How we use your data
Choose a topic to find out why we process data and what data, on what legal basis, how long we keep it and to whom we may disclose it.
Customer identification and due diligence
| Why | The law requires us to establish the customer’s identity, the purpose of the transaction and the origin of the funds, and to check whether the customer is on a sanctions list or is a politically exposed person. We establish identity before carrying out an occasional transaction or linked transactions where the amount exceeds the threshold set by law and by Tavex’s internal rules, or where there is a suspicion of a breach of the law. Tavex does not do business with customers who directly or indirectly breach sanctions imposed by the European Union. This helps to prevent money laundering, terrorism financing and fraud. |
|---|---|
| What data | First name, surname, personal identity number, date of birth, details and a copy of your identity document, contact details, citizenship and country of residence, purpose of the transaction, origin of funds, information on politically exposed person status. |
| Legal basis | Legal obligation – the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing and the Law on International Sanctions and National Sanctions of the Republic of Latvia (Article 6(1)(c) of the General Data Protection Regulation (GDPR)). |
| How long | 5 years after the business relationship ends or after the occasional transaction, as required by law. This period may be extended only in the cases provided for by law. |
| Who we share it with | The Financial Intelligence Unit (FIU) of Latvia; the State Revenue Service, Latvijas Banka (the central bank of Latvia) and other authorities – only in the cases provided for by law, usually at their request; our sanctions screening service provider; Tavex Group companies, where the law permits. |
If you buy on our website, we may verify your identity remotely through our service provider Veriff: you take a photo of your identity document, and the system compares an image of your face with the photo in the document.
Purchases, sales and accounting
| Why | To enter into and perform a transaction – currency exchange or the purchase or sale of precious metals at a branch or on our website – and to record the transaction in our accounts. |
|---|---|
| What data | Identification and contact details, transaction data (date, amount, products, payment method), and bank account details if you pay by bank transfer. If you sell precious metals or jewellery to us – also your declared place of residence, telephone number and country of residence. When you buy on our website, we also process your IP address to prevent fraud. |
| Legal basis | Entering into and performing a contract (Article 6(1)(b) GDPR) and legal obligation – the Accounting Law and tax legislation (Article 6(1)(c) GDPR). |
| How long | For the periods set by the Accounting Law and tax legislation; after that – for as long as necessary to defend against possible claims. |
| Who we share it with | Banks and payment service providers (for example, Montonio), courier service providers for order delivery (Omniva, Venipak, Unisend), auditors, and public authorities in the cases provided for by law. |
Western Union money transfers
| Why | To arrange and carry out money transfers, which Tavex provides at its branches as a Western Union agent. |
|---|---|
| What data | Sender and recipient details, the amount and purpose of the transfer, identification data. |
| Legal basis | Performance of a contract and the legal obligation to identify the customer and prevent money laundering (Article 6(1)(b) and (c) GDPR). |
| How long | 5 years after the transaction, as required by law. |
| Who we share it with | Western Union Payment Services Ireland Limited, which processes the data as an independent controller in accordance with its privacy statement; public authorities in the cases provided for by law. |
Fraud prevention
| Why | Fraudsters increasingly persuade people over the phone to buy currency or precious metals and hand them over to others. We want to protect you from losses and prevent Tavex services from being used for fraud. |
|---|---|
| What we do | If the circumstances of a transaction suggest possible fraud, our staff may ask additional questions, warn you or refuse to carry out the transaction. We act in the same way with Western Union transfers where there are signs that a person is being persuaded to transfer money to their own accounts (most often abroad) or to the accounts of third parties. |
| What data | Transaction data, the information you provide about the purpose and circumstances of the transaction, video footage from the branch. |
| Legal basis | Tavex’s legitimate interests in preventing losses and protecting customers (Article 6(1)(f) GDPR). |
| How long | 5 years after the transaction – together with the transaction and customer due diligence records; if criminal proceedings have been opened – until they are concluded. |
