Last Updated: December 9th, 2025

1. Introduction

SIA "BUYONE" ("we," "us," or "our"), incorporated in Latvia (Reg. No. 40203518800), is the data controller for the BuyOne application ("Service"). We are committed to protecting your privacy. By using our Service, you acknowledge the practices described below.

2. Data We Collect

We collect data to provide and improve our Service. This includes:

• Account Data: Name, email address, phone number, mailing address, age, gender, and your marketing communication preferences.
• Financial Data: Payment details are processed directly by our PCI-DSS compliant payment partners; we do not store your credit card data.
• Device & Usage Data: IP address, device type, connection speed, and browser type collected automatically for security and analytics.
• Optional User Content: Photos or media, only if you grant Camera/Gallery permissions. You may revoke these permissions at any time in your device settings.
• Location Data: GPS data (if enabled) to provide location-based services and relevant content.

3. Legal Basis and Purpose of Processing

Under the GDPR, we process your data based on the following legal grounds:

• Performance of Contract: To process transactions, manage your account, and deliver products/services.
• Legitimate Interest: To improve our app, prevent fraud, ensure security, and for internal analytics.
• Consent: To send you newsletters, promotional offers, and updates. You are not required to provide this consent to use the Service, and you may withdraw it at any time.
• Legal Obligation: To comply with Latvian accounting and tax laws.

4. Data Sharing and Third Parties

We do not sell your data. We share data only with trusted third parties who assist in operating our Service, bound by confidentiality agreements:

• Service Providers: Hosting (e.g., AWS), email delivery, and customer support tools.
• Payment Processors: To facilitate secure payments.
• Analytics & Advertising: We use web analytics tools to understand app usage. These parties may collect data consistent with their own privacy policies.
• Legal Requirements: We may disclose data to Latvian law enforcement if required by a valid court order or subpoena.

5. International Transfers

Your data is processed in Latvia. If we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses (SCCs).

6. Data Retention

• General Account Data: Retained as long as your account is active.
• Deleted Accounts: If you delete your account, we delete or anonymise your personal data within 60 days, unless longer retention is required by law (e.g., 5-10 years for transaction records under Latvian accounting laws).

7. Your Rights (GDPR)

As an EU user, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Request deletion of your data (subject to legal retention requirements).
• Restriction: Request that we limit the processing of your data.
• Portability: Receive your data in a structured, machine-readable format.
• Objection & Opt-Out: You have the right to object to direct marketing at any time. You can unsubscribe from our newsletters by clicking the "unsubscribe" link at the bottom of any email or by contacting us. To exercise these rights, contact us at support@buyone.me.

8. Security

We use SSL encryption and strict access controls to protect your data. However, no method of Internet transmission is 100% secure, and we cannot guarantee absolute security.

9. Cookies and Tracking

We use cookies and local storage (Sessions) to authenticate users and analyse traffic. You can control cookies via your browser settings, though disabling them may affect app functionality.

10. External Links

Our Service may contain links to external sites that we do not operate. If you click on a third-party link, you will be directed to that third party's site. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

11. Children’s Privacy

Our Service is not directed at persons under 18. We do not knowingly collect data from minors. If we discover such data, we will delete it immediately.

12. Changes to This Policy

We may update this policy specifically to reflect changes in our practices or laws. We will notify you of material changes via the app or email. Continued use of the Service constitutes acceptance of the updated policy.

13. Dispute Resolution & Governing Law

This Policy is governed by the laws of the Republic of Latvia. The supervisory authority in Latvia is the Data State Inspectorate (www.dvi.gov.lv), which can be contacted by email at info@dvi.gov.lv. In the event of a concern, we encourage you to contact us first to resolve the issue amicably. If a resolution cannot be reached, the matter shall be subject to the jurisdiction of the Republic of Latvia.