Privacy Policy

Last updated: July 31, 2026

This Privacy Policy describes how cardozone collects, uses, and protects your personal information when you visit our website and book tours of the medieval castles of Turaida and Cēsis from Riga. We are committed to protecting your privacy and handling your data responsibly and transparently.

Who We Are

We are the data controller responsible for your personal information. We operate guided day tours to medieval cardozone ruins in Latvia, offering immersive experiences at Turaida cardozone and Cēsis cardozone departing from Riga. When you interact with us through bookings, inquiries, or visits to our website, we collect and process certain information to provide our services effectively.

Information We Collect

We collect information in several ways:

• Booking Information: When you book a tour, we collect your name, email address, phone number, date of birth, and payment details.
• Contact Form Data: If you contact us with questions or inquiries, we collect the information you provide in your message.
• Website Usage: We collect information about how you interact with our website, including pages visited, time spent, and clicks.
• Technical Data: We automatically collect your IP address, browser type, device type, and operating system.
• Cookies: We use cookies to enhance your browsing experience and analyze website performance.

Legal Basis for Processing

We process your personal information on the following legal bases:

• Contract Performance: We process your booking and payment information to fulfill our tour services that you have requested.
• Legitimate Interests: We analyze website usage and improve our services based on your interaction data. We also maintain security and prevent fraud.
• Consent: Where required, we process information based on your explicit consent, particularly for marketing communications and non-essential cookies.
• Legal Obligation: We may process data to comply with applicable laws, tax requirements, and regulatory obligations in Latvia.

How We Use Your Information

We use your personal information for the following purposes:

• Processing and confirming your tour bookings and payments
• Sending you tour confirmations, reminders, and updates
• Responding to your inquiries and customer support requests
• Improving our website, tours, and services based on your feedback
• Analyzing website traffic and user behavior to optimize performance
• Sending promotional materials and newsletters (only with your consent)
• Preventing fraud, ensuring security, and protecting our legal interests
• Complying with legal and regulatory obligations

Data Retention

We retain your personal information for specific periods based on the purpose of processing:

• Booking and Transaction Data: We retain booking information for up to 36 months after your tour date to manage refunds, handle disputes, and maintain financial records.
• Contact Form Inquiries: Messages submitted through our contact form are retained for up to 24 months after your last interaction with us, or until your inquiry is resolved.
• Website Analytics and Cookies: Analytics data and non-essential cookies are retained for up to 13 months from collection.
• Server Logs: Technical logs containing IP addresses and access information are retained for up to 12 months.
• Marketing Communications: If you consent to newsletters, we retain your email address until you unsubscribe or withdraw consent.

After these periods, we securely delete or anonymize your data unless we are required by law to retain it longer.

Your Rights

You have the following rights regarding your personal information:

• Right of Access: You can request a copy of all personal data we hold about you.
• Right to Rectification: You can correct or update inaccurate information.
• Right to Erasure: You can request deletion of your data in certain circumstances, subject to legal retention obligations.
• Right to Restrict Processing: You can ask us to limit how we use your information.
• Right to Data Portability: You can request your data in a structured, portable format.
• Right to Object: You can object to marketing communications and certain processing activities.
• Right to Withdraw Consent: You can withdraw consent for non-essential cookies and marketing at any time.

To exercise any of these rights, contact us using the information provided below.

Cookies and Tracking

We use cookies to improve your website experience. Essential cookies are necessary for website functionality and are always active. Analytics cookies help us understand how you use our site. Marketing cookies allow us to show you relevant content. You can manage your cookie preferences through your browser settings. For more detailed information about cookies, please refer to our separate Cookie Policy.

Data Security

We implement industry-standard security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction. Our website uses SSL encryption for all data transmission. Payment information is processed through secure payment gateways that comply with PCI Data Security Standards. However, no online transmission is completely secure, and we cannot guarantee absolute security.

Third-Party Sharing

We do not sell your personal information to third parties. We may share your information with trusted service providers who assist us in operating our website and providing tours, such as payment processors, email service providers, and analytics platforms. These providers are contractually obligated to use your information only as necessary to provide services to us. We may also disclose information when required by law or to protect our legal rights.

International Data Transfers

Your information is primarily stored and processed in Latvia within the European Union. We comply with EU data protection regulations and do not transfer data outside the EU without appropriate safeguards. Any transfers that do occur are protected by adequacy decisions or standard contractual clauses.

Children's Privacy

Our services are not directed to children under 13 years old. We do not knowingly collect personal information from children. If we become aware that a child has provided us with personal information, we will delete such data and notify the parent or guardian. Parents or guardians who believe their child has provided information to us should contact us immediately.

Supervisory Authority

If you have concerns about our data protection practices, you have the right to lodge a complaint with the Data Protection Authority of Latvia (Datu Valsts Inspekcija). This is a free process, and you can submit a complaint even if you have contacted us first.

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of our website and services after updates constitutes your acceptance of the revised policy.