| Who we share it with | The State Police and the Financial Intelligence Unit (FIU) of Latvia; Tavex Group companies, to help identify similar fraud schemes. |
Video surveillance at branches
| Why | To protect customers, staff and valuables, ensure that transactions can be traced, detect fraud and, where necessary, provide evidence to the police. Our branches are high-security sites. |
|---|---|
| Where | In customer areas, transaction areas (at the cash desks), gold testing areas and high-security areas, at the entrance and, at some branches, along the entry route used by staff and cash-in-transit personnel. There is no video surveillance in rest rooms, toilets, changing rooms or other rooms where a particularly high level of privacy can reasonably be expected. Hidden cameras are not used. |
| What data | Video images. No audio is recorded, and facial recognition is not used. Cameras on building fronts cover only about 1 m around the branch, not the flow of passers-by. |
| Legal basis | Tavex’s legitimate interests (Article 6(1)(f) GDPR). |
| How long | No longer than 90 days (usually about 30 days); for cameras in the common areas of a building – no longer than 30 days. Longer only where a recording is needed to investigate an incident. |
| Who we share it with | The State Police and other authorities upon written request; insurers in the event of an insured incident; the Tavex Group IT department, which provides technical maintenance of the system – for technical purposes only. The data is not transferred outside the EU/EEA. |
How to obtain a recording in which you appear
Submit a request at any Tavex branch, presenting your identity document, or send a request signed with a qualified electronic signature to dpo@tavex.lv. Please state the branch, the date and the approximate time, and briefly describe the situation and your appearance. We will make other people’s images unrecognisable or provide still images with a description of the recording; you can also view the recording at the branch. As recordings are overwritten automatically, please submit your request as soon as possible. If a criminal offence has been committed, contact the State Police – we will preserve the recording immediately at their request.
Right to object. You may object to video surveillance on grounds relating to your particular situation, and we will assess every objection. As our branches are high-security sites, it is usually not possible to stop video surveillance in respect of an individual person. Video recordings cannot be rectified, as this would mean altering the information.
The full text of the Video Surveillance Policy is available on request at any Tavex branch.
Communicating with you and customer service
| Why | To answer your questions, deal with requests and complaints, and keep you informed about your order or transaction. |
|---|---|
| What data | First name, surname, contact details, the content of communications (emails, letters, messages), information relating to the request. Telephone calls and video chats are not recorded. |
| Legal basis | Performance of a contract or steps taken before entering into a contract (Article 6(1)(b) GDPR) and Tavex’s legitimate interests in providing good customer service and defending its rights (Article 6(1)(f) GDPR). |
| How long | 1 year after the complaint or request has been dealt with; if a dispute has arisen – until it is resolved. |
| Who we share it with | IT and communication service providers acting on behalf of Tavex. |
News and offers
| Why | To send you news, educational materials about precious metals and special offers, and to run campaigns and competitions. |
|---|---|
| What data | Email address, first name, the interests you have selected, participation in campaigns. |
| Legal basis | Your consent (Article 6(1)(a) GDPR). |
| How long | Until you withdraw your consent. You can do this at any time – using the unsubscribe link in every email, at a branch or by writing to dpo@tavex.lv. |
| Who we share it with | Email delivery and marketing service providers acting on behalf of Tavex. |
Website and cookies
Our website uses necessary cookies that make it work and – only with your consent – analytics and marketing cookies. You can change your choice at any time in the cookie settings.
If you accept analytics and marketing cookies, data may also be transferred outside the European Union (see the section “Transfers of data outside the EU/EEA”). For more details, see our Cookie Policy.
Artificial intelligence tools
Tavex uses artificial intelligence tools to prepare internal documents and to analyse anonymised data. We do not enter customers’ personal data into these tools.
Artificial intelligence does not take decisions that produce legal effects concerning you or similarly significantly affect you. For more details, see our Artificial Intelligence Policy.
