Privacy Policy

The “Retro Auto Muzejs” Association, Reg. No. 40008169205, legal address: Kantora iela 22A, Riga, LV-1002 (hereinafter referred to as the “Association”) has created this website to inform the general public about its activities, the latest news from the museum it operates, as well as to provide the opportunity to purchase tickets, souvenirs, and other goods or services online

The purpose of this Privacy Policy is to explain the purposes for which the Association collects personal data, the scope of its collection and processing, data protection measures, data retention periods, and the rights of data subjects during the collection and processing of their data.

The Association’s Privacy Policy applies to every natural person whose personal data is processed by the Association, and it applies to the processing of personal data regardless of the form in which you or any other individual have provided such data: electronically, on paper, or in any other form.

When processing personal data, the Association complies with the applicable laws and regulations of the Republic of Latvia, the most relevant of which, in matters of data processing, are Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), and the Law on the Processing of Personal Data.

All rights (including property rights and copyrights) to the website belong to the Association. The data subject (a person who visits the website created by the Association) acknowledges that any infringement of the aforementioned rights is punishable by law.

By beginning to use this website, the data subject confirms that he or she has read the Privacy Policy.

If the data subject does not agree to the terms of use of the website or the provisions of the Privacy Policy, but continues to use the website, the data subject is deemed to have consented to the processing of personal data as described in the Privacy Policy.

The Association is the data controller. For questions regarding the processing of personal data, you may contact the Association by email at karlisorleans@gmail.com, by writing to the Association’s registered address, or by phone at (+371 29393327).

1. Collection of Personal Data

The Association processes personal data received from the data subject, publicly available information, online banks, and payment service providers. The categories of personal data processed by the Association depend primarily on the activities carried out by the data subject—visiting the website, communicating with the Association, purchasing tickets or goods, participation in events organized by the Association, etc.

2. Personal Data Processed and the Purpose of Data Processing

The Association processes personal data in order to achieve the Association’s data processing purpose. The Association does not request or collect information about an individual that is not necessary to achieve a specific objective of the Association.

The association processes the following categories of personal data:

• first name, last name, address, email address, phone number – to facilitate and maintain contact, and to communicate on various matters.
• first name, last name, personal identification number, address, and bank account information—for the purpose of carrying out various legal transactions. In cases where data processing is related to making payments through a financial or payment institution, please review the privacy policy of the service provider (e.g., a bank);
• Transaction details – purchased goods or services (e.g., tickets, souvenirs), delivery address, price, payment information, and other information necessary for processing, paying for, and delivering the order;
• images in photo or video format—from video surveillance conducted on the Association’s premises where the museum is located, as well as from photographs and video recordings taken during events organized by the Association;
• Cookies – see below for a more detailed description of the cookies used on the Association’s website.

The association may also hold various types of personal data in the form of documents, publications, printed materials, literature, videos, and photographs (typically—first name, last name, photograph) related to the museum’s exhibits, the history of the exhibits, and events in Latvia. For example, if you have been involved in a lifestyle related to the museum’s themes, the Association may also hold the following personal data about you: first name, last name, photograph, information about your participation in events (races, reunions), and information about the restoration, repair, or other activities involving vehicles in which you were involved. Generally, in such cases, personal data is of secondary importance and closely related to the museum’s main theme—vintage vehicles and their history; however, in certain cases, data regarding individuals who are significant to this field or to the history of a particular vehicle may be more extensive and unusual (for example, a detailed description of a person’s “rituals” or habits before a race).

3. Legal Basis for Data Processing

The Association processes your personal data on the following legal grounds:

• Consent of the data subject (you) —for example, when registering for an event organized by the Association. You have the right to withdraw your consent to the collection, processing, and use of your personal data at any time;
• Performance of the Agreement – when entering into any legal transaction with the Association, including donating an item to the Association, making a donation, receiving payments from the Association, or paying for goods or services provided by the Association (including purchasing tickets or souvenirs online), registering for events;
• Compliance with regulatory requirements —data is collected and stored to ensure compliance with the requirements set forth in a regulatory act, such as compliance with accounting regulations;
• Respect for the legitimate interests of the Association or other individuals— since the Association collects various types of information about vintage vehicles and their history, the Association may have at its disposal, in various formats (publications, printed materials, literature, videos, and photographs)—such as the following personal data: first name, last name, photograph, information about participation in events (races, rallies), information regarding the restoration, repair, or other activities involving the vehicle in which you participated. Generally, in such cases, personal data is of secondary importance and closely related to the museum’s main theme—vintage vehicles and their history; however, in certain cases, data regarding individuals significant to this field or the history of a specific vehicle may be more extensive. Such data processing occurs through the collection and storage of data that has come into the Association’s possession as a result of communication or during the process of acquiring items for the collection.

The association also processes personal data obtained through video surveillance to prevent criminal offenses (as a preventive measure, information about video surveillance is posted at the entrance to the museum grounds) and detection (in cases where a criminal offense is suspected), and to protect property (to ensure that no damage is caused to the property of the Association, museum visitors, or third parties).

The association’s public events are filmed and photographed to inform the public about the museum’s offerings, achievements, and latest news.

The Association’s legitimate interests, which form the basis for the aforementioned data processing, are security, the protection of its own interests, and the performance of its museum functions.

4. Payment Processing and Transfer of Personal Data to the Payment Platform

Payment processing is provided by the payment platform https://makecommerce.lv; therefore, our company transfers the personal data necessary for processing payments to the platform’s owner, Maksekeskus AS.

