PRIVACY POLICY

Last updated: March 3, 2026

This Privacy Policy describes how ABEKSS SIA (“we”, “us”, “our”) collects and uses your personal data when you interact with our Website. This includes browsing, shopping, creating an account, contacting us, subscribing to marketing emails, and using our services (like greeting cards and gift wrapping).

This policy is designed to meet transparency requirements under the EU General Data Protection Regulation (GDPR) and relevant Latvian law. For details about cookies, pixels and similar technologies (including consent settings), please see our Cookie Policy and your cookie settings page: https://balticgifts.com/#consent-change

Our Website is intended for users who are at least 16 years old. We do not knowingly collect or solicit personal information from children under 16. If you are under 16, please do not submit any personal information to us. Parents and guardians should supervise their children’s online activity to ensure compliance with this policy.

We reserve the right to modify or amend this Privacy Policy at any time. Any changes will be effective immediately upon posting on this page.

Our full Website address is: https://balticgifts.com

1. Who we are

Data Controller: ABEKSS SIA
Registration number: 40103400229
Address: Kungu street 7/9, Riga, LV-1050, Latvia
Phone: +371 27734599
E-mail: info@abekss.lv

For all data protection matters and to exercise your GDPR rights, please contact us at info@abekss.lv

2. Who this Privacy Policy applies to

This Privacy Policy applies to:

Website visitors
Customers (guest checkout and registered users)
Account holders (“My Account”)
Newsletter subscribers
People who contact our customer support
Customers who use optional services (e.g., greeting card text printing, gift wrapping)
Customers choosing delivery or in-store pickup (where available)

We operate from Latvia and ship worldwide except Russia, Belarus and North Korea.

We may add new services or features; this policy will continue to apply unless a separate notice is provided.

3. What personal data we collect

We collect personal data in three main ways:
(A) data you provide,
(B) data collected automatically, and
(C) data from third parties involved in fulfilling your order.

3.1 Data you provide to us

Depending on how you use the Website, we may process:

Identity and contact details: name, email address, phone number
Order and checkout details: items purchased, quantities, prices, discounts, VAT details, order notes
Delivery details: shipping method, parcel locker selection (if applicable), delivery address (required for courier delivery)
Billing details: billing address and invoice information
Account data (if you create an account): username, saved addresses, order history
Consent records: the log of cookie-consent choices
Passwords are stored in a hashed form (we do not store plain-text passwords).
Customer support communications: messages you send us and our responses
Marketing preferences: newsletter subscription status and consent records
Greeting card / gift wrap services (optional): greeting card text you enter, gift wrap selections and related order information
(Note: the greeting message may contain personal data depending on what you write.)

We do not intentionally collect special category data (sensitive data) such as health data or political opinions.

Please do not include sensitive information in free-text fields (e.g., Greeting card text or Order notes during check-out).

3.2 Data we collect automatically (technical data)

When you browse our Website, our systems may automatically receive:

IP address and general network information
Device and browser data (e.g., browser type, operating system, screen resolution)
Log data (date/time of access, pages viewed, error logs)
Session/cart identifiers necessary to keep your cart and check-out working
Consent information (e.g., whether you accepted or rejected certain cookie categories), managed via our consent tool

3.3 Data from third parties

To fulfill purchases and operate our services, we may receive or process data via:

Payment providers (payment status, transaction references)
Shipping providers (shipment tracking events/status updates)
Marketing/analytics providers (only where you have consented to cookies/trackers; see Cookie Policy)

We may receive order-status updates from shipping carriers (e.g., tracking numbers) that contain the recipient’s name and address.

4. Why we process personal data, purposes and legal bases

Under GDPR, we must have a legal basis for each processing activity. The main legal bases we rely on are:

Contract (GDPR Art. 6(1)(b)) – to process and deliver your order and provide requested services
Legal obligation (Art. 6(1)(c)) – e.g., accounting/tax and consumer law requirements
Legitimate interests (Art. 6(1)(f)) – e.g., operating a secure and reliable Website, preventing abuse
Consent (Art. 6(1)(a)) – e.g., marketing emails and non-essential cookies/trackers

4.1 Purposes (overview)

We process personal data to:

Operate the Website and provide core e-commerce functionality (Cart, Check-out, Account)
Process orders, payments, refunds, and provide customer service
Deliver goods / arrange parcel locker delivery / courier delivery / pickup
Meet legal obligations (accounting, tax, consumer law, dispute handling)
Protect the Website and prevent fraud/abuse
Send transactional messages (order confirmations, shipping updates)
Send marketing emails/newsletters (only when you have opted in)
Measure and improve the Website and marketing using analytics/advertising tools (only when you consent via cookie settings; see Cookie Policy)

4.2 Legitimate interests

Where we rely on legitimate interests, our interests typically include keeping the Website secure and stable, preventing fraud and abuse, and maintaining and improving our services.