Social media
| Why | To share Tavex news and to respond to your questions and comments on social media. |
|---|---|
| What data | Your public profile information, the comments, reactions and messages you send to Tavex accounts; aggregated page statistics. |
| Legal basis | Tavex’s legitimate interests in communicating with the public (Article 6(1)(f) GDPR). |
| How long | Public comments – for as long as they are visible on the social network; messages – 1 year after the end of the conversation. |
| Who we share it with | Meta (Facebook, Instagram), Google (YouTube), TikTok, Telegram. Tavex and the social network operator may be joint controllers for page statistics; the social network also processes your data in accordance with its own privacy terms. |
Claims, litigation and audits
| Why | To defend Tavex’s rights in disputes and to comply with the requirements of auditors and supervisory authorities. |
|---|---|
| What data | Only the data needed to deal with the specific claim, dispute or inspection. |
| Legal basis | Tavex’s legitimate interests in defending its rights, and legal obligation (Article 6(1)(f) and (c) GDPR). |
| How long | Until the dispute or inspection is finally concluded and the decision has been enforced. |
| Who we share it with | Courts, sworn advocates, sworn bailiffs, debt collection service providers, auditors, Latvijas Banka and other supervisory authorities. |
Whistleblowing
| Why | The Whistleblowing Law requires us to provide a way to report possible wrongdoing. |
|---|---|
| What data | The whistleblower’s name and contact details, the content of the report and the data of the persons mentioned in it. |
| Legal basis | Legal obligation – the Whistleblowing Law (Article 6(1)(c) GDPR). |
| How long | 5 years after the examination of the report has been completed; if administrative proceedings, criminal proceedings or litigation have been initiated – until they are concluded. Reports that are clearly not whistleblower reports are deleted after examination. |
| Who we share it with | Competent authorities in the cases provided for by law. We do not disclose the whistleblower’s identity, except in the cases provided for by law. |
Profiling and automated decisions
To fulfil our legal obligations, we monitor customer risk and transactions using automated systems. If the system indicates an increased risk or a possible match with a sanctions list, the situation is assessed by a Tavex employee – the decision is never taken by the system alone. With your consent, we may offer you products on our website that match your interests.
Transfers of data outside the EU/EEA
Your data is normally processed within the European Union and the European Economic Area. If data is transferred outside it (for example, when analytics and social media tools are used), this happens only where the European Commission has decided that the country ensures an adequate level of protection, or where standard contractual clauses approved by the European Commission have been concluded. We will provide more detailed information on request.
Where we obtain data from
You provide most of the data yourself. To carry out the checks required by law, we also obtain data from sanctions lists, the State Revenue Service database of politically exposed persons, public registers, the remote identification service Veriff and Tavex Group companies. Where data is required by law, you must provide it – without it we are not permitted to carry out the transaction.
Your rights
Find out whether we process data about you and what data, and receive a copy of it.
Ask us to correct inaccurate or incomplete data.
Ask us to erase data or restrict its processing where we are no longer required by law to keep it.
Object to processing based on legitimate interests and to direct marketing.
At any time; this does not affect the lawfulness of processing carried out before withdrawal.
Receive your data in a structured electronic format where it is processed on the basis of consent or a contract.
Some rights may be restricted where the law requires us to keep the data – for example, we cannot erase customer due diligence data before the end of the period set by law. The law also prohibits us from informing you that a report about you has been submitted to the Financial Intelligence Unit (FIU) of Latvia.
How to exercise your rights
- Submit a request at any Tavex branch, presenting your identity document, or send a request signed with a qualified electronic signature to dpo@tavex.lv.
- Please state as precisely as possible which data or time period your request relates to – this will help us reply sooner.
- We will reply within one month. In complex cases this period may be extended by a further two months, in which case we will inform you in advance. We keep your request and our reply for 3 years after the reply has been given.
If you believe that your rights have been infringed, you can lodge a complaint with the Data State Inspectorate.
Controller
SIA TAVEX, reg. No. 40003585673
Elizabetes iela 21a-103, Rīga, LV-1010
tavex@tavex.lv, +371 6720 5533
Data Protection Officer
Tavex has appointed an independent Data Protection Officer.
dpo@tavex.lv or Elizabetes iela 21a-103, Rīga, LV-1010, marked “For the attention of the Data Protection Officer”
Documents
Certain matters are described in more detail in the following documents.
Artificial Intelligence Policy
How and for what purposes Tavex uses artificial intelligence tools.
Entry into force and amendments
These principles enter into force on 27 October 2026 and replace the Personal Data Processing Principles in force since 1 July 2021. Tavex may amend these principles; the current version is always available on this page and at Tavex branches. We will give notice of significant changes on our website and at our branches before they take effect. These principles have been prepared in Latvian and translated into Russian, English and Lithuanian; in the event of any discrepancy, the Latvian text prevails.
