Privacy policy
Effective date: 23 July 2026
Last updated: 23 July 2026
The controller responsible for your personal data is SIA CRYSTAL ROSE, the owner of the online store www.onezerocosmetics.lv. The company’s registration No. is 42403037051, and its registered address is “Annas kalns”, Jusi, Griškāni Parish, Rēzekne Municipality, LV-4601, Latvia.
SIA CRYSTAL ROSE has prepared this Privacy Policy to demonstrate our commitment to protecting your personal data and to explain how we collect and process it.
This Privacy Policy describes our data-processing practices in connection with the website www.onezerocosmetics.lv and the other services we provide to users, collectively referred to as the Services. We will disclose your personal data only in the circumstances described in this Privacy Policy.
We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC, commonly known as the General Data Protection Regulation or GDPR.
Terms used in this Privacy Policy
In this Privacy Policy, personal data means any information relating to an identified or identifiable natural person.
Processing of personal data means any operation performed on personal data, including its collection, recording, storage, use, disclosure, correction, deletion or destruction.
How to contact us
For questions about how we collect, store and use your personal data, please contact us using one of the following methods: email: info@onezerocosmetics.lv
Postal address, marked “Privacy”:
SIA CRYSTAL ROSE
“Annas kalns”
Jusi, Griškāni Parish
Rēzekne Municipality
LV-4601, Latvia
ONE:ZERO Services
Through the Services, you may access information and content owned, licensed or otherwise provided by SIA CRYSTAL ROSE, its branches and affiliated companies, collectively referred to as ONE:ZERO.
The Services may also include information provided by third parties and made available under a licence, permission or another form of agreement with ONE:ZERO.
In this Privacy Policy, the terms we, us and our refer to ONE:ZERO.
Using the Services and providing information
You may provide us with personal data when, for example, you create a customer account, make a purchase, subscribe to marketing communications or contact us.
When you use www.onezerocosmetics.lv, we may process information about your orders and other activities to register and authenticate your account, process orders and payments and deliver products to you.
Providing your personal data is generally voluntary. However, if you do not provide the information we require, we may be unable to fulfil the purposes described in this Privacy Policy or provide the requested Services.
Where we process your personal data on the basis of your consent, you may withdraw that consent at any time. Withdrawing your consent will not affect the lawfulness of any processing carried out before the withdrawal.
Scope, purposes and retention of personal data
We may collect information that you voluntarily provide to us, as well as information about your use of our website, as described below.
We primarily collect personal data directly from you, including when you place an order, create a customer account, subscribe to marketing communications or contact us by email, telephone, social media or another communication channel.
In certain circumstances, we may also receive information from our service providers. For example, payment-service providers and delivery companies may provide us with information about the status of your payment or delivery.
Personal data you provide
The personal data you provide may include your first and last name, email address, telephone number, date of birth, delivery address, billing address, persistent identifiers linked to your personal data and other information you voluntarily provide to us.
Please ensure that the personal data you provide is accurate, complete and up to date. You should notify us or update the information in your customer account whenever your personal data changes.
We process the personal data you provide for the purposes described below.
1. Registration for and administration of the ONE:ZERO Loyalty Programme
We process your personal data to register you for the ONE:ZERO Loyalty Programme and administer your membership.
Membership in the ONE:ZERO Loyalty Programme may allow you to place orders through the ONE:ZERO online store, receive personalised offers, receive a permanent discount, receive marketing communications about news and updates and access other programme benefits through the ONE:ZERO online store and physical stores.
We use your personal data to create your ONE:ZERO account, provide access to your account, display relevant information within your account, respond to your enquiries, verify your registration and contact you when necessary, including to inform you about changes to the ONE:ZERO Loyalty Programme terms.
To create your account and administer your membership, you must provide the personal data necessary to enter into and perform the membership agreement. Without this information, registration for the ONE:ZERO Loyalty Programme is not possible.
Your first name, last name and email address are required for registration.
Personal data associated with your customer account is retained for as long as the account remains active.
If your customer account remains inactive for two consecutive calendar years, the associated personal data will be deleted or permanently anonymised, except where we are required to retain certain information for a longer period under applicable law.
