Privacy Policy

Last updated: 11 November 2026

1. Who processes your data

The website oilfusion.lv is operated by SIA "Oil Fusion" (reg. No. 40203604182, Latvia) — "we". We are the controller of your personal data. For any questions, write to info@oilfusion.lv.

Data processing is governed by Regulation (EU) 2016/679 (GDPR) and the Latvian Personal Data Processing Law.

2. What data we collect and why

When you submit an enquiry through the form on the site, we receive what you enter yourself: name, phone number, email address and a comment (if you add one).

If you ask Olga a question, we receive the text of the question and your email address. If you use the choice of oils by description, we receive only the description. See section 6 for details.

This data serves one purpose only — to contact you about your enquiry and respond. We do not use it for mailings and do not share it with third parties for advertising.

3. The legal basis

your enquiry — with your consent and to take steps at your request (Art. 6(1)(a) and (b) GDPR);
the visit counter — our legitimate interest in understanding how the site performs (Art. 6(1)(f)); this data is anonymised;
legal obligations — where the law requires us to keep data (e.g. accounting for a purchase).

4. How we contact you and where your enquiry goes

So that we can see your enquiry and reply, it is sent automatically to our working email info@oilfusion.lv (a Latvian service, within the EU) and to our working Telegram chat.

We reply using the contacts you provide — by phone, email or, if more convenient, via WhatsApp. Telegram and WhatsApp are services outside the EU; when we contact you through them, your contact details are transferred there. The master copy of every enquiry always stays on our email within the EU.

5. Purchases in the online shop

You place your order on our website. We process your data ourselves. Payment is handled by Paysera, a payment institution registered in Lithuania that operates across the EU. If you pay by card, the payment data is also received by Paysera's partner that handles card payments (the acquirer). It processes the data as an independent controller to carry out the payment, prevent fraud and comply with the law. Delivery is carried out by a carrier. We pass them your name, phone number and chosen pickup point. We keep order data for three years under the Commercial Law.

6. Questions for Olga and choosing oils by description

On the “Question for Olga” page you enter the text of your question and your email address. Together with them we save the site language and the product whose page you came from. We need this data so that Olga can answer your question and recommend oils. The legal basis is your consent, which you give by ticking the box in the form (Art. 6(1)(a) GDPR).

We send the text of your question and our catalogue to the artificial intelligence service Anthropic (USA, outside the EU), which prepares a draft reply. Anthropic does not receive your email address. The question and the draft, without your email address, go to our working Telegram chat. Olga reads the reply, corrects it if needed and sends it herself.

To choose oils by description at the top of the catalogue, you enter only a description. We send it to Anthropic to choose suitable products from the catalogue. We do not store the description itself. To avoid sending the same description again, for one day we keep only an irreversible marker calculated from it and the list of chosen products.

We keep the question together with the reply on the server in the EU for 12 months, after which it is deleted automatically. If you would like us to delete your question sooner, write to info@oilfusion.lv.

7. How long we keep enquiries

We keep enquiry correspondence for up to 3 years — this matches the limitation period for commercial matters in Latvia and covers repeat contact. After that we delete it.

We keep questions for Olga on our server for 12 months, see section 6. The copy in our working Telegram chat and the sent reply in our mailbox are kept by those services under their own rules.

8. Where data is processed

The site is hosted on a server in the European Union (the Netherlands). Consultation enquiries are not stored on the server, it only forwards them to our email and Telegram. Data of orders, withdrawals and questions for Olga is stored on this server. The text of questions and descriptions is also processed by Anthropic outside the EU, as described in section 6.

9. Visit counter (no personal data)

We run our own counter, designed not to collect personal data. Instead of your IP address we store only an irreversible marker made from the address, the browser and a secret key that changes every night; the IP itself and the full browser string are not stored. The key changes every night, so the next day you are an unrecognisable visitor. Records are anonymised, kept for up to 400 days, and the counter sets no cookies.

10. Cookies

The website uses one strictly necessary cookie to provide functions selected by the user: remembering the selected language and shopping cart contents, identifying an order submission attempt and, for administrators, maintaining the login session. The cookie is not used for analytics or advertising and therefore does not require consent.

The cookie is stored only after a language is selected, a product is added to the cart or an administrator logs in. It is not stored when the website is simply browsed.

11. How we protect data

We take reasonable technical and organisational measures: the site runs over the secure HTTPS protocol, and access to enquiries is limited to responsible persons. Risks on the internet cannot be fully eliminated, but we keep them to a minimum.

12. Your rights

Under the GDPR you may: know what data of yours we hold and receive a copy; correct inaccurate data; erase your data ("right to be forgotten"); restrict processing; receive your data in a portable format; withdraw consent and object to processing.

Write to info@oilfusion.lv. If you believe we are infringing your rights, you may lodge a complaint with the supervisory authority in Latvia — Datu valsts inspekcija (dvi.gov.lv). We do not make automated decisions and do not carry out profiling.

13. Minors

The site is intended for adults. We do not knowingly collect data of children under 16. If such data reaches us by mistake — write to us and we will delete it.

14. Changes

We may update this policy. The current version is always on this page, with the update date shown at the top.

This text is provided for information and does not constitute legal advice.