When making a payment on the Association’s website, your payment data (such as first name, last name, contact information, the bank selected for the payment, or card details, transaction amount) are transferred for processing to Maksekeskus AS (registered in Estonia), which acts as an independent data controller with regard to payment processing and anti-fraud measures. More detailed information on how Maksekeskus AS processes personal data is available in the platform’s privacy policy: https://makecommerce.lv/noteikumi/.

Bank card details (card number, expiration date, CVC code) This information is not provided to the Association, nor does the Association store it—this data is processed solely by a certified payment service provider in accordance with the PCI DSS standard.

5. Cookies

A cookie is a small file that a website stores on your computer or mobile device when you visit the site (including the museum’s website).

Cookies are stored on the data subject’s device only if you consent to it (unless the cookies are necessary for the technical functioning of the website). However, please note that if the data subject does not consent to the use of cookies, certain features of the website (including the shopping cart and payment functionality) may not function properly or may not work at all.

The legal basis for the use of cookies is the Association’s legitimate interest in ensuring the technical functionality of the website, i.e., the operation of the shopping cart. The website uses cookies to analyze user activity (Google Analytics cookies).

The following cookies are used to ensure the proper functioning of the association’s website:

• Essential cookies— required to browse the website and use its features, such as remembering information entered into forms during a session, ensuring the shopping cart functions properly, and facilitating the payment process. Without these cookies, it would not be possible to provide certain website services. These cookies are stored on your device until you close your web browser.
• Functional cookies— these help the website remember the user’s settings and preferences to make it easier to use the site later. These cookies are stored on the device permanently.
• Analytical cookies – collect information about how the website is used and identify the most frequently visited sections, including the content selected while browsing the site. This information is used for analytical purposes to improve the website’s functionality.
• Target Audience Selection — allows us to track users’ visits to the site, the pages they visited previously, and the links they clicked. This information is used to ensure that the ads displayed match users’ interests.

The association uses cookies to:

• save visitors’ settings;
• to ensure the website functions properly, including the shopping cart and payment features;
• compile analytical data (visitor statistics);
• ensure that ads tailored to users’ needs are displayed on other websites.

You can delete cookies at your discretion. Cookies are stored on your device temporarily or until you manually delete them. Users of the Association’s website can delete all cookies already stored on their device and can configure their browser settings to prevent cookies from being stored. In that case, you must manually select the option to not store cookies each time you visit the Association’s website. However, please be aware that some services and features of the Association’s website may not function properly.

You can opt out of Google Analytics cookies by downloading and installing the Google Analytics Opt-out Browser Add-on. This add-on communicates with Google Analytics to indicate that information about your visit to this website should not be sent to Google Analytics. You can make the necessary changes here: https://tools.google.com/dlpage/gaoptout

6. Transfer of Personal Data

In order to fulfill its legal obligations, the Association may disclose personal data to law enforcement agencies, as well as to state and local government agencies, in the cases specified by law.

In order to properly fulfill its obligations and to protect its legitimate interests, the Association may transfer personal data to other parties (data processors) to the extent necessary to carry out the relevant activities, for example:

• to the payment service provider—Maksekeskus AS (MakeCommerce platform)—for online payment processing;
• for accounting service providers—to maintain accounting records and comply with the requirements of tax laws and regulations;
• for courier services and delivery service providers—to deliver ordered goods;
• To IT service providers—for website maintenance and technical support;
• volunteers—to ensure the museum’s operations.

The Association’s cooperation partners may process personal data only in accordance with the Association’s instructions and may not use personal data for any purpose other than the fulfillment of their obligations on behalf of the Association. These processors are required to maintain an appropriate level of personal data protection.

7. Retention Period for Personal Data

Personal data is processed for as long as necessary to fulfill the purpose of the processing. The retention period is justified by the contract, the Association’s legitimate interests, applicable laws and regulations, or for as long as the data subject’s consent to data processing remains valid, unless there is another lawful basis for processing personal data.

Personal data processed on the basis of the data subject’s consent (for example, to send the latest news) is stored and processed for this purpose until the data subject withdraws their consent.

Personal data related to transactions (invoices, orders, payment confirmations) is retained for as long as required by the Accounting Law and other regulatory acts.

Once the data retention period expires, the data is permanently destroyed or anonymized.

8. Rights of the Data Subject

In accordance with the General Data Protection Regulation and the laws of the Republic of Latvia, the data subject has the right to:

• to receive the information specified in regulatory acts regarding the processing of their personal data by the Association.
• request access to your data and receive a copy of it;
• request the correction of incorrect, inaccurate, or incomplete personal data;
• request the deletion of your personal data (“the right to be forgotten”), except in cases where the law requires the data to be retained;
• withdraw previously given consent to the processing of personal data;
• in certain cases, object to data processing or restrict data processing;
• to receive your personal data in a structured, commonly used format (data portability);
• file a complaint with the State Data Inspectorate.

A data subject may exercise their rights only on the basis of a written request (including one signed with a secure electronic signature). The Association will respond within the time limit specified in the applicable laws and regulations. The Association will review the data subject’s complaint in accordance with the requirements of applicable laws and regulations. If a resolution cannot be reached, the data subject has the right to file a complaint with the State Data Inspectorate (www.dvi.gov.lv).

9. Final Provisions

When processing and storing personal data, the Association implements organizational and technical measures to ensure the protection of personal data against accidental or unlawful destruction, alteration, disclosure, and any other unlawful processing.

You can contact the Association by writing to its legal address – Kantora iela 22A, Riga, LV-1002, by calling (+371 29393327), or by emailing karlisorleans@gmail.com.

The association may amend this policy, and any changes will be posted on this website.

The Cookie Policy was last updated on May 20, 2026.