Where we rely on legitimate interests, we consider the impact on your rights and have assessed that our interests are not overridden by your interests or fundamental rights and freedoms.

You can object to processing based on legitimate interests (see Section 10).

We are the data-controller for all personal data collected on this site; the third-party services listed in this section act as data-processors who only process your data on our documented instructions under a Data-Processing Agreement.

We do not sell your personal data to any third parties.

We share personal data only with third parties that are necessary to run the web-store, fulfill orders, provide site functionality, comply with legal obligations, or to send marketing communications. The list below groups the recipients by the purpose of the sharing and, for each, tells you what data are transferred, why we do it (legal basis) and what safeguards apply.

5.1 Payment providers

Payment providers may process personal data under their own privacy terms and may act as independent controllers for certain processing.
Depending on your chosen payment method, payment-related data is processed by:

We send the order amount, currency, buyer’s e-mail address and shipping address so PayPal can process the payment.
Legal basis: performance of a contract (Art. 6 (1)(b) GDPR).
PayPal is an independent controller; its own privacy terms apply.

We transmit the card-holder’s name, billing address, e-mail and a token that represents the card (the actual PAN never touches our server).
Legal basis: performance of a contract (Art. 6 (1)(b) GDPR).
Klix is an independent controller; its own privacy terms apply.

Name, address and bank-account details (IBAN, BIC) when you choose a bank-transfer or we need to issue a refund.
Legal basis: performance of a contract (Art. 6 (1)(b) GDPR).

5.2 Shipping and delivery providers

Based on the shipping method you select, we share the necessary delivery information (typically name, phone, email, and where required, address) with:

Recipient name, address, phone number and order reference so the carrier can deliver the parcel. Legal basis: performance of a contract (Art. 6 (1)(b) GDPR).

The same data are sent; the address may be omitted if a locker is used.
Legal basis: performance of a contract (Art. 6 (1)(b) GDPR).

The carriers may retain the data for their own statutory periods (e.g., customs, tax).

If you select a courier delivery, a physical address is required.
If you select a parcel locker, an address may not be required, but you may still enter one.

5.3 Email marketing and communications

All providers listed in this section are bound by Data-Processing Agreements (DPAs).

E-mail address (and optionally name/phone if you supplied them) for newsletters and campaign-performance statistics.
Legal basis: explicit consent (Art. 6 (1)(a) GDPR). You can unsubscribe at any time.

When you contact us by e‑mail or sign up for our newsletter through the forms on the website, we collect and securely store the following information:
* E‑mail address (mandatory)
* Name and phone number (optional, only if you provide them)

Purpose – The data are used exclusively to:
* Respond to your inquiry or support request;
* Manage your subscription to our newsletter;
* Send you occasional marketing or promotional messages about new products and services only if you have given explicit consent.

Legal basis –
* Performance of a contract / legitimate interest (Art. 6 (1)(b) GDPR) for replying to a support request;
* Explicit consent (Art. 6 (1)(a) GDPR) for any marketing‑related e‑mail. Consent is obtained via the tick‑box in the sign‑up form and can be withdrawn at any time by clicking the “unsubscribe” link in every newsletter or by contacting us at shop@balticgifts.com.

Data retention –
* E‑mail address, name and phone number are retained for as long as you remain subscribed or until you request deletion.
* If you have not subscribed for more than 24 months we automatically archive the data and delete it after an additional 6 months, unless a longer retention is required for legal or accounting reasons.

Security – All personal data are stored in encrypted databases and accessed only by authorised staff. Transmission of e‑mail data is protected by TLS 1.2+ (HTTPS).

