Privacy Policy

PRIVACY AND PERSONAL DATA PROCESSING POLICY

Effective date: 10 July 2026

1. General Provisions

This Privacy and Personal Data Processing Policy explains how SIA “BLAST SOVEREIGN A/T” collects, uses, stores, transfers and protects the personal data of visitors to LFbra.com, customers, prospective customers, company representatives, recipients of products and business partners.

LFbra.com is a B2B website intended primarily for persons purchasing products as part of their economic, commercial or professional activities.

The website provides information about products manufactured by SIA “BLAST SOVEREIGN A/T”, their characteristics and indicative prices. A customer may select products of interest and submit an enquiry through the website.

No payment is made directly through the website. After receiving and reviewing an enquiry, a manager contacts the customer, agrees the order terms and sends a commercial offer, order confirmation, pro forma invoice or invoice by email. Payment is made by bank transfer.

This Policy applies to the personal data of natural persons. Information relating solely to a legal entity does not in itself constitute personal data. However, the GDPR applies to information concerning company representatives, employees, board members, contact persons, sole traders, self-employed persons and other identifiable natural persons.

2. Personal Data Controller

The controller of personal data is:

SIA “BLAST SOVEREIGN A/T”
Registration number: 42103109011
Registered address: Ezermalas iela 9A, Liepāja, LV-3401, Latvia
Website: LFbra.com
Email: info@lfbra.com

In this Policy, SIA “BLAST SOVEREIGN A/T” is referred to as the “Company”, “we”, “us” or the “Seller”.

Questions regarding the processing of personal data or the exercise of data subject rights may be sent to:

info@lfbra.com

3. How the Website Works

The website operates on the OpenCart platform and may provide the following functions:

• browsing the catalogue of the Company’s own products;

• viewing product descriptions, specifications and indicative prices;

• adding products to a shopping cart or enquiry list;

• submitting a B2B enquiry;

• creating a customer account;

• viewing previously submitted enquiries or orders, where this functionality is available;

• communicating with a Company manager;

• subscribing to news where separate consent has been provided.

Adding products to the shopping cart and submitting a form through the website constitute a customer enquiry and do not automatically conclude a sales contract.

After receiving an enquiry, a Company manager may contact the customer to clarify:

• the company name and company details;

• the quantity of products;

• technical specifications;

• configuration;

• packaging;

• production times;

• delivery terms and delivery address;

• the applicability of VAT;

• other order terms.

The final terms of the transaction are agreed separately and specified in a commercial offer, order confirmation, pro forma invoice, invoice or contract.

4. Personal Data We Process

Depending on how a person interacts with the website and the Company, we may process the following categories of personal data.

4.1. Contact Details

• first name and surname;

• job title;

• name of the represented company;

• business email address;

• telephone number;

• correspondence address;

• preferred language and method of communication.

4.2. Customer Details

We may process:

• company name;

• registration number;

• VAT identification number;

• registered address;

• billing address;

• delivery address;

• country of registration;

• information about the person representing the company;

• other information required to prepare an offer or invoice and fulfil an order.

Where such information relates solely to a legal entity, it is not considered personal data. However, it may constitute personal data where it relates to a sole trader or self-employed person, or where it makes it possible to identify a particular natural person.

4.3. Enquiry and Order Data

We may process:

• selected products;

• product codes;

• quantities;

• technical specifications;

• configuration requirements;

• packaging requirements;

• customer comments;

• expected timeframes;

• delivery address and delivery terms;

• the content of an enquiry;

• commercial offers;

• order confirmations;

• pro forma invoices;

• invoices;

• delivery notes;

• information about production, order preparation and delivery;

• the history of order amendments and approvals.

4.4. OpenCart Account Data

If registration is available on the website, we may process:

• the user’s first name and surname;

• company name;

• email address;

• telephone number;

• delivery and billing addresses;

• encrypted password;

• registration date;

• date of the most recent login;

• enquiry and order history;

• account settings;

• IP addresses and technical login logs.

We do not have access to a user’s password in plain text.

The user is responsible for keeping their account login details confidential and must notify us immediately if unauthorised access is suspected.

4.5. Bank Payment Data

Payments are not made through the website.

