Privacy Policy

1. Who is responsible for your data

Black Pepper is a website and brand operated by SIA MTM SHIRT EUROPE, the controller of the personal data processed through blackpepper.lv (the “Website”):

In this policy, “we”, “us” and “our” refer to SIA MTM SHIRT EUROPE.

2. Summary

We do not sell personal data and do not use it for advertising.

3. Contact form and email

What we collect. When you send a message through the contact form, we receive:

• your name (required);
• your email address (required);
• your company or project (optional);
• your message (required);
• the date and time of submission and a label identifying the Website as the source of the message.

How it reaches us. Your message is delivered through the Telegram messaging service (a Telegram bot) to a private chat that only one authorised person can access. It is not stored in a database on the Website, and your IP address is not included in the message. We do not forward contact-form submissions to other people, mailing lists or customer-relationship (CRM) systems.

How we use it. We use your details only to read your enquiry and reply to you. We reply by email. Further communication through other channels takes place only if we both agree to it.

No marketing. The contact form is not a newsletter or marketing subscription. We will send you new commercial offers only if you separately agree to receive them.

Writing to us by email. If you write to the email address shown on the Website instead, we process your email and its content in the same way and for the same purpose.

How long. We keep contact-form messages and emails until the correspondence is concluded, but no longer than 12 months from receipt, unless longer retention is required by law.

Is it required? Contacting us is voluntary. Without a name, an email address and a message we cannot reply to you.

4. Telegram

Contact-form messages are delivered via Telegram, which acts as our messaging service provider. The messages are therefore stored on Telegram’s infrastructure, in a chat accessible to one authorised person, until they are deleted in line with the retention period in section 3. Telegram may process data outside the European Economic Area (see section 11).

5. Spam and abuse protection

Cloudflare Turnstile. To protect the contact form from automated abuse, the Website uses Cloudflare Turnstile, provided by Cloudflare. Turnstile is loaded when you open the Website’s home page, where the contact form is located. It processes technical information about your browser and device, including your IP address, to distinguish people from automated traffic. It usually works in the background; a visible check appears only if Cloudflare requires one. When you send the form, our server sends the Turnstile result and your IP address to Cloudflare for verification. We use Turnstile only for security, not for analytics. If the check prevents you from sending a message, you can email us instead.

Submission limits. To limit repeated submissions, our server counts how many messages are sent from the same connection within a 10-minute window. For this it uses a one-way, keyed hash of your IP address — never the IP address itself. The value is kept only temporarily for this check and is not stored together with your message. A random identifier generated by your browser for each submission is used for up to 10 minutes so that the same message is not delivered twice.

Server logs. Our contact-form logs record only short technical events (for example “delivered” or “rate limited”). They do not contain your message, your contact details or your IP address.

6. Google Analytics 4 (only with your consent)

When. Google Analytics 4 (“GA4”), provided by Google, runs on the Website only after you click “Accept analytics” in the analytics banner. Before you decide, and if you click “Reject analytics”, no Google Analytics script is loaded, no request is sent to Google Analytics and no analytics cookies are set.

What. With your consent, GA4 collects information about your visit, such as the pages you view, your browser and device type, and an approximate location that Google derives from your IP address, together with the identifiers stored in the cookies listed in section 7.

Our settings.

• Google Signals is disabled.
• GA4 event-data retention is set to 2 months. This setting determines how long event-level and user-level data is kept for detailed analysis in GA4. It does not delete aggregated reports, which Google Analytics may continue to show after that period.

Purpose. To understand how visitors use the Website and to improve it. We do not use GA4 for advertising.

Changing your mind. You can change your choice at any time via “Cookie settings” in the Website footer. If you withdraw consent, the Website deletes the Google Analytics cookies from your browser and stops loading Google Analytics. Withdrawal does not affect processing carried out before it.

7. Cookies and browser storage

We distinguish between analytics cookies, which are used only with your consent, and essential browser storage, which the Website needs to work as you expect and which is not used for tracking.

The Website itself sets no other cookies. Cloudflare Turnstile may use its own technical mechanisms for its security check (section 5), as described in Cloudflare’s documentation.

You can delete cookies and site data in your browser settings at any time.

8. Hosting

The Website is hosted by Vercel. When you visit, your browser sends standard technical data (such as IP address, browser type, requested page and time). Vercel processes this data to deliver and protect the Website, and it may be recorded in technical server logs kept by Vercel.

Fonts are served from the Website itself; your browser does not contact Google Fonts.

9. Content management and images (Sanity)

Website content is managed in Sanity. Logos, award badges and other images are delivered from Sanity’s content delivery network (cdn.sanity.io). To display them, your browser connects to that network, which receives standard technical data such as your IP address. People who edit content in the content editor (/studio) sign in with Sanity; this does not concern Website visitors.

10. External content and links

• Images from Star Wine List. The testimonial portraits on the Website are loaded directly from starwinelist.com. When they load, your browser connects to that website, which receives standard technical data such as your IP address. The Website instructs your browser not to send it the address of the page you are viewing.
• Links to other websites (for example Instagram, LinkedIn, MICHELIN Guide, Star Wine List, Riga Wine & Champagne, LOWINE). The Website does not embed their content or widgets; no data is sent to them unless you follow a link. After that, their own privacy policies apply.

11. Recipients and international transfers

We share personal data only with the service providers described above, and only to the extent needed for the stated purposes: Vercel (hosting), Cloudflare (Turnstile), Telegram (message delivery), Google (Google Analytics, only with your consent) and Sanity (content and images).

Some of these providers may process data outside the European Economic Area, including in the United States. Such transfers are subject to the GDPR’s rules on international transfers (Chapter V).

12. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• object to processing based on our legitimate interests;
• data portability, where applicable;
• withdraw your consent at any time (for analytics: via “Cookie settings”), without affecting processing carried out before withdrawal.

To exercise your rights, write to unfiltered784@gmail.com. We will respond within one month; this period may be extended where the GDPR allows. We may need to confirm your identity before acting on a request.

13. Complaints

If you believe your data is processed unlawfully, you may lodge a complaint with the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija), www.dvi.gov.lv, or with the supervisory authority of the EU country where you live or work. We would appreciate the chance to address your concern first.

14. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The Turnstile security check only determines whether a form submission is accepted; you can always contact us by email instead.

15. Security

The Website uses HTTPS. Access credentials for the services above are kept on the server and never sent to your browser. IP addresses used for submission limits are processed only as one-way hashes, and contact-form logs contain no message content.

16. Children

The Website is not directed at children.

17. Changes to this policy

We may update this policy. The current version and its effective date are always published on this page. If a change affects analytics, we may ask for your consent again.