Third‑party sharing – We do not share your newsletter data with any external marketing providers. The only third parties that may process the data are our e‑mail service provider (e.g., Mailchimp) under a Data‑Processing Agreement; they are bound by the same GDPR obligations.

5.4 Website-infrastructure, hosting, DNS, CDN & backups

We do not publish detailed security configurations. We use these providers to ensure availability, performance, backup/recovery, and security of the Website.

We use service providers to host and operate the Website and to keep it secure and reliable. These providers may process technical data such as IP address, device/browser information, and server logs, and may process other personal data to the extent necessary to provide their services.

Server‑side files, database, and e‑commerce functionality (e.g., product catalog, checkout, order data) –
Essential for the Website to be reachable and for you to place orders. Without this service the Webstore could not exist.
Legal basis: performance of a contract (Art. 6 (1)(b) GDPR).

Technical logs – IP address, device/browser information, timestamps, error logs, firewall alerts, DDoS‑mitigation data. Used to keep the Website available, detect and prevent fraud or abuse, and comply with tax/accounting obligations.
Legal basis: legitimate interest in ensuring the availability, performance and security of the website (Art. 6 (1)(f) GDPR).

Authoritative DNS – only the IP address of the recursive resolver (the DNS server that asked Cloudflare for our domain) is logged; the visitor’s own IP is never seen. The log is truncated (last octet for IPv4, last 80 bits for IPv6) and automatically deleted after no more than 25 hours.
Legal basis: legitimate interest in ensuring continuous domain availability, performance and security (Art. 6 (1)(f) GDPR). International-transfer safeguard: the short-lived, truncated IP data are transferred to the United States under the EU-U.S. Data-Privacy Framework.

Technical cookies – “vary” cookies (_lscache_vary) and private-cache identifiers (PHPSESSID, lsc_private) that are strictly technical and only help deliver the correct cached page.
Legal basis: legitimate interest in optimizing website performance and reducing server load (Art. 6 (1)(f) GDPR).

Visitor IP address and request headers so our images can be delivered quickly worldwide.
Legal basis: legitimate interest in fast, reliable content delivery (Art. 6 (1)(f) GDPR). International-transfer safeguard: EU-U.S. Data-Privacy Framework.

Serve open-source JavaScript and CSS libraries; request logs contain the visitor’s IP address and user-agent string, but the CDNs themselves do not set cookies.
Legal basis: legitimate interest in performance optimisation (Art. 6 (1)(f) GDPR). International-transfer safeguard: EU-U.S. Data-Privacy Framework.

Maintenance & Backups – Full site database (order data, customer e-mails and other personal data) stored on servers in the EEA or the United States.
Legal basis: performance of a contract (Art. 6 (1)(b) GDPR) and legitimate interest in business continuity (Art. 6 (1)(f) GDPR). International-transfer safeguard: Standard Contractual Clauses (SCCs) for the U.S. copies.

5.5 Analytics, advertising & marketing partners

We utilize services from third-party data processors, including Google, Microsoft, and Meta, to provide certain website functionalities and services. These processors, who handle personal data on our behalf, are responsible for complying with their own privacy regulations and ensuring the protection of user data. We have entered into data processing agreements with these providers to ensure they meet our requirements for data security and privacy.

We use the GTM platform together with the GTM4WP WordPress plugin to inject and control every third‑party tracking script on our site. GTM is only a container that loads the tags we have configured (Google Analytics 4, Google Ads, Microsoft Clarity, Meta Pixel, etc.). GTM itself never collects, stores or processes any personal data; it simply forwards the data that the individual tags capture to the corresponding service providers. Because GTM acts only as a conduit, the personal data it handles are the same data that each downstream tag sends, and GTM does not add any identifying information of its own.
Legal basis: legitimate interest in operating a tag-management system (Art. 6 (1)(f) GDPR).

Through GTM we deploy Google Analytics 4, a web‑analytics service provided by Google LLC. GA4 records pseudonymised information – the visitor’s IP address is automatically rounded to the city level before it is stored, so the data can no longer be linked to an individual without additional information. The categories of data collected are:
* Approximate city‑level location (pseudonymised IP)
* Device type, operating system and browser version
* Pages viewed, clicks, scroll depth, session duration
* E‑commerce conversion events (purchase amount, product IDs, order reference)

Purpose of processing: measuring site performance, improving user experience, and evaluating marketing‑campaign effectiveness.

