Last updated: 4 October 2026
This Privacy Policy explains what personal data we collect when you visit or buy from linenowl.com (the "Website"), why we collect it, who receives it, how long we keep it and what rights you have. We follow the EU General Data Protection Regulation (GDPR) and the Personal Data Processing Law of the Republic of Latvia.
Who we are
The controller of your personal data is SIA "LUKI", the company behind LinenOwl:
- Registration No. 41503024162, VAT No. LV41503024162
- Legal address: Sporta iela 20, Līvāni, Līvānu nov., LV-5316, Latvia
- E-mail: info@linenowl.com
Write to this address about anything in this policy, including to use your rights.
What we collect and why
| Purpose | Data | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Taking, paying for and delivering your order | Name, delivery and billing address, e-mail, phone number, what you ordered, payment status | Contract, Art. 6(1)(b) | Orders and invoices: 5 years, as Latvian accounting law requires |
| Accounting and tax | Invoice data | Legal obligation, Art. 6(1)(c) | 5 years |
| Your customer account, if you create one | Name, e-mail, password (stored scrambled, so that we cannot read it), saved addresses, order history | Contract, Art. 6(1)(b) | Until you ask us to delete the account; order records as above |
| Answering your messages and handling returns and complaints | Name, e-mail, the message, the order it is about | Contract, Art. 6(1)(b), and our legitimate interest in resolving claims, Art. 6(1)(f) | 2 years after the last message, the period in which a consumer can claim for non-conforming goods |
| Newsletter, only if you subscribe | Consent, Art. 6(1)(a) | Until you unsubscribe (the link is in every newsletter) | |
| Website analytics, only if you accept analytics cookies | Pages viewed, approximate location, device and browser, the page you came from | Consent, Art. 6(1)(a) | Google keeps it for at most 14 months |
| Showing prices with the tax of your country before you enter an address | IP address, looked up in a database on our own server; nothing is sent to anyone | Legitimate interest in showing the price you will pay, Art. 6(1)(f) | The IP address is not stored; the country found is kept in the shop cookie |
| Keeping the Website secure and free of spam | IP address, pages requested, browser; for blocked form submissions also the e-mail address entered | Legitimate interest in a secure website, Art. 6(1)(f) | Server logs: 14 days. Blocked form submissions: 8 weeks |
To deliver an order we need your name, delivery address and e-mail address; without them we cannot accept the order. Everything else is optional.
Most of this data comes from you. We also receive the payment status from the payment provider. The customer reviews shown on product pages are copied from our Etsy shop, with each reviewer's name shortened.
We do not sell your data and do not use it for advertising. We do not ask for special categories of data (such as health or religion); if you send us such data by accident, we delete it.
Payments
Card, PayPal and Link payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). You enter your card details on Stripe's form: we never receive or store your card number. If you pay with PayPal, PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) also processes the payment. Stripe screens card payments for fraud automatically; if a payment is declined, write to us and you can pay by bank transfer instead. For a bank transfer we see the payer's name and account details on our bank statement.
Apart from that fraud check, we make no decisions about you by automated means alone.
Who receives your data
- Hetzner Online GmbH, Germany: hosts the Website. The server is in Nuremberg, Germany.
- Our e-mail hosting provider in Latvia: stores the e-mails we send and receive.
- Stripe and, if you choose it, PayPal: process your payment (see above).
- The postal operator that delivers your parcel: VAS "Latvijas Pasts" and, abroad, the postal service of the destination country. They receive your name, address and, where needed for delivery, your phone number and e-mail.
- Our accountant, for bookkeeping.
- Google Ireland Limited: Google Analytics, only if you accept analytics cookies.
- Public authorities, such as the State Revenue Service, when the law requires it.
Our service providers may use your data only to provide their service to us.
Transfers outside the EU
Google and Stripe may process data in the United States. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognizes as giving adequate protection; where that does not apply, they use the European Commission's standard contractual clauses. A parcel sent outside the EU necessarily passes your name and address to the postal service of the destination country.
Cookies
A cookie is a small file a website stores in your browser. This website uses two kinds.
Cookies the shop needs. They keep your cart, your login and your checkout working, so they are set without asking. They are not used to follow you on other websites.
| Cookie | Set by | Purpose | Kept for |
|---|---|---|---|
| PrestaShop-… | linenowl.com | Your cart, language, currency, country and login | 20 days |
| PHPSESSID | linenowl.com | Technical session of the shop's server | Long-lived (shop software default) |
| lo_consent | linenowl.com | Remembers your cookie choice | 6 months |
| __stripe_mid, __stripe_sid | Stripe, at checkout only when you pay by card | Fraud prevention for card payments | 1 year; 30 minutes |
Analytics cookies, only with your consent. If you choose "Accept" in the cookie banner, Google Analytics (Google Ireland Limited) sets cookies that count visits and show which pages are viewed. We use this to learn which pages are useful. If you choose "Reject", no analytics cookies are set: Google Analytics then receives only a cookieless signal that a page was viewed, with no identifier stored in your browser.
| Cookie | Set by | Purpose | Kept for |
|---|---|---|---|
| _ga | Google Analytics | Tells one visitor from another | 2 years |
| _ga_HZPBEXBTQQ | Google Analytics | Keeps track of the current visit | 2 years |
We do not use advertising or social network cookies. The links to social networks on this website are plain links: nothing from those networks loads until you click one.
You can change your choice at any time with "Cookie settings" at the bottom of every page. Choosing "Reject" there also deletes the analytics cookies already set. You can delete any cookie in your browser settings as well.
Your rights
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you;
- have incorrect data corrected;
- have your data deleted, unless the law requires us to keep it (for example invoices);
- restrict how we use your data while a question about it is being resolved;
- receive the data you gave us in a machine-readable format, or have it sent to another company;
- object to processing based on our legitimate interest;
- withdraw your consent at any time (newsletter, analytics cookies). This does not affect what was done before you withdrew it.
If you have an account, you can see and change most of your data on your account page. For anything else, write to info@linenowl.com. We reply within one month. We may ask you to confirm your identity first, so that we do not give your data to someone else.
Complaints
If you think we handle your data wrongly, please write to us first and we will try to put it right. You also have the right to complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija), Elijas iela 17, Riga, LV-1050, www.dvi.gov.lv, or to the data protection authority of the EU country where you live or work.
Changes to this policy
When we change this policy, we publish the new version here and update the date at the top.