Last updated: 14 August 2026
Indibuy (“Indibuy”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store, disclose, and protect your personal data when you visit our websites, purchase products from us, create an account, contact us, subscribe to marketing communications, or otherwise interact with Indibuy.
This Privacy Policy is intended to comply with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable European Union and Latvian data protection laws.
1. Who We Are
The data controller responsible for the processing of your personal data is:
Business name: SIA “Indibuy” Trading name: Indibuy Country: Latvia Email: indibuy.lv@outlook.com Website: indibuy.lv
Where products are marketed under an Indibuy-owned brand or collection, including LunaLux, Indibuy remains responsible for the processing of personal data unless otherwise stated.
2. Personal Data We May Collect
Depending on how you interact with us, we may process the following categories of personal data:
2.1 Identity and Contact Information
This may include:
- Your name (First, last and/or middle name)
- Email address
- Telephone number
- Billing address
- Delivery address
- Country or region
2.2 Order and Transaction Information
When you place an order, we may process information including:
- Products ordered
- Order number
- Purchase date
- Order value
- Delivery method
- Payment status
- Returns and refunds
- Customer communications relating to the order
2.3 Payment Information
Payments may be processed by third-party payment service providers.
Depending on the payment method selected, the payment provider may collect information such as card details, bank information, payment authentication information, or other information necessary to complete the transaction.
Indibuy does not intend to directly store complete payment-card details where payment processing is handled by an authorized third-party payment provider.
The relevant payment provider may process your personal data according to its own privacy policy and legal obligations.
2.4 Delivery Information
To deliver your order, we may provide necessary personal data to postal, courier, parcel-terminal, fulfilment, or other delivery service providers.
This may include:
- Your name
- Delivery address or parcel-terminal selection
- Telephone number
- Email address
- Order or shipment reference
Only information reasonably required to arrange and manage delivery will be shared.
2.5 Account Information
If customer accounts are available on our website, we may process:
- Account login information
- Contact details
- Order history
- Saved addresses
- Account preferences
Passwords should be stored using appropriate security measures and should not be accessible to Indibuy in plain text.
2.6 Customer Service and Communications
If you contact us through email, social media, telephone, website forms, or another communication channel, we may process:
- Your name
- Contact details
- The content of your enquiry
- Previous correspondence
- Information necessary to resolve your request
2.7 Website and Technical Information
When you use our websites, certain technical information may be collected automatically, depending on the technologies and cookies used.
This may include:
- IP address
- Browser type
- Device type
- Operating system
- Pages visited
- Date and time of visits
- Referring website
- Website interactions
- Cookie identifiers
For further information about cookies and similar technologies, please see our Cookie Policy.
3. Why We Process Your Personal Data
We process personal data only where we have an appropriate legal basis.
Processing Your Orders
We use your personal data to:
- Accept and process orders
- Process payments
- Arrange delivery
- Send order and delivery communications
- Manage returns, refunds, and complaints
- Provide customer support
The principal legal basis for this processing is the performance of a contract or taking steps at your request before entering into a contract.
Meeting Legal Obligations
We may process and retain information where required to comply with legal obligations, including applicable accounting, taxation, consumer protection, fraud prevention, and regulatory requirements.
The legal basis is compliance with a legal obligation.
Operating and Protecting Our Business
We may process information where reasonably necessary to:
- Maintain website and information security
- Prevent or investigate fraud and abuse
- Protect our legal rights
- Resolve disputes
- Maintain appropriate business records
- Improve the reliability and security of our services
Where applicable, this processing is based on our legitimate interests, provided that those interests do not override your fundamental rights and freedoms.
Marketing
Where permitted by applicable law, we may send information about Indibuy products, collections, promotions, or offers.
Where consent is legally required, we will request your consent before sending such communications.
You may withdraw your marketing consent or unsubscribe from marketing communications at any time.
4. Cookies and Analytics
Our websites may use cookies and similar technologies for purposes such as:
- Providing essential website functionality
- Maintaining shopping-cart and checkout functionality
- Remembering user preferences
- Website security
- Measuring website performance and traffic
- Analytics
- Advertising and marketing, where applicable
Cookies that are not strictly necessary will be used only in accordance with applicable consent requirements.
More detailed information about the cookies and technologies used on our websites, their purposes, providers, and duration should be provided in our Cookie Policy and cookie-consent interface.
5. Who We May Share Personal Data With
We do not sell your personal data.
Where necessary for operating our business and providing our services, personal data may be shared with selected third parties, including:
- Payment service providers
- Banks and financial service providers
- Shipping and courier companies
- Parcel-terminal operators
- Website hosting providers
- E-commerce platform and technology providers
- Email and customer communication providers
- Accounting and professional service providers
- Analytics and advertising providers, where applicable
- Government, regulatory, law-enforcement, tax, or judicial authorities where legally required
Service providers that process personal data on our behalf are expected to process such information only for authorized purposes and subject to appropriate contractual and security requirements.
