The Wrist Rest · Your information
Privacy Policy
How we handle information when you visit The Wrist Rest, place an order or contact us.
1. Who we are
Thewristrest.com is operated by SIA Ruby Holdings. We are responsible for the personal information we process through this store.
Company: SIA Ruby Holdings, trading as The Wrist Rest.
Registered address: Daugavgrīvas iela 132k-1, 18, Riga, Latvia.
Registration number: 40203502655.
Email: info@thewristrest.com.
Website: https://thewristrest.com.
2. Orders, payments and customer support
When you place an order, we collect the information needed to process and deliver it: your name, email address, billing and shipping addresses, phone number where supplied, selected products and variations, order notes, totals and order status. We also keep payment references and transaction status to handle payments, refunds and disputes.
We use this information to fulfil your purchase, communicate about delivery, answer questions and handle returns. Where a legal basis is required, this is necessary for performing our contract with you or taking steps you request before ordering. Tax, accounting and other mandatory records are processed to meet legal obligations.
We use relevant technical and transaction information, including IP address, browser details and request logs, to operate and secure the store, prevent fraud and investigate problems. Our legal basis is our legitimate interest in a reliable and secure service, balanced against your privacy rights. Information you provide in a support message is used to respond to that request.
Please do not include medical information or other unnecessary sensitive details in order notes or messages. Required checkout fields are needed to process the order; without them we may be unable to complete payment or delivery. Guest checkout is available.
3. Comments and product reviews
When visitors leave comments or reviews, we collect the information entered in the form, together with the visitor’s IP address and browser user agent to help detect spam. A published review or comment, including the display name you provide, is visible to other visitors.
An anonymised string created from your email address, also called a hash, may be provided to Gravatar to check whether you use that service. Read Automattic’s Privacy Policy. After a comment is approved, your profile picture may be visible with it. Moderation and spam prevention are carried out for our legitimate interest in operating a trustworthy public feedback feature.
4. Media
If you upload images to a public area of the website, avoid including embedded location data, such as EXIF GPS data. Other visitors may be able to download public images and extract embedded information. Do not include personal information in an image that you do not want others to see.
6. Embedded content and external links
Pages may include content from other websites, such as videos or images. Embedded content can behave as though you visited the other website directly. Those services may collect information, use cookies and track your interaction, especially if you are logged into their service. Their own privacy policies apply to their processing. Opening an external link also takes you to a service we do not operate.
7. Who receives information?
Authorised store administrators and service providers receive information needed to operate the website, fulfil orders, arrange delivery, process payments or support you. This can include hosting and technical support providers, delivery or fulfilment partners, and accounting or legal advisers. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.
Stripe: payments are processed through Stripe and the payment method selected at checkout. Information necessary for payment processing, authentication, fraud prevention, refunds and disputes is shared with these providers. Payment credentials are entered through their payment interface. Read Stripe’s Privacy Policy for its processing and international-transfer arrangements.
If you request a password reset, your IP address may be included in the reset email. Visitor comments may be checked by an automated spam-detection service.
The site uses caching to improve loading speed. Temporary cached copies and technical logs may be held by our hosting and technical service providers. These are used for operating and supporting the service.
8. International processing
Payment and technical providers may process information outside Latvia or the European Economic Area. Where the GDPR applies, a transfer must have a lawful mechanism, such as an adequacy decision or appropriate contractual safeguards. You can contact us for information about the providers and safeguards relevant to your information, and how to obtain a copy where applicable.
9. How long we retain information
We keep order, payment and support records for the purposes described above, including completing orders, dealing with returns or disputes, complying with accounting and tax obligations, and protecting legal rights. The applicable retention period depends on those purposes and legal requirements. Our store currently has no automatic WooCommerce deletion period configured for order or account records; records may remain until they are manually reviewed, deleted or anonymised.
If you leave a comment, the comment and its metadata may be retained indefinitely so that follow-up comments can be recognised and moderated. You can request deletion, subject to any lawful reasons for retaining particular information.
For users with an account, we store the profile information they provide. Users can view and edit their profile information, except their username. Store administrators can also access it. You can contact us to request deletion of an account or personal information; some order records may need to be retained for legal reasons.
10. Your rights
Where applicable data protection law provides these rights, you can request access to, correction of, erasure of or restriction of your personal information; object to processing based on legitimate interests; and request a portable copy of eligible data. If processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing.
Email info@thewristrest.com to make a request. We may need to verify your identity before releasing or changing records. Erasure does not require us to delete records we must retain for legal obligations or legal claims. We normally respond to GDPR rights requests within one month, subject to the extensions allowed by law.
You can also complain to Latvia’s Data State Inspectorate, or the competent data protection authority in your country.
11. Changes and contact
We may update this policy when the website or our information-handling practices change. The updated date appears at the top of this page. For questions about this policy or your information, contact SIA Ruby Holdings using the details in section 1.