Privacy policy

Who we are

This website is operated by SIA "Male Grooming" (brand "Lumberjack Barbershop"). Registration number: 40103900666. VAT number: LV40103900666. Registered address: Gunāra Astras iela 8 k-1 - 83, Riga, LV-1082, Latvia. For any questions about personal data, contact: info@lumberjack.lv. We are the data controller for the data we collect on this website.

What data we collect and where from

Site content is managed in Sanity CMS, which does not store visitor personal data.

Why we process data (legal basis)

Performance of a contract (GDPR Art. 6(1)(b)): processing bookings and providing services. Consent (GDPR Art. 6(1)(a)): communication via forms, and analytics and advertising cookies. Legitimate interests (GDPR Art. 6(1)(f)): site security, anti-bot protection, technical logs.

Analytics and advertising cookies are used only if you have accepted them in the consent banner. You can withdraw consent at any time.

Who we share data with

We use trusted processors that handle data only on our behalf: Altegio (bookings), Vercel (hosting), Upstash (caching), Resend (email delivery), Cloudflare (anti-bot), Telegram (receiving leads), Google (visit analytics and advertising performance, only with consent). We do not sell personal data to third parties.

Data transfers outside the EU

Some processors (Vercel, Cloudflare, Telegram, Google) may process data outside the European Economic Area. In such cases we rely on the European Commission's Standard Contractual Clauses (SCC) to ensure an adequate level of data protection.

How long we keep data

Booking data: while the client is active, no longer than 24 months after the last visit. Form submissions: until the enquiry is resolved, no longer than 12 months. Analytics data: per Google settings (e.g. up to 14 months). Technical logs: short-term, for security purposes.

Your rights

You have the right to access, rectify, erase, restrict processing of, object to processing of, and port your data, and to withdraw consent at any time (including analytics and advertising cookies via the cookie settings on the site). To exercise these rights, contact info@lumberjack.lv.

If you believe your rights have been violated, you may lodge a complaint with the supervisory authority: Datu valsts inspekcija (State Data Inspectorate of Latvia, www.dvi.gov.lv).

Data security

We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or disclosure, including encrypted connections (HTTPS) and anti-bot protection.

Contact and updates

For questions about this policy, contact info@lumberjack.lv.

Google Ads Enhanced Conversions

What we collect: the email and phone you enter in the online booking form. What we do with it: turn it into an irreversible cryptographic code (SHA-256) directly in your browser. The email and phone themselves never reach Google. We only send a digital fingerprint from which the original data cannot be recovered. Who we share it with: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be processed on Google servers outside the European Economic Area under Standard Contractual Clauses (SCC) approved by the European Commission. Why: to understand which ads bring real Lumberjack Barbershop clients and to avoid spending budget on campaigns that do not work. Legal basis: your consent. Works only when you have accepted the "Advertising" category in the cookie consent window. Without consent, fingerprints are not created or sent anywhere. Retention period: per Google Ads policy, about 540 days from the moment of transfer. How to withdraw consent: open the cookie settings on the site ("Cookie settings" link in the footer) and uncheck the "Advertising" category. From that moment on, booking form data will no longer reach Google. How to request deletion of already transferred data: write to info@lumberjack.lv and we will process your request. You can also submit a request directly through the Google Data Subject Request form: support.google.com/policies/troubleshooter/7575787. Separately: when you arrive from an ad (URL contains a gclid parameter), we log for 7 days in our cache a hash of your IP address (SHA-256 with a secret salt), user-agent, referer and URL path, to detect invalid clicks and protect the ad budget from automated fraud. Legal basis: legitimate interest (GDPR Art. 6(1)(f)). The raw IP is not stored.