Privacy policy
Last updated: 03 February 2026
1. Who we are
SIA efficientmorning.ai (Registration No. 40203557649, VAT No. LV40203557649), registered at Krišjāņa Barona iela 130‑k9‑17, Riga, LV‑1012, Latvia, trades online as HeroByName ("we", "our", "us"). We are the data controller for the personal data described in this notice.
Privacy enquiries & data‑subject rights requests: hello@herobyname.com
2. Personal data we collect
Category |
Typical examples |
|---|---|
Identity & Contact |
Name, postal & billing address, telephone, e‑mail |
Account details |
Login, hashed password, settings, saved carts |
Transaction data |
Items purchased, order ID, payment status, shipping method |
Payment tokens |
Card last‑four digits, PSP token (no raw card data is stored) |
Uploaded content |
Photo provided for personalisation, inscription text |
Device & usage |
IP address, browser type, time‑zone, click‑stream on our store |
Marketing preferences |
Newsletter opt‑in/out, cookie‑consent choices |
Advertising & conversion data |
IP address, browser and device information, advertising cookies and event identifiers, pages and products viewed, searches, cart and checkout activity, purchases, order value and currency. Where permitted and enabled, customer contact details such as name, email address, phone number and approximate location may be used for advertising event matching. |
3. Why we use your data & legal bases
Purpose |
Legal basis (GDPR) |
Process & ship your order |
Contract Art 6 (1)(b) |
Show previews & generate artwork |
Consent Art 6 (1)(a) |
Send service e‑mails, handle support |
Legitimate interest Art 6 (1)(f) |
Direct e‑mail marketing |
Consent Art 6 (1)(a) – you may withdraw anytime |
Book‑keeping, VAT, consumer‑law duties |
Legal obligation Art 6 (1)(c) |
Fraud prevention & network security |
Legitimate interest Art 6 (1)(f) |
Advertising measurement, conversion tracking & personalised advertising |
Consent — GDPR Article 6(1)(a). We use this data to measure advertising performance, attribute purchases, optimise campaigns and, where enabled, show relevant advertisements on Facebook and Instagram. Consent may be withdrawn at any time. |
4. Who processes the data
We share data only as needed with:
-
E‑commerce host – Shopify Inc. (Canada / USA)
-
Cloud VPS provider – EU datacentre
-
Image‑generation subcontractor – SCCs in place
-
Payment processor & anti‑fraud – PSP tokenises your card
-
Postal & courier partners – Latvijas Pasts and, at your choice, DHL/UPS
-
Professional advisers & legally required bodies (e.g. tax authority)
-
Advertising & measurement — Meta Platforms Ireland Limited (Facebook and Instagram). We may share advertising events and permitted customer information through Shopify's Facebook & Instagram by Meta integration, including Meta Pixel, Conversions API and Advanced Matching. The respective responsibilities for this processing are described in Section 7.
A full vendor list can be provided on request.
5. International transfers
Whenever data leaves the EEA we rely on:
-
Adequacy decision (Canada)
-
Standard Contractual Clauses (2021/914/EU) for transfers to the USA or Singapore. Copies of SCCs can be provided on request.
Information shared with Meta may be processed outside the European Economic Area (EEA). Where applicable, international transfers are subject to an adequacy decision or appropriate safeguards under the GDPR, including Standard Contractual Clauses where relevant. Further information is available in Meta's Privacy Policy.
6. Retention schedule
Data item |
Retention rule |
Uploaded photo |
Deleted same day the parcel ships |
Personalisation text/images |
Deleted 90 days after shipment (support and reprint window) |
Order & invoice records |
10 years (Latvian accounting law) |
Marketing e‑mail consent |
Until you unsubscribe |
7. Cookies & tracking
We use essential cookies and similar technologies to operate our website, maintain shopping carts, support checkout and provide other necessary functions.
With your consent, we may also use analytics and marketing technologies to understand how visitors interact with our store and measure the effectiveness of our advertising.
7.1. Meta Pixel, Conversions API & Advanced Matching
We use the Facebook & Instagram by Meta integration provided through Shopify. This may include Meta Pixel, which collects events through your browser, and Conversions API, which securely transmits certain events between servers.
Depending on your consent and our active settings, the information shared with Meta may include page views, product views, searches, cart activity, checkout events, purchases, order values, event identifiers, IP address, browser and device information, and advertising cookie identifiers.
Where Advanced Matching is enabled, customer information such as name, email address, phone number and location may also be processed to help Meta match advertising events. Certain identifiers may be hashed before transmission; hashing does not make personal data anonymous.
We use these technologies to measure advertising performance, understand which advertisements lead to purchases, optimise campaigns and, where enabled, create relevant advertising audiences, including remarketing.
7.2. Legal basis & your choices
The legal basis for optional marketing tracking and the related processing of personal data is your consent under Article 6(1)(a) GDPR. Where prior consent is required, including in the EEA, marketing tracking and associated advertising event sharing must not begin before you have given that consent.
You can accept, reject or manage optional cookies through our cookie banner. You can also change your choices or withdraw consent at any time using the Cookie preferences link in the website footer. Refusing optional tracking does not prevent you from purchasing our products.
Withdrawal of consent applies to future processing and does not affect the lawfulness of processing carried out before withdrawal.
7.3. Processing by Meta
Meta Platforms Ireland Limited receives data for advertising measurement and related services. For certain activities involving the collection and transmission of advertising event data, we and Meta act as joint controllers under Article 26 GDPR. This joint responsibility is limited to the relevant collection and transmission operations. Meta is responsible for its subsequent independent processing where applicable.
Meta may process information in accordance with its own Privacy Policy. Our advertising information and consent records are retained according to the applicable purposes, retention settings and legal requirements. Information received by Meta is subject to Meta's own retention practices.
Further information:
Meta Privacy Policy: https://www.facebook.com/privacy/policy/
Meta Controller Addendum: https://www.facebook.com/legal/controller_addendum
8. Your rights
Under GDPR (and similar laws) you may:
-
access, correct, erase or port your data;
-
object to or restrict certain processing;
-
withdraw consent at any time;
-
lodge a complaint with the Latvian Data State Inspectorate.