Legal basis: explicit user consent obtained through the Real Cookie Banner (Art. 6 (1)(a) GDPR). International-transfer safeguard: EU-U.S. Data-Privacy Framework; data are automatically deleted after 14 months.

International‑transfer safeguard: EU‑U.S. Data‑Privacy Framework (Google is certified under the framework).
Retention: Google automatically deletes the data after 14 months.
Processor status: Google acts as a data processor under a DPA that requires it to handle the pseudonymised data only on our instructions and to maintain appropriate security.

We use Google Ads to run paid-search and display advertising campaigns. The connection is made inside Google’s own dashboard (no Google-Ads script or plugin is placed on our website).
When you give consent for “marketing” cookies, the Google Analytics 4 tag automatically forwards the following data to Google Ads through Google’s internal API:
* Pseudonymised IP address (rounded to city level)
* Device and browser information (type, operating system, screen resolution)
* Pages visited on our site (URL, timestamps)
* Conversion-related events (e.g., “Add-to-Cart”, “Purchase”, product-ID, order amount)

Legal basis for Google Ads –
* If you have explicitly consented to marketing/advertising cookies via the Real Cookie Banner, the processing is based on consent (Art. 6 (1)(a) GDPR).
* If you have not consented, only non-personalised (contextual) Google-Ads are shown; in that case the processing relies on legitimate interest (Art. 6 (1)(f) GDPR) and you may object at any time (see Section 5.8).

International-transfer safeguard –
* Transfers to the United States are covered by the EU-U.S. Data-Privacy Framework (DPF) that Google has certified.

Retention –
* Google retains the data according to its own advertising-policy (typically up to 24 months). We do not store the data after it is sent to Google.

User-control / opt-out –
– You can withdraw consent for marketing cookies at any time via the Real Cookie Banner.
– You may also opt-out of personalised Google Ads directly in your Google Ads settings: https://adssettings.google.com/authenticated
– For a browser-based block you can install the Google Ads Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).

Joint-controller? No – Google acts solely as a data processor for the advertising service; we remain the controller of the personal data we collect.

Records device and browser information, screen resolution, click‑paths, scroll depth and anonymised session recordings – no raw IP address is stored. The recordings are therefore not linked to an identifiable individual.
Legal basis: explicit user consent (Art. 6 (1)(a) GDPR).
International-transfer safeguard: EU-U.S. Data-Privacy Framework; recordings are retained for 12 months.

Sends event names (AddToCart, Purchase, etc.), device/browser data and an approximate city‑level location to Meta Platforms Ireland Ltd. When an e‑mail address is available it is hashed before transmission, making it unreadable without the original hashing key. This means the data are pseudonymised for the purpose of ad measurement and delivery.
Legal basis: explicit user consent (Art. 6 (1)(a) GDPR). Joint-controller relationship: we and Meta Platforms Ireland Ltd are joint controllers for these activities (Art. 26 GDPR). The essential terms are set out in Meta’s Page-Insights Controller Addendum (https://www.facebook.com/legal/terms/page_controller_addendum). International-transfer safeguard: EU-U.S. Data-Privacy Framework; data are retained for 180 days.

Plugin synchronises product SKUs, names, prices, order IDs and hashed customer e-mail addresses with Facebook Business Manager for dynamic ads and checkout. The hashing makes the e‑mail addresses pseudonymised, so they cannot be used to identify an individual without the original key.
Legal basis: explicit user consent for marketing (Art. 6 (1)(a) GDPR).
Joint-controller relationship and safeguards: same joint‑controller arrangement and EU‑U.S. Data‑Privacy Framework as the Meta Pixel; data are retained for 180 days (aligned with the Meta Pixel).

Creates an encrypted, non-identifiable signature from the visitor’s IP address and user-agent to count unique visitors; no cookies are used and no personal data that can identify an individual are stored.
Legal basis: legitimate interest in analyzing aggregated website usage (Art. 6 (1)(f) GDPR).

The visitor’s IP address is automatically included in the request to Google’s CDN for performance logging.
Legal basis: legitimate interest in ensuring consistent visual presentation of the site (Art. 6 (1)(f) GDPR). International-transfer safeguard: EU-U.S. Data-Privacy Framework.

