Privacy Policy

This Privacy Policy explains what data we collect, how we use it, and what rights you have regarding your personal information when using our websites calma.lv and thespa.lv.

SIA Proffee (Reg. No. 40103420140, legal address: Ilūkstes iela 54, k-7-68, Rīga, LV-1082) (hereinafter — the “Company”), as the controller of the websites calma.lv and thespa.lv, respects your privacy and processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), as well as the Law on the Processing of Personal Data of the Republic of Latvia.

1. Information You Provide to Us

We may collect the following data when you fill out a form on the website or contact us by other means:

• name;
• email address;
• company name;
• phone number;
• message;
• number of employees;
• other information that you voluntarily provide during communication or when ordering services.

2. Media and Testimonials (with Consent)

We may also process and publish personal data that you voluntarily provide to us, such as:

• testimonials, comments, or recommendations about our services;
• photographs, video or audio materials (for example, from events or treatments) in which you can be identified.

Such materials may be published on our website, social media platforms, and other official communication channels of the Company (including under the brands Calma and The SPA) only with your explicit consent. You can withdraw your consent at any time by contacting us using the details provided in this policy.

3. Employment or Cooperation Inquiries

We may also process personal data that you voluntarily provide when expressing interest in employment or cooperation — for example, as a massage therapist, administrator, or other partner.

Such data may include information about your professional experience, education, age, services offered, and contact details. This data is used solely to evaluate potential employment or collaboration opportunities and is not shared with third parties without your consent.

4. Online Orders and Payments

Our website uses WooCommerce to manage online orders for services.

When you place an order through our website, we may collect the following information:

• first and last name;
• email address;
• phone number (optional);
• billing address (country, city, street, postal code, state/province);
• order details (selected service, duration, price);
• the website page through which the order was placed;
• selected payment method.

Orders can be placed without creating a user account (guest checkout only).

We do not collect or store your full card details on our website. Depending on your device and payment method (e.g., Apple Pay or Google Pay), certain billing information may be automatically provided by your payment provider.

We may also process certain technical data related to your order for security and fraud prevention purposes.

5. Technical and Usage Data

We automatically collect certain technical data when you visit our website, such as your IP address, browser type, device information, language settings, and general website activity.

When using our online ordering functionality (WooCommerce), additional technical data may be processed to ensure secure checkout, cart functionality, order management, and fraud prevention.

This information may be collected through cookies and analytics tools and is used for website functionality, security, performance monitoring, and statistical analysis.
For more information, please see our Cookie Policy.

We use personal data for the following purposes:

• to respond to inquiries and maintain communication;
• to receive and process orders (including orders made online, by phone, or through other communication channels);
• to provide services;
• to process online payments and manage orders placed through our website (WooCommerce);
• to send automated transactional emails related to your order (e.g., order confirmation, processing, refund or failed payment notifications);
• to prevent fraud and ensure payment security;
• for internal administration;
• for accounting and legal compliance purposes;
• to analyse website traffic and improve the site (if you have given your consent);
• to send occasional service-related or promotional communications to existing clients, where permitted by applicable law;
• to ensure website security and prevent misuse;
• to publish testimonials, photographs, video or audio materials you have voluntarily provided — on our website, social media or other communication channels — for informational or marketing purposes (if you have given your consent).

We process personal data on the following legal grounds:

• your consent (e.g., when submitting forms or accepting cookies);
• performance of contractual obligations (e.g., when providing services);
• legitimate interests (e.g., ensuring website security or replying to an inquiry);
• compliance with legal obligations (e.g., bookkeeping or fulfilling requirements from regulatory authorities).

Your data may be shared with third parties in the following cases:

1. with an external accounting service provider, if bookkeeping is outsourced under contract;

2. with Stripe — our payment service provider — for processing online payments;

Payments made on our website (including card payments and express payment methods such as Apple Pay and Google Pay) are processed securely via Stripe.
When you complete a payment on our website, payment data is transmitted directly to Stripe and is not stored on our servers.
In certain cases, we may also provide a Stripe payment link or QR code. In such cases, you are redirected to a Stripe-hosted payment page, and payment data is processed directly by Stripe.