The legal basis for this processing is taking steps at your request before entering into a contract and performing our contract with you.
2. Administration of personalised offers and other benefits
As part of your membership, we process your personal data to administer personalised offers and other benefits, such as birthday benefits.
We only process the personal data necessary to provide the relevant offer or benefit.
We use automated decision-making, including profiling, to provide personalised offers and other benefits.
For this purpose, we may analyse personal data you provide to us, information about your purchasing activity, activity within your membership account and other information relating to your use of the Services.
This analysis may be performed using general rules, specific algorithms and predictive models.
These activities do not produce legal effects concerning you or otherwise affect you in a similarly significant way.
To provide basic membership benefits, we may use automated decision-making based solely on general rules applicable to all ONE:ZERO Loyalty Programme members.
This processing is not based on your preferences, behaviour or similar characteristics. We do not analyse your behaviour or preferences when determining your eligibility for these basic benefits.
For example, the system may use the date of birth you provided to determine when birthday benefits become available to you.
Based on the benefits you use or do not use, we may also determine which other programme benefits are available to you.
To provide personalised offers, personalised recommendations and certain other benefits, we may use profiling.
Profiling involves using algorithms and predictive models to analyse your preferences, behaviour and similar characteristics.
For example, algorithms may analyse the personal data you provide and your purchasing activity, including the products you have purchased, to create offers tailored to you.
Based on your purchasing activity, we may also provide personalised recommendations regarding other benefits or products that may be available to you.
Because personalised offers and benefits are an essential part of the ONE:ZERO Loyalty Programme, you cannot participate in the programme if you do not agree to the automated decision-making and profiling required to provide these benefits.
To administer personalised offers and other benefits, we may process your first and last name, date of birth, purchase history and user-generated data, including information about your activity within our information systems and the ONE:ZERO online store.
The retention period depends on the activity of your membership account.
If your account remains inactive for two consecutive calendar years, the relevant personal data will be deleted or permanently anonymised.
The legal basis for this processing is the performance of our contract with you.
3. Administration of purchases made through the ONE:ZERO online store
We process your personal data to administer purchases made through the ONE:ZERO online store. This includes processing your order and payment, issuing invoices, contacting you about your order and its status, delivering your order and carrying out other activities necessary to fulfil it.
To fulfil your order, you must provide the personal data required to enter into and perform the contract. For example, payment details are required to process your payment, and if you request delivery to a specific address, we need the address to which your order should be delivered.
You do not need to create an account to place an order through the ONE:ZERO online store. You may complete your purchase as a guest by providing only the personal data necessary to process your order, such as your first and last name, contact details and payment information.
We use your telephone number and email address to communicate with you about your order. For example, we may contact you if there is an issue with your order or delivery, or to inform you about its status, including when the order has been confirmed, prepared for dispatch, delivered, cancelled, left unfulfilled or made available for collection following an unsuccessful delivery attempt.
ONE:ZERO may use third-party service providers or delivery companies to deliver your order. In such cases, a limited amount of your personal data may be shared with our partners, who may act as our data processors or as independent data controllers, depending on the service they provide. This information may include your name, contact details, order information and delivery details. Where information is shared with an independent data controller, ONE:ZERO may provide a reference to that controller’s privacy policy.
To administer purchases made through the ONE:ZERO online store, we may process your first and last name, contact details, order information, payment and transaction information and delivery information.
Personal data relating to the fulfilment of an order is retained for as long as necessary to complete the order and comply with our legal obligations. Accounting records relating to orders are retained for the periods required by applicable law.
The legal basis for this processing is taking steps at your request before entering into a contract and performing our contract with you.
4. Compliance with legal requirements
We process your personal data to comply with legal requirements applicable to us, including accounting, product liability and product safety obligations.
For example, we retain transaction information and documentation relating to purchases made through the ONE:ZERO online store, including order details, invoices and return information, for the periods required by law.
For these purposes, we may process your first and last name, contact details, order information, payment and transaction information and delivery information.
Documentation relating to orders is retained for the periods required by applicable law. Other information processed to comply with legal requirements is retained for the relevant statutory retention period.