The request for the static image includes the visitor’s IP address.
Legal basis: legitimate interest in providing location information (Art. 6 (1)(f) GDPR). International-transfer safeguard: EU-U.S. Data-Privacy Framework.

Details (including cookie categories and how to withdraw consent) are provided in our Cookie Policy.

For more information about how these companies process your data, please refer to their respective privacy policies:
Google’s Privacy Policy
Microsoft’s Privacy Policy
Meta’s Privacy Policy

5.6 Legal recipients

Courts, law-enforcement, regulators and other authorities – we disclose any personal data that is required to comply with a legal obligation, protect our legal rights, or respond to a lawful request.
Legal basis: legal obligation (Art. 6 (1)(c) GDPR).

We only disclose the minimum data necessary to comply with the request.

5.7 Data-processing agreements & safeguards

Where a third-party acts as a data processor on our behalf (Google, Microsoft, Meta, Cloudflare, QUIC.cloud, jsDelivr, UNPKG, ManageWP, etc.) we have entered into Data-Processing Agreements (DPAs) that obligate them to:
– process personal data only on our documented instructions,
– implement appropriate technical and organisational security measures, and
– respect the GDPR principles of purpose limitation, data minimisation, etc.

All transfers of personal data to the United States (Google, Meta, Microsoft, Cloudflare, QUIC.cloud, jsDelivr, UNPKG) rely on the EU-U.S. Data-Privacy Framework as the adequacy safeguard. ManageWP’s U.S. backups are protected by Standard Contractual Clauses (SCCs).

5.8 Your rights & how to exercise them

Consent management – All analytics and marketing tags (GA4, Clarity, Meta Pixel, Facebook for WooCommerce) are blocked until you give explicit consent via the Real Cookie Banner. You may withdraw or modify that consent at any time using the banner widget.

Google Analytics – install the Google Analytics Opt-out Browser Add-on.
Google Ads – use the Google Ads Opt-out Browser Add-on (or manage your ad-personalisation settings at https://adssettings.google.com/authenticated).
Microsoft Clarity – install the Microsoft Clarity Opt-out Extension.
Meta Pixel – use the Meta Pixel Opt-out Browser Extension.

You have the right to:

Access the personal data we hold about you,
Rectify inaccurate data,
Erase (right to be forgotten),
Restrict processing,
Object to processing.

To exercise any of these rights, please contact our customer service at shop@balticgifts.com.

We will respond to any request exercising your data-subject rights within one calendar month, and up to two months where the request is complex or we receive a large number of requests, in accordance with GDPR Art. 12(3).

You may also lodge a complaint with the supervisory authority (see Section 10.2)

6. International data transfers (outside the EEA)

Some of the service providers we use (for example, providers of analytics, advertising, email marketing, maintenance, or backups) may process personal data outside the European Economic Area (EEA), including in the United States.

When personal data is transferred outside the EEA, we rely on appropriate safeguards such as:
EU Standard Contractual Clauses (SCCs): These are approved by the European Commission and impose specific obligations on data exporters and importers to protect personal data.
Other valid transfer mechanisms: We may also use other mechanisms recognized under GDPR for transferring data outside the EEA, where appropriate and applicable. We will use these mechanisms in accordance with all legal requirements.

Backups: while we strive to keep backups primarily within the EEA, some providers may use geographically diverse infrastructure, meaning backups may be stored in various EEA countries, such as Latvia and Germany. Backups may also be stored outside the EEA, including the United States.
We rely on appropriate safeguards such as EU Standard Contractual Clauses (SCCs) to protect personal data transferred outside the EEA.

Backups may be stored for up to 3 months (depending on configuration and provider).

We regularly review the adequacy status of the EU-U.S. Data-Privacy Framework and will adapt our safeguards if the status changes.

7. How long we keep personal data (retention)

We keep personal data only as long as necessary for the purposes described above, including legal and accounting obligations. After the retention period ends, data is deleted or anonymized unless we have a legal obligation or another legitimate reason to retain it longer (for example, for legal claims).

