Privacy & Data Governance Policy

Last Reviewed & Effective: January 1, 2026

1. Data Controller Identification

This Privacy Policy governs the processing of personal data by Pickora Baltic Expeditions SIA (Company Registration No. 40203389142), having its registered office at Baznīcas iela 14-3, Rīga, LV-1010, Latvia (hereinafter referred to as "the Controller", "we", "us", or "our"), operating under the brand name Pickorahappybundle across the domain pickorahappybundle.cyou.

We are fully dedicated to protecting the privacy rights of our visitors, readers, and expedition clients in strict compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or GDPR) and relevant Latvian data privacy statutes.

2. Categories of Personal Data Collected

We gather only the minimum necessary personal data required to deliver high-quality editorial content, route advisory services, and concierge correspondence:

  • Direct Contact Data: When submitting an inquiry through our concierge forms, we collect your full name, email address, topic of interest, and the voluntary narrative of your message.
  • Technical & Browsing Telemetry: Anonymized Internet Protocol (IP) address, browser type, operating system version, referring URLs, access timestamps, and device viewport metrics.
  • Cookie & Consent State: Records indicating whether you have accepted or customized our cookie preferences via the consent banner.

3. Legal Bases for Processing (GDPR Art. 6)

Your personal data is processed under the following lawful grounds:

  • Legitimate Interests (Art. 6(1)(f)): Maintaining server security, diagnosing technical errors, and defending against malicious web automated abuse.
  • Consent (Art. 6(1)(a)): For non-essential cookies and analytics cookies explicitly permitted via the consent interface.
  • Performance of Pre-contractual Measures (Art. 6(1)(b)): Responding to client inquiries regarding route consultation and bespoke concierge bookings.

4. Data Retention & Erasure

We maintain your personal data only for the duration strictly necessary to fulfill the purposes for which it was originally collected. Concierge email inquiries are retained for up to twenty-four (24) months for audit and correspondence integrity, after which they are irreversibly deleted from our active mail archives.

5. Your Statutory Rights Under GDPR

As a data subject within the European Economic Area, you possess comprehensive statutory rights:

  • Right of Access (Art. 15): Obtain confirmation as to whether your personal data is being processed and receive a copy thereof.
  • Right to Rectification (Art. 16): Require correction of inaccurate or incomplete personal records.
  • Right to Erasure / Right to be Forgotten (Art. 17): Request deletion of your data when retention is no longer justified.
  • Right to Restriction of Processing (Art. 18): Restrict the scope of data processing in disputed instances.
  • Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format.
  • Right to Object (Art. 21): Object at any time to processing based on legitimate interest grounds.

To exercise any of these rights, please contact our Data Protection Officer directly via email at [email protected].

6. Supervisory Authority Complaints

If you believe our data processing violates applicable data protection regulations, you possess the legal right to lodge a formal complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, Latvia (Website: www.dvi.gov.lv).