Privacy Policy
Last updated: June 10, 2026
This Privacy Policy explains how Raivo Ernstreits, operating under the trade name Formful ("we", "us", or "our"), collects, uses, and protects your personal data when you visit theformful.com (the "Website"). We are committed to protecting your privacy in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and applicable Latvian data protection law.
1. Data Controller
The data controller responsible for your personal data is:
Raivo Ernstreits, self-employed person (saimnieciskās darbības veicējs), registered in the Republic of Latvia
Trade name: Formful
Email: contact@theformful.com
Website: https://theformful.com
2. Data We Collect
2.1 Data You Provide
When you contact us through our contact form or email, we collect your name, email address, and the content of your message. When you make a purchase, we collect your name, billing address, email address, and payment information (processed securely by Stripe — we do not store card details ourselves).
2.2 Data Collected Automatically
When you visit the Website, we may automatically collect technical data including your IP address, browser type and version, operating system, referring URL, pages visited, and the time and date of your visit. This data is collected through server logs, cookies, and analytics tools (see Section 6).
3. Legal Basis for Processing
We process your personal data on the following legal grounds under Article 6 GDPR:
— Contract performance (Article 6(1)(b)): to process orders and deliver services you have requested.
— Legitimate interests (Article 6(1)(f)): to improve the Website, prevent fraud, and ensure security.
— Consent (Article 6(1)(a)): for analytics cookies and marketing communications, where you have given explicit consent.
— Legal obligation (Article 6(1)(c)): where required by applicable law.
4. How We Use Your Data
We use your personal data to:
— Respond to enquiries and provide customer support
— Process and fulfil orders and payments
— Send transactional emails related to your order
— Analyse Website usage to improve functionality and content
— Comply with legal obligations including tax and accounting requirements
— Detect and prevent fraud or abuse
5. Data Sharing and Third Parties
We do not sell or rent your personal data. We share data only with trusted service providers acting as data processors on our behalf:
— Stripe, Inc. — payment processing. Data may be transferred to the United States under Standard Contractual Clauses. Privacy policy: stripe.com/privacy
— Vercel, Inc. — website hosting and analytics. Privacy policy: vercel.com/legal/privacy-policy
— Google LLC (Google Analytics 4) — website analytics, only if you have consented to analytics cookies. Data may be transferred to the United States under Standard Contractual Clauses. Privacy policy: policies.google.com/privacy
— Sanity AS — content management system. Data is processed in the European Economic Area. Privacy policy: sanity.io/legal/privacy
We may disclose personal data if required by law, court order, or to protect our rights, property, or safety.
6. Cookies
We use cookies and similar tracking technologies. For full details, please see our Cookie Policy. You can manage your cookie preferences at any time via the cookie consent banner on our Website.
7. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy or as required by law. Order and payment data is retained for seven (7) years in accordance with Latvian accounting law. Enquiry data is retained for two (2) years from the date of last contact. Analytics data is retained in accordance with the respective service provider's retention policy.
8. International Transfers
Some of our service providers are based outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as EU Standard Contractual Clauses approved by the European Commission.
9. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
— Right of access: to obtain a copy of the personal data we hold about you
— Right to rectification: to request correction of inaccurate data
— Right to erasure: to request deletion of your data (subject to legal exceptions)
— Right to restriction: to request that we limit how we use your data
— Right to data portability: to receive your data in a structured, machine-readable format
— Right to object: to object to processing based on legitimate interests
— Right to withdraw consent: at any time, where processing is based on consent
To exercise any of these rights, contact us at contact@theformful.com. We will respond within 30 days. You will not be charged for exercising your rights.
10. Right to Lodge a Complaint
If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the Latvian supervisory authority:
Data State Inspectorate (Datu valsts inspekcija)
Blaumana iela 11/13-11, Riga, LV-1011, Latvia
Website: dvi.gov.lv
Email: pasts@dvi.gov.lv
11. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or destruction, including HTTPS encryption, access controls, and regular security reviews.
12. Children's Privacy
Our Website is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page indicates when the Policy was last revised. We encourage you to review this page periodically. Continued use of the Website after changes constitutes acceptance of the updated Policy.
14. Contact
For any questions or requests regarding this Privacy Policy or your personal data, please contact us at: contact@theformful.com