The legal basis for this processing is compliance with our legal obligations.
5. Management of customer claims, complaints, suggestions and reviews
We process your personal data to handle your claims, complaints, suggestions, enquiries and product reviews submitted through the ONE:ZERO online store.
When submitting a claim or complaint, please provide your first and last name, contact details, a description of the issue and any documents supporting your claim. If you do not provide the information required to assess the matter, we may be unable to investigate or resolve your claim.
When handling a customer claim or complaint, we may also process other categories of personal data described in this Privacy Policy where they are relevant to the matter.
Personal data relating to claims, complaints and suggestions is retained for no longer than two years from the date it is received. It may be retained for longer where the matter remains unresolved or is subject to legal proceedings. In such cases, the data is retained until the matter has been resolved or for one year after the relevant legal proceedings have concluded.
Product reviews may be retained for as long as the relevant product remains available through the ONE:ZERO online store.
The legal basis for processing claims and complaints is compliance with the legal obligations applicable to us.
The legal basis for processing product reviews is our legitimate interest in receiving customer feedback and improving the shopping experience.
6. Surveys
We may process your personal data to invite you to participate in surveys and collect customer feedback for the purpose of improving and expanding our Services.
Where you have consented to receive marketing communications, we may send you a survey through your selected communication channel. We may also publish surveys on our website or make them available through our online or physical stores, allowing you to participate voluntarily.
Participation in surveys is entirely voluntary.
Surveys are anonymous unless participation in a survey is organised together with a prize draw.
Where a survey is not anonymous, we may process your first and last name, contact details, purchase history, feedback and opinions provided in your responses.
Where a survey is not anonymous, personal data relating to your participation is retained for no longer than one year after the survey has ended.
If a survey is organised together with a prize draw, the retention period stated in the applicable prize-draw terms will apply.
The legal basis for processing your personal data in connection with a survey is your consent.
7. Prize draws, games and competitions
We process your personal data to administer prize draws, games and competitions organised by ONE:ZERO or its suppliers where you have chosen to participate.
We may process your personal data to register and administer your participation, select and announce winners, verify your identity when awarding a prize, deliver or issue prizes and include your name in official prize-draw records where required by law.
To participate in a prize draw, game or competition, you must provide the personal data required under the applicable rules. If you do not provide the required information, you may be unable to participate or receive a prize if you win.
When issuing a prize, we may verify your identity. If the information provided does not match or your identity cannot be verified, the prize may not be issued.
Depending on the relevant prize draw, game or competition, we may process your first and last name, contact details, purchase history and user-generated data, including information about your activity within the ONE:ZERO online store.
If you are a winner, your first and last name may be included in a prize receipt and the official records of the prize draw, game or competition. These documents are retained for five years from the date of the relevant event.
In all other cases, personal data collected during a prize draw, game or competition is retained for no longer than two years after it has ended.
The legal bases for this processing are your consent and, where applicable, compliance with our legal obligations relating to official records and the awarding of prizes.
8. Sending marketing communications
We process your personal data to send you marketing communications, including personalised offers, information about discounts, benefits, sales, special campaigns, company news, events and new products.
We may send these communications through the communication channels you have selected, such as SMS, email or browser notifications. You may also subscribe solely to receive marketing communications without joining the ONE:ZERO Loyalty Programme.
We use automated decision-making, including profiling, to provide personalised and effective direct marketing communications. For this purpose, we may consider the personal data you provide and information obtained from your behaviour and interactions with our Services.
These activities do not produce legal effects concerning you or otherwise affect you in a similarly significant way.
You may unsubscribe from marketing communications at any time by contacting us at info@onezerocosmetics.lv or using the unsubscribe link included in an email sent to you.
When you unsubscribe, we will update your personal data processing preferences so that you no longer receive direct marketing communications.
For the purpose of sending marketing communications, we may process your first and last name, date of birth, contact details, information about benefits you have used, purchase history, customer preference data, including the consents you have provided, user-generated data, including information about abandoned shopping carts, and connection and device information, including the type of device you use.
Personal data processed for marketing purposes is retained until you withdraw your consent to receive marketing communications.
