right to withdraw consent

Where processing is based on consent, you may withdraw consent at any time without affecting earlier lawful processing.

Rights regarding automated decision-making

You have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

Tuvu does not intend to make decisions about customers based solely on automated processing that have legal or similarly significant effects.

Payment or fraud-prevention providers may use automated systems under their own responsibility and privacy policies.

Right to lodge a complaint

You may lodge a complaint with a competent data protection supervisory authority, particularly in the country where you live, work or believe a violation occurred.

15. How to Exercise Your Rights

To exercise your rights, contact:

Email: hello@woocommerce-181503-6592518.cloudwaysapps.com
Postal address: Pernavas street 44-13, Riga, LV-1009, Latvia

Please describe your request clearly. We may request additional information where reasonably necessary to verify your identity and protect your personal data.

We will normally respond within one month. Where permitted by the GDPR, this period may be extended by up to two additional months for complex or numerous requests. We will notify you if an extension is required.

Requests are normally handled free of charge. A reasonable fee may be charged, or a request may be refused, where it is manifestly unfounded or excessive, particularly because it is repetitive.

16. Complaints to the Supervisory Authority

If you believe your personal data has been processed unlawfully, we encourage you to contact us first so we can try to resolve the matter.

You may also contact the Latvian supervisory authority:

Data State Inspectorate of Latvia
Elijas iela 17
Rīga, LV-1050
Latvia
Email: pasts@dvi.gov.lv
Telephone: +371 67223131
Website: www.dvi.gov.lv

If you live in another EEA country, you may also contact the data protection authority in that country.

17. Children’s Privacy

The Tuvu Website and online store are intended for adults purchasing products for children. They are not directed at children who are not legally able to provide their own personal data or enter into a purchase contract.

We do not knowingly invite children to create accounts, subscribe to marketing or place orders.

If you believe a child has provided personal data to us without appropriate authorisation, contact us at hello@woocommerce-181503-6592518.cloudwaysapps.com.

Because Tuvu sells child-related products, information about a child may sometimes be provided by a parent or legal guardian in connection with a product question, complaint or safety incident. We will process such information only where necessary for the relevant purpose and legal obligations.

18. Third-Party Websites

The Website may contain links to websites operated by third parties.

This Privacy Policy does not apply to websites that we do not control. Please review the privacy policy of the relevant third party before providing personal data.

19. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes to the Website;
• new service providers or technologies;
• changes to our business activities;
• legal or regulatory developments; or
• improvements to our privacy practices.

The latest version will be published on the Website with the updated effective date.

If a change materially affects processing based on your consent, we will request new consent where required.

20. Contact Us

For questions about this Privacy Policy or the processing of your personal data, contact:

Luna Creative SIA / Tuvu
Registration number: 40203342995
Legal address: Permavas street 44-13, Riga, LV-1009, Latvia
Email: hello@woocommerce-181503-6592518.cloudwaysapps.com
Website: www.woocommerce-181503-6592518.cloudwaysapps.com