Data protection
This page adds the details the EU data protection rules (GDPR) ask for to our privacy policy: who is responsible for your data, why we use it, who we share it with, how long we keep it, and your rights.
Who is responsible
The controller of your personal data is SIA Efflo, registration No. 40203740926, registered address "Upeslīči", Tadaiķu pagasts, Dienvidkurzemes novads, LV-3440, Latvia. Email info@efflomatcha.com.
What we collect and why
When you order
Your name, email, phone number, delivery and billing address, what you ordered and how you paid. We use it to process, deliver and support your order, and to keep the accounting records the law requires. Card and bank details are handled by the payment provider you choose at checkout. We do not see or store your full card number.
Legal basis: performing our contract with you (GDPR Art. 6(1)(b)) and our legal obligations under Latvian accounting and tax law (Art. 6(1)(c)).
When you book a workshop or a matcha bar
Your name, contact details, and the date, place and size of the group, so we can plan and run it. Legal basis: the contract, or the steps you ask us to take before one (Art. 6(1)(b)).
When you write to us
Your message and contact details, so we can answer. Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), or the contract if it is about an order.
When you create an account
Your name, email, addresses and order history, so you can see your orders and check out faster. Legal basis: the contract (Art. 6(1)(b)).
When you sign up for our newsletter
Your email address, to send you news and offers. Legal basis: your consent (Art. 6(1)(a)). Every email has an unsubscribe link, and you can withdraw your consent at any time.
When you leave a review
The name you give, your review and rating, shown on our product pages. Legal basis: your consent (Art. 6(1)(a)).
When you browse the shop
Your IP address, device and browser, and the pages you visit. Necessary data keeps the shop working and secure (legitimate interest, Art. 6(1)(f)). Analytics and marketing data is only collected with your consent (Art. 6(1)(a)). See our cookie policy.
Who we share it with
Only with the companies that help us run the shop, and only what each needs:
- Shopify, which runs our online store, checkout, payments and analytics.
- The payment provider you choose at checkout.
- Our shipping platform and the delivery company you choose, such as Omniva, DPD, Smartposti, Venipak, Latvijas Pasts, LP Express or Unisend.
- Popupsmart, which shows pop-ups on our site.
- Our email service, for the newsletter.
- Our accountant, and public authorities when the law requires it.
They process the data on our behalf and under our instructions, or as controllers under their own privacy policies (payment providers and delivery companies).
Outside the EU
Some of these companies, Shopify among them, may process data outside the European Economic Area, for example in Canada or the United States. Where they do, the transfer is protected by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or by the Commission's standard contractual clauses.
How long we keep it
- Orders and invoices: as long as Latvian accounting and tax law requires.
- Messages and workshop bookings: as long as we need them to answer you and handle any claim.
- Your account: until you delete it or ask us to.
- Newsletter: until you unsubscribe.
- Cookies: as set out in our cookie policy.
Your rights
You have the right to see the personal data we hold about you, to have it corrected or deleted, to restrict how we use it, to object to its use, including for marketing at any time, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time; this does not affect what was done before.
To use any of these rights, email info@efflomatcha.com. We reply within one month. We may ask you to confirm who you are first.
If you think we handle your data wrongly, please tell us first. You can also complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija), www.dvi.gov.lv, or to the data protection authority in the EU country where you live.
Other things to know
You do not have to give us personal data, but without your name, address and email we cannot take and deliver an order. We do not make decisions about you by automated means alone that have legal or similarly significant effects, though payment providers may run automated fraud checks on payments. Our shop is not meant for children.
We may update this page when our shop or the law changes. The date below shows the latest version.
Last updated: 27 October 2026.