From Stripe, we receive limited information necessary for order confirmation and accounting purposes, such as:

• payer’s name;
• email address;
• billing country;
• payment status;
• payment amount;
• partial card information (e.g., card brand and last four digits).

Stripe processes personal data in accordance with its own Privacy Policy: https://stripe.com/en-lv/privacy.

3. with our hosting provider (Nano IT SIA, Latvia) — for website hosting and maintenance, as well as for storing emails, correspondence, and data submitted via forms;

4. with Google services (e.g., Google Analytics) — only if the user has given consent;

5. if you have given your consent to the use of your testimonials, photos, videos, or audio materials (including voice recordings), such content may be published on third-party public platforms — for example, social media (Instagram, Facebook, LinkedIn) or messaging services (WhatsApp, Telegram) — as part of the Company’s official communication (including under the brands Calma and The SPA). Such publication is subject to the privacy policies of the respective platforms;

6. if you contact us via third-party platforms such as WhatsApp, Telegram, Facebook Messenger, Instagram, or LinkedIn, certain technical data (such as metadata and device identifiers) may be shared with the respective service providers in accordance with their privacy policies;

7. with independent specialists and partner organizations (e.g., spa specialists, massage therapists, spa salons) working with us under a service agreement — solely for the purpose of providing the service you have requested. Such partners — whether individuals or legal entities — are required to maintain confidentiality and may use the data only within the scope of delivering the service on behalf of our company;

8. in certain cases, to external specialists or organizations (e.g., a designer, content manager, photographer, or relevant agency), if you have given your consent to the use of media files or testimonials. These partners — regardless of their legal status — act on behalf of our company and are required to maintain confidentiality;

9. we may also disclose personal data to government authorities or law enforcement if required by law, to comply with legal obligations, or to protect our or others’ legal interests.

Our website uses cookies, including third-party cookies, to enhance functionality and analyze site traffic.

When visiting the site for the first time, you can choose which cookie categories to allow (except for essential cookies, which are always used), and change your preferences at any time.
For more details, please see our Cookie Policy.

We implement appropriate technical and organizational security measures to protect personal data.

Access to the data is granted only to authorized staff and partners (e.g., spa specialists, massage therapists, or partner organizations such as spa salons) who need it to perform their professional duties.

If you have given consent for the use of your testimonial, photograph, video or audio recording, such materials are also processed in accordance with confidentiality and data protection principles. Access is granted only to authorized employees and engaged specialists or organizations involved in the creation, processing, or publication of such materials (e.g., administrators, designers, content managers, or agencies), and only to the extent necessary to perform their duties.

All such individuals and organizations are required to maintain confidentiality and use the data exclusively within the scope of providing services or performing tasks on behalf of our company.

You have the right to:

• access your personal data;
• request corrections or deletion of your data;
• request restriction of data processing;
• withdraw your consent (if data is processed based on consent);
• file a complaint with the Data State Inspectorate (https://www.dvi.gov.lv).

To exercise your rights, please contact us at: info@calma.lv or info@thespa.lv
We will respond to your request within one month.

We retain personal data no longer than necessary for the purposes for which it was collected, or as required by law.

Order and payment-related data is retained for up to 10 years in accordance with accounting and tax regulations of the Republic of Latvia.

Testimonials, photographs, video or audio recordings provided with your consent are stored until you withdraw your consent or as long as necessary for their intended use (e.g., marketing), unless otherwise required by law.

Technical cookies may be stored for up to 365 days. Analytics cookies are retained in accordance with the policies of the respective service provider (e.g., Google).

If you have any questions or comments regarding our Privacy Policy, please contact us at: info@calma.lv or info@thespa.lv