The legal basis for this processing is your consent.
9. Information security, fraud prevention and management of legal claims
We may process your personal data to establish, exercise or defend legal claims, prevent or stop fraudulent or unlawful activities, gather evidence relating to identified issues, manage relevant incidents and prevent the misuse of our products or Services.
For fraud prevention and the management of legal claims, we may process any information and personal data described in this Privacy Policy that you have previously provided to ONE:ZERO, where such information is relevant and necessary for the particular matter.
Where a legal claim arises, the relevant personal data will be processed for the duration of any investigation, settlement negotiations and the establishment, exercise or defence of the claim.
The data will be retained for three years after a decision has been made to close the investigation or until the final enforcement of a court judgment, whichever is applicable.
Information-security data, such as audit logs, may be retained for up to 18 calendar months unless a longer retention period is required by law.
The legal basis for this processing is our legitimate interest in preventing fraud, ensuring information security and establishing, exercising or defending legal claims.
10. Statistical and market-research purposes
We process personal data for statistical and market-research purposes so that we can monitor, evaluate, improve and expand our online Services.
For these purposes, we do not process your name, contact details or other information that directly identifies you as a specific individual.
For statistical and market-research purposes, we may process information about your participation in the ONE:ZERO Loyalty Programme, including the duration of your membership and registration year, order information, delivery information, payment information, purchase history, customer preferences, information about your activity within the ONE:ZERO Loyalty Programme and feedback you provide.
Personal data processed for statistical and market-research purposes is retained for as long as necessary to pursue our legitimate interests.
The legal basis for this processing is our legitimate interest in monitoring, improving and expanding our Services.
Security of personal data
We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or any other form of unlawful processing.
Access to personal data is granted only to those individuals and service providers who require it to perform their respective duties.
Disclosure of information
To operate the online store and fulfil our obligations to you, we may disclose personal data to service providers that support payment processing, order delivery, accounting, IT systems and website maintenance, customer service, marketing communications, analytics and other necessary services.
Personal data is disclosed only to the extent necessary to provide the relevant service. Depending on its role, a service provider may act as our data processor or as an independent data controller.
We use the following delivery service providers:
– SIA “OMNIVA”, registration No. 40103527192.
– SIA “DPD Latvija”, registration No. 40003393255.
Payment processing is provided through the payment platform makecommerce.lv. We therefore transfer the personal data required to complete payments to the platform owner, Maksekeskus AS.
We may disclose collected information, including personal data, to third parties where required or permitted by law. For example, we may disclose information to supervisory authorities and law-enforcement authorities in response to an official request.
We may also disclose collected information, including personal data, to companies that may acquire all or part of ONE:ZERO.
We may share your personal data with our insurers and professional advisers for risk-management purposes, to obtain professional advice, or to establish, exercise or defend legal claims.
In addition to the circumstances described above, we may disclose your personal data where necessary to comply with our legal obligations. With your consent, we may also share personal data with partners that provide marketing services on our behalf.
ONE:ZERO aims to ensure that your personal data is processed within the European Union and European Economic Area whenever possible.
Your personal data may nevertheless be transferred to or processed in a country outside the EU or EEA by service providers engaged by us. Where this occurs, we ensure that appropriate safeguards are in place to protect your personal data.
Such safeguards may include a European Commission adequacy decision confirming that the relevant country provides an adequate level of data protection, the European Commission’s Standard Contractual Clauses or other legally recognised safeguards.
You may request information about the safeguards used for international data transfers by submitting a written request to us.
ONE:ZERO is not responsible for protecting information that you provide through other websites or platforms. Please be aware that personal data you voluntarily disclose elsewhere may be collected and used by third parties, which may result in you receiving unsolicited communications.
Corporate reorganisation or change of ownership
Business transactions
For strategic or other reasons, we may decide to sell, purchase, merge or otherwise reorganise our business.
Such a transaction may involve disclosing personal data to prospective or actual purchasers, joint-venture partners or other parties involved in the transaction. We may also receive personal data from sellers or other transaction parties.
We take appropriate steps to protect personal data disclosed or received in connection with such transactions.