We do not request or receive the following through LFbra.com:

• bank card number;

• bank card expiry date;

• CVV or CVC code;

• online banking password;

• PIN code;

• bank transaction confirmation code.

After payment by bank transfer, the Company may receive and process:

• the name or business name of the payer;

• the payer’s bank account number;

• the name of the bank;

• the payment amount and currency;

• the payment date;

• the payment reference;

• the pro forma invoice or invoice number;

• the bank transaction identifier;

• information necessary to issue a refund.

4.6. Communication Data

We may retain:

• emails;

• messages submitted through the website;

• documents and attachments;

• information provided during a telephone conversation;

• the date and time of communications;

• sender and recipient information;

• the content of commercial negotiations;

• information concerning the agreement of order terms.

Telephone conversations are not recorded unless the Company provides separate notice before recording begins.

4.7. Technical Data

When the website is used, the following information may be processed automatically:

• IP address;

• date and time of the visit;

• address of the page visited;

• actions performed on the website;

• device type;

• browser type and version;

• operating system;

• source from which the visitor accessed the website;

• browser language;

• session identifiers;

• error information;

• technical security logs;

• cookie data.

5. Sources of Personal Data

We may obtain personal data:

• directly from a website visitor;

• from an enquiry or registration form;

• from the OpenCart shopping cart;

• from email correspondence;

• during a telephone conversation;

• from the company represented by the person;

• from another representative or employee of the customer;

• from a bank statement;

• from a courier, transport or logistics company;

• from publicly accessible commercial and state registers;

• from publicly available sources where necessary to verify company details or a representative’s authority.

Where a person provides us with the personal data of another natural person, such as a colleague, representative, driver or recipient of products, that person must have a lawful basis for providing the data and must inform the relevant person that their data has been provided to the Company.

6. Purposes and Legal Bases of Processing

We process personal data only where there is a specific purpose and an appropriate legal basis.

6.1. Processing a B2B Enquiry

We process data in order to:

• receive an enquiry;

• identify the customer and contact person;

• contact the customer;

• clarify product specifications and quantities;

• answer questions;

• verify whether an order can be fulfilled;

• prepare a commercial offer.

The legal basis is:

• taking steps at the request of a natural person prior to entering into a contract, where the natural person is the party to the proposed transaction;

• the Company’s legitimate interest in reviewing B2B enquiries and conducting business communications with representatives of legal entities.

6.2. Preparing a Pro Forma Invoice and Confirming an Order

We process data in order to:

• calculate the price;

• determine the applicable tax treatment;

• prepare a commercial offer;

• prepare a pro forma invoice;

• agree the terms of the order;

• reserve production and logistics resources.

The legal basis is:

• taking steps prior to entering into a contract;

• performance of a contract;

• the Company’s legitimate interest in organising a B2B transaction.

6.3. Production and Order Fulfilment

Data is used for:

• product preparation;

• product manufacturing;

• order assembly;

• document preparation;

• packaging arrangements;

• informing the customer about the order status;

• arranging dispatch and delivery;

• communicating with the recipient of the products;

• fulfilling warranty and other agreed obligations.

The legal basis is:

• performance of a contract;

• the Company’s legitimate interest in carrying out a transaction with a legal entity;

• compliance with the Company’s legal obligations.

6.4. Accounting and Tax Records

We process information concerning orders, invoices, pro forma invoices and payments in order to:

• identify incoming payments;

• prepare invoices and accounting documents;

• maintain accounting records;

• comply with tax obligations;

• provide evidence of business transactions;

• issue refunds;

• provide information to competent public authorities.

The legal basis is compliance with the Company’s legal obligations and performance of a contract.

6.5. Account Management

If a customer creates an account, we process data in order to:

• register the user;

• authenticate the user;

• save contact details;

• save addresses;

• display enquiry history;

• manage account settings;

• protect the account;

• restore access.

The legal basis is:

• taking action at the user’s request;

• performance of a contract;

• the Company’s legitimate interest in providing and protecting website functionality.

6.6. Handling Complaints and Disputes

We may process data in order to:

• review a complaint;

• respond to an enquiry;

• verify the circumstances of an order;

• resolve a dispute;

• recover outstanding debts;

• establish, exercise or defend legal claims;

• protect the Company’s property and rights.