We retain personal data for the following periods:

Completed and refunded orders: 5 years (Latvian Accounting Law, Section 12; tax/accounting record-keeping)
Customer accounts: 3 years after last activity
Failed payment attempts: 60 days
Cancelled orders: 1 day
Customer service records: 3 years
Technical/security logs: typically 90 days (for security, troubleshooting, and abuse prevention)
Backups and deletion requests: If you request deletion, we will delete personal data from our active systems where applicable. Deleted data may remain in backups for a limited period (typically up to 3 months) until backups are rotated/overwritten, after which it will be deleted.
Legal hold: We may retain data beyond the periods above if it is necessary for legal proceedings, investigations, or to establish, exercise, or defend legal claims.

8. Do you have to provide personal data?

Required for purchases (contract necessity): if you place an order, we need certain data such as your name, contact details, and (where applicable) delivery address so we can process payment, deliver goods, and provide customer support.
Required for courier delivery: a physical address is required when you choose courier delivery.
Optional: creating an account is optional (guest checkout is available). Optional fields (e.g., order notes, greeting card text) are not required unless you choose those services.
Marketing and cookies: subscribing to marketing emails and accepting non-essential cookies (statistics/marketing/functional third-party content) is optional. You can use the Website even if you refuse non-essential cookies, although some embedded content may not load until you consent.

If you refuse to provide mandatory data, you will not be able to complete a purchase.

9. How we protect personal data (security) and data breaches

We use appropriate technical and organizational measures to protect personal data, including:

HTTPS/TLS encryption for data transmission and payments
Access controls and strictly limited staff access to any personal data
Regular updates and maintenance of the Website and plugins
Backups and recovery measures

Data breaches: If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and affected individuals as required by GDPR.

No method of transmission or storage is 100% secure, but we work to protect data using reasonable safeguards appropriate to the risks.

Depending on your situation, you have the right to:

Access your personal data
Correct inaccurate or incomplete data
Delete your personal data (with some legal exceptions)
Restrict processing
Data portability (for data processed based on contract or consent, where applicable)
Object to processing based on legitimate interests
Withdraw consent at any time (this does not affect processing already carried out)

10.1 How to exercise your rights (including account deletion)

If you have an account, you can access and update certain information in your account area.

Account deletion: You can request deletion of your account and personal data by contacting our customer service at shop@balticgifts.com.
Where self-service deletion is available in the account area, you may also use that functionality.
We may ask for additional information to verify your identity before fulfilling a request.
We will respond without undue delay. In most cases, we respond within a few business days, and in any event within one month of receiving your request, as required by the GDPR.

If your request is particularly complex or if we receive multiple requests, we may need more time (up to an additional two months). If so, we will inform you within the first month and explain why an extension is needed.

10.2 Right to lodge a complaint (Latvia)

You have the right to lodge a complaint with the Latvian supervisory authority:
Datu valsts inspekcija (Data State Inspectorate, “DVI”)

Address: Elijas street 17, Riga, LV-1050, Latvia
Website: https://www.dvi.gov.lv/
Email: info@dvi.gov.lv
Phone: +371 6722 3131

If you live in another EEA country, you can also contact your local supervisory authority.

11. Cookies Policy

We believe in giving you control over your privacy. We use cookies on our Website to provide you with a better browsing experience and personalized content.

To manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents, we use the consent tool “Real Cookie Banner”. Details on how “Real Cookie Banner” works can be found at https://devowl.io/rcb/data-processing/.

The legal basis for the processing of personal data in this context are Art. 6 (1) (c) GDPR and Art. 6 (1) (f) GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

You can choose to accept or reject certain cookies through our cookie settings tool at any time.
For more information about our cookie practices, please read our Cookies Policy.

12. Changes to Privacy Policy

We reserve the right to make changes to the Privacy Policy at any time by posting it on the Website. Any version of the Privacy Policy published on the Website supersedes all previous versions of the Privacy Policy and shall be effective immediately upon publication.

CONTACT INFORMATION

If you have any questions, comments or requests regarding our Privacy Policy,
please contact us by writing to shop@balticgifts.com or info@abekss.lv

You can also contact us by calling or sending mail to our office:
Address: Kungu street 7/9, Riga, LV-1050, Latvia
Phone: +371 27734599

BY PRICE

BY RECIPIENT

POPULAR

THEMES

COLLECTIBLES

PRIVACY POLICY

1. Who we are

2. Who this Privacy Policy applies to