Your rights
This section summarises the principal rights available to you under applicable data-protection legislation. Some of these rights are subject to specific conditions and exceptions. For complete information, we recommend reviewing the applicable legislation and guidance issued by the relevant supervisory authorities.
You may have the right to receive information about how your personal data is processed, access the personal data we hold about you, request the correction of inaccurate or incomplete personal data, request the deletion of your personal data, restrict the processing of your personal data, object to the processing of your personal data, object to processing for direct-marketing purposes, receive your personal data in a portable format, withdraw your consent and lodge a complaint with a supervisory authority.
You may be able to exercise some of these rights through the profile settings available on www.onezerocosmetics.lv.
To exercise your rights or ask questions about our processing of your personal data, please contact us at info@onezerocosmetics.lv.
Right of access
You have the right to obtain confirmation from us as to whether we process your personal data.
Where we process your personal data, you have the right to access that data and receive information about the processing, including the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients and other information required under applicable law.
We will provide you with a copy of your personal data.
You may also have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format. However, this right cannot be exercised where doing so would adversely affect the rights and freedoms of others.
We may refuse to provide access to certain personal data where applicable law permits or requires us to do so.
Right to rectification
You have the right to request the correction of inaccurate personal data concerning you.
Taking into account the purposes of the processing, you may also request that incomplete personal data be completed.
Right to restriction of processing
You may request that we restrict the processing of your personal data where you contest the accuracy of the personal data, the processing is unlawful but you do not want the data to be deleted, we no longer require the personal data for our processing purposes but you need it to establish, exercise or defend a legal claim, or you have objected to processing based on our legitimate interests or those of a third party while we verify whether our legitimate grounds override your objection.
Where processing is restricted, we may continue to store your personal data, but we will otherwise process it only with your consent, to establish, exercise or defend legal claims, to protect the rights of another natural or legal person or for important reasons of public interest.
Right to object
You have the right to object to the processing of your personal data on grounds relating to your particular situation where the processing is based on our legitimate interests or those of a third party.
If you object, we will stop processing your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or unless the processing is necessary to establish, exercise or defend legal claims.
Right to object to direct marketing
You have the right to object at any time to the processing of your personal data for direct-marketing purposes, including profiling related to direct marketing.
If you object, we will no longer process your personal data for those purposes.
Right to data portability
You may exercise the right to data portability where we process your personal data by automated means and the legal basis for processing is your consent or the performance of a contract or steps taken at your request before entering into a contract.
Right to withdraw consent
Where the legal basis for processing your personal data is consent, you may withdraw that consent at any time.
The withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.
Right to lodge a complaint
If you believe that our processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with the Latvian Data State Inspectorate:
Data State Inspectorate
Elijas iela 17
Riga, LV-1050
Latvia
Before submitting a complaint, we encourage you to contact us so that we can try to resolve the matter together.
Deletion of personal data
As described above, you have the right to request the deletion of personal data held by us.
To submit a deletion request, please contact us at info@onezerocosmetics.lv.
When we receive your request, we will assess it in accordance with the General Data Protection Regulation. You may have the right to request deletion where the personal data is no longer necessary for the purposes for which it was collected or otherwise processed, you withdraw your consent and there is no other legal basis for processing, you object to processing based on our or a third party’s legitimate interests, the personal data is processed for direct-marketing purposes, the personal data has been processed unlawfully or the personal data must be deleted to comply with a legal obligation applicable to us.
Please note that the right to deletion is not absolute and may not apply where the processing is necessary to exercise the right to freedom of expression and information, comply with our legal obligations or establish, exercise or defend legal claims.
We will assess whether any of these circumstances apply to your request. Where the GDPR requires us to delete your personal data, we will do so.
Personal data will not be deleted where its continued processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
Changes to this Privacy Policy
We may update this Privacy Policy periodically to reflect changes in our personal-data processing activities, Services or applicable legal requirements.
The current version of this Privacy Policy will always be available on onezerocosmetics.lv. The date of the most recent update is displayed at the beginning of the Privacy Policy.
Where changes are material, we may also notify you through the website or, where appropriate, through other suitable communication channels.