The legal basis is:

• compliance with a legal obligation;

• performance of a contract;

• the Company’s legitimate interest in protecting its rights.

6.7. Security

We may process technical data in order to:

• maintain the operation of the website;

• protect OpenCart and related systems;

• prevent unauthorised access;

• detect malicious activity;

• prevent fraud;

• correct technical errors;

• investigate security incidents;

• create backups.

The legal basis is the Company’s legitimate interest in ensuring the security of the website, information systems and business data.

6.8. Direct Marketing

A response to an enquiry and the sending of a commercial offer, pro forma invoice, invoice, order information or delivery information do not constitute marketing communications.

Regular marketing communications, news and special offers are sent only:

• after separate consent has been obtained;

• or where another legal basis expressly permitted by applicable law exists.

Consent to marketing is voluntary and is not a condition for processing an enquiry or fulfilling an order.

The recipient may opt out of marketing communications at any time by:

• using the unsubscribe link;

• changing the account settings, where this functionality is available;

• sending a message to info@lfbra.com.

Opting out of marketing does not affect the receipt of communications necessary to process an enquiry or fulfil an order.

7. Legitimate Interests

Where processing is based on a legitimate interest, we assess:

• whether a legitimate business purpose exists;

• whether the processing is necessary to achieve that purpose;

• whether the purpose can be achieved by means that interfere less with the person’s rights;

• whether the rights and interests of the natural person override the interests of the Company.

Our legitimate interests may include:

• processing B2B enquiries;

• conducting business correspondence;

• performing transactions with legal entities;

• protecting the website and information systems;

• preventing fraud;

• retaining evidence of business communications;

• defending against unfounded claims;

• recovering debts;

• improving the quality of the website and customer service.

A natural person has the right to object to processing based on legitimate interests.

8. Requirement to Provide Data

Providing data is voluntary.

However, without the minimum necessary information, we may be unable to:

• identify the customer;

• respond to an enquiry;

• prepare an offer;

• calculate the price;

• issue a pro forma invoice or invoice;

• fulfil an order;

• arrange delivery;

• comply with accounting and tax obligations.

The following information should not be sent through the website or by email:

• passwords;

• PIN codes;

• bank card details;

• online banking codes;

• payment confirmation codes;

• medical data;

• information concerning criminal convictions;

• other sensitive information unrelated to the transaction.

9. Cookies

LFbra.com may use cookies and similar technologies.

9.1. Necessary Cookies

Necessary cookies may be used without separate consent where they are objectively required for:

• operation of the website;

• maintaining a session;

• operation of the shopping cart;

• user authentication;

• ensuring security;

• saving settings selected by the user;

• preventing abuse.

Blocking necessary cookies may cause the website or certain OpenCart functions to operate incorrectly.

9.2. Optional Cookies

Analytics, advertising, social media and other optional cookies may be placed only after the user has provided prior consent.

The user must be able to:

• accept optional cookies;

• reject them;

• select individual categories;

• change a previous choice;

• withdraw consent.

Rejecting optional cookies does not prevent the user from viewing the catalogue or submitting a B2B enquiry.

Information about the cookies actually used, their providers, purposes and retention periods must be provided in the cookie settings or in a separate Cookie Policy.

10. Recipients of Personal Data

Access to personal data is granted only to persons who require it to perform their duties or provide a particular service.

Recipients may include:

• authorised Company employees;

• the hosting provider;

• website developers and technical support specialists;

• OpenCart service providers;

• email service providers;

• server and cloud infrastructure providers;

• CRM or business information system providers, where such systems are used;

• an accountant or accounting service provider;

• banks;

• courier, transport, warehousing and logistics companies;

• insurance companies;

• auditors;

• legal advisers;

• debt collection service providers;

• state and municipal authorities;

• tax authorities;

• law enforcement authorities;

• courts and other competent authorities.

Because the Company sells its own products, personal data is not transferred to third-party manufacturers for product manufacturing unless such transfer is actually necessary to fulfil a particular order.

Service providers acting as personal data processors may process data only:

• in accordance with the Company’s instructions;

• within the scope of the concluded agreement;

• for the agreed purpose;

• in compliance with security and confidentiality requirements.

