Limited liability company “CAROLETA”, registration number: 40203427018 registered office: Riga,

Rudens Street 12 (hereinafter – Karoleta) has taken on the duty to protect clients' privacy.

In accordance with this, we have prepared privacy policy principles that apply to the acquisition, use,

publication, transfer and storage of customers' personal data.

Our web activities are conducted in accordance with the laws of the Republic of Latvia, as well as

relevant European Union law. Please take a few minutes to familiarise yourself with our privacy

policy principles.

Legal basis for the processing of personal data

1. Caroleta processes Customer's personal data on the basis of the following legal bases:

• for entering into and execution of a contract - in order to enter into a contract upon request of the

Customer and ensure fulfilment thereof;

• for the implementation of regulatory enactments - in order to fulfil the obligation specified in

binding external regulatory enactments;

• in accordance with the consent of the Customer - data subject;

• in the legitimate interest - to realize the legitimate interests of Caroleta and the Customer arising

from the obligations between Caroleta and the Customer or from the entered into agreement or

law.

2. The legitimate interests of Caroleta are:

• to carry out commercial activities;

• verify the Customer's identity before entering into the agreement;

• to ensure fulfilment of the obligations of the contract;

• Save orders for Customer goods and services as well as notes on them (e.g. oral or written);

• Analyze the operation of Caroleta's website;

• administer Caroleta Customer's account;

• promote your goods and services by sending commercial announcements;

• to send reports on the progress of the application and purchase agreements;

• prevent fraud;

• administer purchases, payments, and orders;

• inform the public about your activities.

Purposes for processing personal data

3. Caroleta shall process personal data for the following purposes:

- identification of the customer;

- preparation and conclusion of a contract;

- the supply of goods and the establishment and provision of services (fulfilment of contractual

obligations);

- advertising and distribution of goods or for commercial purposes;

- customer service;

- examination and processing of objections;

- billing administration;

- to improve the operation of your homepage.

Processing of personal data

4. Caroleta processes Customer data using modern technology capabilities, taking into account

existing privacy risks and available organizational, financial and technical resources.

5. For the qualitative and expeditious performance of the contractual obligations entered into with

the Customer, Karoleta may authorise its co-operation partners to perform certain activities of

supply of goods or provision of services, such as delivery of goods, leasing services, sending of

commercial reports and the like. In performing these tasks, Karoleta's co-operation partners process

Customer's personal data and are considered Caroleta data processing operators (processors) and

Karoleta has the right to transfer to co-operation partners the Customer's personal data necessary

for carrying out these activities to the extent necessary for carrying out these activities in Veiksans.

6. The co-operation partners of the Caroleta (as a controller of personal data) will ensure fulfilment

of the requirements for processing and protection of personal data in accordance with the entered

into data processing agreement and legislation, and will not use personal data for purposes other

than fulfilling the obligations of the agreement entered into with the Customer on behalf of

Caroleta.

7. Caroleta shall not disclose Customer's personal data to third parties except in the following cases:

• if the third party concerned has to transfer the data within the framework of the contract entered

into (e.g. supply of goods);

• if the Customer has given explicit and unambiguous consent;

• persons provided for in external regulatory enactments upon a justified request thereof, in

accordance with the procedures and amount specified in external regulatory enactments;

• in cases specified in external regulatory enactments for the protection of the legitimate interests

of Caroleta.

Personal data storage takes as long as:

• as long as the agreement entered into with the Customer is in effect;

• while Karoleta or the Customer may exercise their legitimate interests in accordance with the

procedures laid down in external laws and regulations;

• as long as there is a legal obligation to store the data;

• until the Customer's consent to the relevant processing of personal data is in effect, if there is no

other lawful basis for the processing of the data.

Access to personal data and other Customer Rights

8. The Customer has the right to receive the information specified in regulatory enactments in

relation to the processing of his or her data. Most of the Customer's information has already been

placed in the www.Karoleta.lv, under “My account,” where the Customer can verify the accuracy of

its data, correct it, and revoke consent for receiving commercial messages.

9. The Customer is entitled to request the termination of the processing of his personal data, to

request information on the purposes for which his personal data are being used, and to request the

transfer of his personal data in a widely used format to himself or to third parties. In order to avoid

any misuse of customer data and rights, an application may only be made in a form which enables

the identity of the applicant to be identified. (the application must be digitally signed or submitted in

person by Caroleta). We have the right to respond to such applications within 30 days.

An application for termination of the processing of data shall be deemed to be an application for

termination of the contract of a permanent customer.

Customer consent and right to revoke data processing

The Customer may give consent to the processing of personal data based on consent (e.g. receipt of

commercial communications, etc.) on the www.karoleta.lv website by calling +37127827736

10. The Customer shall have the right to withdraw at any time the consent given for the processing

of the data in the same manner as it has been given.

11. Withdrawal of consent shall not affect data processing carried out at the time when the

Customer's consent was valid

12. Withdrawal of consent shall not interrupt the processing of data on other legal grounds.

Communication with the Customer and commercial communications.

13. Caroleta communicates with the Customer using the contact information (telephone number, e-

mail address) provided by the Customer.

14. Caroleta shall communicate the performance of the service contract on the basis of the contract

entered into (e.g. reconciliation of delivery times of goods, information on purchases and invoices,

status of leasing application, etc.).

15. Communication regarding commercial communications regarding Caroleta shall be made in

accordance with regulatory enactments or in accordance with the consent of the Customer.

16. The Customer may give consent to the processing of personal data based on consent (e.g. receipt

of commercial communications, etc.) on the www.Karoleta.lv's website, in the “My account” section,

or by calling +371 27827736.

17. The consent given by the client to receive commercial communications shall be valid until the

revocation thereof (also after the termination of the service contract). The Customer may opt out of

receiving further commercial communications at any time.

18. Caroleta stops sending commercial notifications as soon as the Customer's request, which can be

up to three days, is processed.

Website visits and cookie processing

19. Caroleta's website uses cookies.

20. Caroleta's websites may contain links to the websites of third parties, which have their own rules

for use and protection of personal data, for which Caroleta Nenas is not liable.