Privacy policy

Last updated: 11 September 2026

This Privacy Policy explains how MERCI CONCEPT SIA collects, uses, shares and protects personal data when you visit the Merci Beauté online store, create an account, place an order, contact us, subscribe to marketing, submit a review or otherwise interact with our services.

1. Who is responsible for your personal data?

The data controller is:

MERCI CONCEPT SIA
Registration No.: 40203729967
VAT No.: LV40203729967
Katrīnas dambis 27
Rīga, LV-1045
Latvia

Email: contact@mercibeaute.com

Our online store is hosted on Shopify. Shopify processes personal data in connection with operating the ecommerce platform and may, for certain features, process personal data as an independent controller.

More information about Shopify's privacy practices is available in Shopify's Privacy Policy.

2. Personal data we process

Depending on how you interact with us, we may process the following categories of personal data:

Identity and contact information: your name, billing and shipping address, email address and telephone number.
Order and transaction information: products ordered or viewed, cart information, order history, returns, refunds, delivery information, payment status and transaction identifiers.
Payment-related information: information made available to us by payment providers, such as payment status, amount, payment method and transaction reference. Full payment-card details are generally processed by the relevant payment provider and are not ordinarily available to us.
Account information: customer-account details, preferences and settings where you choose to create or use an account.
Communications: messages, support requests, complaints, return requests and other information you provide when communicating with us.
Reviews and other content: product reviews or other content you choose to submit through store features or service providers.
Technical and usage information: IP address, browser and device information, identifiers, pages viewed, interactions with the website and similar technical data.
Marketing and consent information: newsletter subscriptions, marketing preferences and records of consent or withdrawal where applicable.
Cookie and similar-technology data: information collected through necessary, analytics, advertising or similar technologies, subject to applicable consent requirements.

3. How we collect personal data

We collect personal data:

directly from you when you place an order, create an account, contact us, submit a review, join a mailing list or otherwise provide information;
automatically when you use our website, including through cookies and similar technologies;
from service providers that help us operate the store, process payments, deliver orders, provide customer-service or review functionality, prevent fraud, measure website performance or conduct marketing; and
from other parties where permitted by law and relevant to operating our business or protecting our rights.

4. Why we use personal data and our legal bases

Processing and fulfilling orders

We use identity, contact, order, delivery and transaction information to accept orders, process payments, arrange delivery, communicate about orders, manage returns and refunds, and provide customer service.

The main legal basis is the performance of a contract with you or taking steps at your request before entering into a contract.

Compliance with legal obligations

We process information where necessary to comply with tax, accounting, consumer-protection, product-safety, regulatory and other legal obligations.

The legal basis is compliance with a legal obligation.

Operating, securing and improving our store

We may process technical, usage, transaction and communication information to maintain the website, prevent misuse and fraud, protect our systems and customers, troubleshoot problems, understand service performance, respond to support requests and improve our operations.

Where consent is not required, we rely on our legitimate interests in operating a secure and effective ecommerce business, provided those interests are not overridden by your rights and freedoms.

Communicating with you

We use your contact information and communications to answer questions, handle complaints and provide service-related messages.

Depending on the context, this processing is necessary to perform a contract, comply with legal obligations or pursue our legitimate interests in providing customer support.

Marketing and advertising

Where required by law, we use your personal data for email marketing, personalised advertising and non-essential tracking only with your consent.

You can withdraw consent or unsubscribe at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Legal claims and protection of rights

We may process relevant information to establish, exercise or defend legal claims, enforce our terms, investigate misuse, and protect our rights or the rights of others.

Depending on the circumstances, the legal basis may be our legitimate interests or compliance with a legal obligation.

5. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some are necessary for the website, cart, checkout, security and customer-account functions to work. Other technologies may be used for analytics, advertising or personalisation.

Where applicable law requires consent for non-essential cookies or similar technologies, we use them only after the required consent has been obtained.

Where cookie or privacy controls are provided on the website, you can use them to manage your choices. You can also adjust your browser settings, although blocking necessary cookies may affect website functionality.

6. Who we share personal data with

We may share personal data with the following categories of recipients where necessary and lawful:

Shopify and ecommerce/hosting providers that operate the store and its technical infrastructure;
payment service providers that process or facilitate payments and payment security;
delivery, logistics and fulfilment providers that deliver orders or provide pickup-point services;
customer-service, review and store-functionality providers that help us provide features used by customers;
analytics, advertising and marketing providers, subject to applicable consent and privacy requirements;
IT, security, cloud and professional-service providers, such as accountants, legal advisers or other advisers where necessary;
public authorities, regulators, courts or law-enforcement bodies where disclosure is required by law or necessary to protect legal rights; and
parties involved in a business reorganisation, financing, acquisition or transfer, subject to appropriate confidentiality and legal safeguards.

Service providers that process personal data on our behalf are expected to process it only for the agreed purposes and in accordance with applicable data-protection requirements.

7. International transfers

Some service providers may process personal data outside Latvia or outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA and the destination is not covered by an adequacy decision, we use or rely on appropriate safeguards required by applicable law, such as the European Commission's Standard Contractual Clauses, together with additional safeguards where necessary.

8. How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Policy, including to fulfil orders, provide customer service, maintain appropriate business records, comply with tax, accounting and other legal obligations, resolve disputes and establish or defend legal claims.

Retention periods vary depending on the type of information and the legal or business reason for keeping it. For example:

order, invoice and transaction records may be retained for the periods required by applicable accounting, tax and consumer-protection laws;
customer-service and complaint correspondence is retained for as long as reasonably necessary to deal with the matter and any related legal obligations or claims;
account information is generally retained while the account remains active and for an appropriate period afterward where required for legitimate or legal purposes; and
marketing-consent records are retained as necessary to demonstrate your preferences, and marketing contact data is no longer used for marketing after you unsubscribe or withdraw consent, subject to limited records needed to respect that choice.

9. Your data-protection rights

Subject to the conditions and limitations of the GDPR and other applicable law, you may have the right to:

request access to your personal data;
request correction of inaccurate or incomplete personal data;
request deletion of personal data;
request restriction of processing;
receive certain personal data in a portable format and, where applicable, have it transmitted to another controller;
object to processing based on legitimate interests;
object at any time to processing of personal data for direct marketing;
withdraw consent at any time where processing is based on consent; and
lodge a complaint with a competent data-protection supervisory authority.

To exercise your rights, contact us at contact@mercibeaute.com.

We may need to verify your identity before acting on a request. We will respond within the time limits required by applicable law.

10. Marketing preferences

If you receive marketing emails from us, you can unsubscribe using the link included in the message or by contacting us.

Even if you opt out of marketing, we may still send non-promotional communications that are necessary for orders, customer service, legal notices or account administration.

11. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

No internet transmission or storage system can be guaranteed to be completely secure, so please avoid sending sensitive information through inappropriate or unsecured communication channels.

12. Children's data

Our store is intended for general consumer shopping and is not designed to knowingly collect personal data from children who are not legally able to provide the information or enter into the relevant transaction.

If you believe a child has provided personal data to us inappropriately, please contact us so that we can review the situation and take appropriate action.

13. Third-party websites

Our website may contain links to third-party websites or services.

Their privacy practices are governed by their own privacy notices, and we encourage you to review those notices before providing personal data to them.

14. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our services, technology, business practices or legal requirements.

The current version will be published on the website with an updated date. Where required by law, we will provide additional notice of material changes.

15. Contact and complaints

For privacy questions or to exercise your rights, contact:

MERCI CONCEPT SIA
Katrīnas dambis 27
Rīga, LV-1045
Latvia