Certain recipients, such as banks, courier companies and public authorities, may act as independent controllers and process data in accordance with their own legal obligations.

11. International Data Transfers

We aim to use service providers that process personal data within the European Economic Area.

However, certain hosting, email, cloud, analytics or technical service providers may process data outside the European Economic Area.

In such cases, data is transferred only where an appropriate mechanism under the GDPR is available, such as:

• an adequacy decision adopted by the European Commission;

• the European Commission’s Standard Contractual Clauses;

• Binding Corporate Rules;

• another lawful safeguard;

• a GDPR derogation applicable to a particular situation.

Where necessary, the Company applies additional technical and organisational safeguards.

Information about the safeguards used may be requested by contacting info@lfbra.com.

12. Retention Periods

We retain personal data only for as long as necessary for the relevant processing purpose, compliance with legal obligations or the protection of legal claims.

12.1. Enquiries That Do Not Result in an Order

Enquiries, commercial offers and correspondence that do not result in a transaction are generally retained for no longer than 24 months after the last substantive contact.

Data may be retained for longer where:

• negotiations are continuing;

• the customer asks us to retain an offer;

• a dispute exists;

• there are reasonable grounds to expect a legal claim;

• retention is required by law.

12.2. Customer Accounts

Account data is retained while the account remains active.

If an account is not used for an extended period, the Company may delete or anonymise it after assessing whether continued retention is necessary.

Deletion of an account does not automatically result in the deletion of accounting documents, completed order data or other information that must be retained on another legal basis.

12.3. Orders and Accounting Documents

Invoices, payment data, supporting accounting documents and information confirming business transactions are retained for at least the period required by Latvian law.

As a general rule, the relevant accounting documents are retained for at least five years.

Certain documents may be retained for longer where required by tax, accounting, customs or other applicable law.

12.4. Correspondence Relating to a Completed Order

Correspondence and documents required to confirm the terms and performance of a transaction may be retained for the duration of the contract and the applicable limitation period.

Where a dispute arises, data may be retained until the dispute has been finally resolved and the resulting decision has been implemented.

12.5. Marketing Data

Data used for marketing communications is retained until:

• consent is withdrawn;

• the recipient unsubscribes;

• the relevant marketing activity is discontinued.

Information evidencing the giving and withdrawal of consent may be retained for an additional period corresponding to the applicable period for defending legal claims.

12.6. Technical Logs

Ordinary technical website logs are generally retained for no longer than 12 months.

Data relating to a security incident, attempted fraud or legal dispute may be retained for longer, until the relevant investigation or proceedings have been completed.

12.7. Requests to Exercise Rights

Data subject requests and our responses may be retained for the period necessary to demonstrate the Company’s compliance with the GDPR and defend against legal claims.

After the relevant retention period expires, data is deleted, destroyed or anonymised.

13. Automated Decision-Making and Profiling

The Company does not make decisions based solely on automated processing of personal data where such decisions:

• produce legal effects concerning a natural person;

• or similarly significantly affect that person.

The price, production feasibility, timeframe, delivery terms and other terms of a B2B transaction are determined or confirmed by a Company employee.

The automatic display of indicative prices on the website or calculation of the shopping cart contents does not constitute a final automated decision regarding the conclusion of a transaction.

14. Data Security

We apply technical and organisational measures intended to protect personal data against:

• unlawful access;

• accidental loss;

• destruction;

• alteration;

• unauthorised disclosure;

• copying;

• fraud;

• other security breaches.

Such measures may include:

• access control;

• use of individual user accounts;

• protection of the OpenCart administration panel;

• encryption of the website connection;

• software updates;

• backups;

• antivirus protection;

• email security;

• access control for documents;

• confidentiality obligations for employees;

• contractual requirements for service providers;

• regular review of whether continued data retention is necessary.

No method of data transmission or storage can guarantee absolute security. If a personal data breach is detected, we act in accordance with applicable legal requirements.

15. Rights of Natural Persons

Where provided for by the GDPR, a natural person has the following rights.

15.1. Right to Information

The right to receive clear information about:

• what data is processed;

• for what purposes;

• on what legal basis;

• to whom it is disclosed;

• how long it is retained.