Some third parties, such as payment providers or delivery companies, may act as independent data controllers for certain processing activities.
6. International Transfers
We aim to use service providers that process personal data within the European Economic Area (“EEA”) where reasonably possible.
However, some technology or service providers may process personal data outside the EEA.
Where personal data is transferred outside the EEA, we will take appropriate measures required under applicable data protection law. Depending on the circumstances, these may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses, or another legally recognized transfer mechanism.
7. How Long We Keep Personal Data
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and as required by applicable law.
Retention periods may vary depending on the type of information and may be determined by:
- Accounting and tax requirements
- Consumer protection requirements
- Contractual obligations
- Warranty or return periods
- Fraud-prevention requirements
- Legal limitation periods
- The need to establish, exercise, or defend legal claims
When personal data is no longer required, we will delete, anonymize, or otherwise securely dispose of it, subject to applicable legal requirements.
8. How We Protect Your Information
We take reasonable technical and organizational measures designed to protect personal data against:
- Unauthorized access
- Unauthorized disclosure
- Accidental loss
- Alteration
- Destruction
- Misuse
These measures may include access controls, secure communications, appropriate authentication mechanisms, system updates, backups, and restrictions on access to customer information.
No internet-based service can guarantee absolute security. We therefore continually review appropriate safeguards according to the nature and risks of the processing.
9. Your Rights Under the GDPR
Subject to the conditions and exceptions established by applicable law, you may have the right to:
Access your data — Request information about the personal data we process about you and obtain a copy.
Rectify your data — Ask us to correct inaccurate or incomplete personal data.
Erase your data — Request deletion of your personal data where the legal requirements for erasure are satisfied.
Restrict processing — Ask us to restrict certain processing of your personal data.
Object to processing — Object to processing based on legitimate interests in circumstances provided by the GDPR.
Data portability — Receive certain personal data you provided to us in a structured, commonly used and machine-readable format and, where applicable, request its transmission to another controller.
Withdraw consent — Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Object to direct marketing — You may object to the use of your personal data for direct marketing at any time.
To exercise your rights, contact us at:
[PRIVACY/CONTACT EMAIL]
We may need to verify your identity before fulfilling certain requests.
10. Complaints
If you have concerns about how Indibuy processes your personal data, we encourage you to contact us first so that we can investigate and address your concerns.
You also have the right to lodge a complaint with the competent data protection supervisory authority.
For Indibuy’s establishment in Latvia, the relevant supervisory authority is:
Datu valsts inspekcija
(Data State Inspectorate of Latvia)
Elijas iela 17
Rīga, LV-1050
Latvia
11. Marketing Communications
If you subscribe to our newsletter or other promotional communications, we may use your contact information to send you information concerning:
- New products
- New jewelry collections
- Special offers
- Promotions
- Seasonal collections
- Indibuy or Indibuy-owned brand news
Where required, marketing communications will be sent based on your consent.
You can unsubscribe at any time using the unsubscribe mechanism included in marketing emails or by contacting us.
Withdrawing from marketing communications will not prevent us from sending transactional communications necessary to manage an existing order, payment, delivery, return, or customer-service request.
12. Social Media
Indibuy may maintain accounts on social-media platforms such as Instagram, Facebook, or other platforms.
When you interact with us through these platforms, the platform provider may separately process information about you according to its own privacy policy.
Where we receive personal data through social media, for example through a direct message or customer enquiry, we will process that information only as reasonably necessary for the relevant communication, customer-service request, marketing activity, or other lawful purpose.
13. Children’s Privacy
Our products and online store are intended for a general consumer audience and are not specifically directed toward children.
We do not knowingly seek to collect personal data directly from children for marketing purposes.
Where legally required, parental or guardian authorization may be required before processing a child’s personal data based on consent.
14. Third-Party Links
Our websites may contain links to third-party websites or services.
Indibuy is not responsible for the privacy practices of independent third parties. We recommend reviewing the privacy information provided by those organizations before submitting personal information to them.
15. Changes to This Privacy Policy
We may update this Privacy Policy when our business operations, website functionality, service providers, legal obligations, or data-processing activities change.
The latest version will be published on our website with the date of the most recent update.
Where a change materially affects how we process personal data, we will take reasonable steps to provide additional notice where required.
16. Contact Us
If you have questions about this Privacy Policy, how Indibuy processes personal data, or wish to exercise your data-protection rights, please contact:
Indibuy
SIA “Indibuy” Rīga, Latvia
Email: indibuy.lv@outlook.com
Important: This Privacy Policy should be reviewed whenever Indibuy introduces a new payment provider, delivery provider, analytics service, advertising platform, newsletter service, customer-account system, or other technology that processes customer personal data.