15.2. Right of Access

The right to obtain confirmation as to whether personal data is being processed and to receive a copy of the personal data being processed.

15.3. Right to Rectification

The right to request correction of inaccurate data or completion of incomplete information.

15.4. Right to Erasure

The right to request deletion of data where:

• it is no longer required for the original purpose;

• consent has been withdrawn and no other legal basis applies;

• the processing is unlawful;

• the data must be erased to comply with a legal obligation.

The right to erasure is not absolute.

We may continue to retain data where necessary:

• to comply with a legal obligation;

• for accounting and tax record-keeping;

• to exercise the right to freedom of expression and information;

• for reasons of public interest;

• to establish, exercise or defend legal claims.

15.5. Right to Restriction of Processing

The right to request temporary restriction of processing, for example while the accuracy of the data is being verified or an objection is being considered.

15.6. Right to Data Portability

In the circumstances provided for by the GDPR, the right to receive data provided to the Company in a structured, commonly used and machine-readable format, or to request its transfer to another controller.

15.7. Right to Object

The right to object to processing based on legitimate interests.

After receiving an objection, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override the rights and interests of the natural person, or where the processing is required for legal claims.

A person may object to processing for direct marketing purposes at any time. Once such an objection has been received, the data will no longer be used for direct marketing.

15.8. Right to Withdraw Consent

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal of consent:

• does not affect the lawfulness of processing carried out before the withdrawal;

• does not prevent processing that continues on the basis of a contract, legal obligation or legitimate interest.

15.9. Right Not to Be Subject to a Decision Based Solely on Automated Processing

A natural person has the right not to be subject to a decision based solely on automated processing where that decision produces legal or similarly significant effects, except in cases permitted by law.

16. Procedure for Exercising Rights

To exercise their rights, a person must send a request to:

info@lfbra.com

The request should preferably include:

• first name and surname;

• the company represented;

• contact email address;

• a description of the request;

• the data or period to which the request relates.

To protect personal data against unauthorised disclosure, we may request additional information necessary to verify the identity of the applicant.

We will not request more information than is objectively necessary to verify identity.

A response will be provided without undue delay and generally no later than one month after receipt of the request.

Where a request is complex or a large number of requests has been received, the response period may be extended by a further two months. In such a case, the applicant will be informed of the extension and the reasons for it.

The exercise of rights is generally free of charge.

Where a request is manifestly unfounded, excessive or repetitive, the Company may:

• charge a reasonable fee taking into account administrative costs;

• or refuse to act on the request where permitted by the GDPR.

17. Complaint to a Supervisory Authority

If a natural person believes that their personal data is being processed unlawfully, they may first contact us at:

info@lfbra.com

Contacting the Company does not restrict the right to lodge a complaint with the Latvian supervisory authority:

Datu valsts inspekcija
Elijas iela 17
Rīga, LV-1050
Latvia

Email: pasts@dvi.gov.lv
Telephone: +371 67223131

A natural person also has the right to apply to a court or use any other legal remedies available under applicable law.

18. Third-Party Websites

The website may contain links to the websites of carriers, public registers, social networks or other third parties.

We do not control the content of third-party websites or the manner in which personal data is processed on them.

Before providing personal data to a third party, users are advised to review that third party’s privacy policy.

19. Data Relating to Minors

The website is intended for B2B interactions and is not intended for persons under the age of 18.

We do not knowingly collect children’s personal data.

If we become aware that a minor’s personal data has been provided without an appropriate legal basis, we will take reasonable steps to delete it.

20. Changes to the Policy

The Company may update this Policy where changes are made to:

• legal requirements;

• operation of the website;

• OpenCart functionality;

• methods of processing enquiries;

• service providers used;

• the Company’s structure;

• the purposes or methods of personal data processing.

The current version is published on LFbra.com together with the date of the latest update.

Where changes materially affect the rights of natural persons, the Company may provide additional notice by an appropriate method.

21. Contact Information

Questions relating to privacy and personal data processing may be sent to:

SIA “BLAST SOVEREIGN A/T”
Registration number: 42103109011
Registered address: Ezermalas iela 9A, Liepāja, LV-3401, Latvia
Website: LFbra.com
Email: info@lfbra.com

Last updated: 10 July 2026