1. Scope and data controller
This privacy policy informs individuals about the processing of personal data relating to visits to the website balvoragroup.lv , communications with SIA “BALVORA Group”, requests for services and the beginning of cooperation. Additional information on data processing may apply to particular services or contractual relationships and will be provided when the relevant processing begins.
Personal data controller: SIA “BALVORA Group”, registration No. 42103079662, address Brīvības iela 56–9, Liepāja, LV-3401. Contact for data protection matters: info@balvoragroup.lv, telephone +371 29606971. This email address is also the contact point for requests from data subjects.
This document has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, or GDPR), the Latvian Personal Data Processing Law and other applicable legislation. The contact details of a data protection officer will be published if one has been appointed and the law requires publication.
2. Sources and categories of data
We may receive data directly from you, for example by email, telephone conversation or a service enquiry; from your authorised representative or the organisation you represent; from public registers where necessary to assess a particular enquiry; and from the website's technical infrastructure to ensure its operation and security.
- Identification and contact data: first name, surname, position, represented organisation, email address, telephone number and other contact details provided by you.
- Enquiry and transaction data: communications, information about the relevant property or service, and necessary contractual and payment details if a transaction is initiated.
- Technical data: time of request, IP address, browser/device technical information and security events, insofar as such data is processed by the actual website hosting infrastructure.
- Preference data: a locally stored choice regarding the website's cookie settings.
Please do not send health, biometric, criminal-conviction or other special-category data unless necessary for dealing with the relevant matter and unless a separate lawful basis has been established.
3. Purposes and legal bases of processing
| Purpose | Categories of data | Legal basis |
|---|---|---|
| Respond to your question, consider an enquiry and prepare an offer | Contact details and the content of communications and enquiries | GDPR Article 6(1)(b), where you are a prospective party to a contract; otherwise Article 6(1)(f) — the legitimate interest in responding to communications addressed to the company and organising its business activities |
| Enter into and perform a contract and administer cooperation | Identification, contractual, contact and payment data | Article 6(1)(b) where the data subject is a party to a contract; for representatives of legal entities, Article 6(1)(f) — the necessity of maintaining and carrying out cooperation |
| Comply with accounting, tax and other legal obligations | Data required in contracts, invoices and supporting documents | Article 6(1)(c) — compliance with a legal obligation applicable to the controller |
| Maintain website availability and information security and prevent abuse | Technical request data and security logs, where such logs are created | Article 6(1)(f) — the legitimate interest in protecting the company's IT resources and investigating security incidents |
| Preserve evidence and defend legal interests in disputes | Relevant correspondence, contracts and transaction documents | Article 6(1)(f) — the legitimate interest in defending rights and bringing or contesting claims |
| Use optional cookies or send electronic marketing communications, if such activity is introduced and consent is required | Relevant preference and contact data | Article 6(1)(a) — freely given, specific and informed consent; optional analytics and advertising cookies are not enabled in the current website code |
Where processing is based on legitimate interests, the necessity of the processing and the balance between those interests and the data subject's interests and fundamental rights are assessed.
4. Is providing data mandatory?
You do not have to provide your name or contact details to visit the website. Providing information when contacting us is voluntary; however, without the necessary contact details and the substance of your enquiry, we may be unable to prepare a reply. Certain data may be needed to enter into a contract or comply with legal requirements; without it, the relevant service or transaction may not be possible.
5. Data retention periods
Personal data is not kept for longer than necessary for the relevant purpose. Retention periods are determined according to the following objective criteria:
- General correspondence — the time required to resolve the enquiry and a reasonable subsequent period for further communication or protection of legal interests; correspondence that forms part of a contractual relationship is retained according to the relevant contractual and statutory periods.
- Contracts and payment documents — for as long as the relevant rights and obligations exist, for mandatory document retention periods and, where necessary, for the limitation period for legal claims.
- Security logs — in line with the actual hosting configuration and reasonable security needs; longer retention only to investigate an incident or fulfil a legal obligation.
- Cookie preference record in the browser — up to 180 days from saving the preference, or until deletion of the data or a change in the policy version, whichever comes first.
Where a specific period is not prescribed by law, it is documented in the company's internal data retention procedure, taking into account the purpose, risks and data minimisation principle. When the basis for processing ends, data is erased or irreversibly anonymised insofar as no other lawful basis for retaining it exists.
6. Data recipients, processors and transfers
Where there is a legal basis, data may be disclosed to the extent necessary to authorised company employees, IT and hosting providers, email providers, accounting or legal service providers, banks and competent public authorities. Processors are granted access on the basis of documented instructions and applicable confidentiality and data protection terms.
If the involvement of a particular service provider entails a transfer of personal data outside the European Economic Area, the company ensures a transfer basis provided for in Chapter V of the GDPR (such as a European Commission adequacy decision or appropriate safeguards). Information on the specific transfer mechanism, where applicable to your data, is available using the contact details provided here.
Data is not sold to data brokers. If you choose to open an external website, subsequent processing of your data is governed by that website's privacy rules.
7. Security
The company implements organisational and technical safeguards proportionate to processing risks, including restricted access to personal data, access-rights management, backups and incident-handling procedures, insofar as these apply to the particular system. No method of transmitting data over the internet is entirely risk-free; security measures are therefore reviewed periodically.
8. Individual rights
Within the scope provided by the GDPR, you have the right to receive information and access your data, request the rectification of inaccurate data, erasure, restriction of processing, object to processing based on legitimate interests and request data portability where there is a lawful basis. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
Send your request to info@balvoragroup.lv. The company may request further information to verify your identity if there are reasonable doubts about the requester's identity. A response will be provided without undue delay, normally within one month; in complex cases, this period may be extended under the GDPR, with notification.
You have the right to lodge a complaint with the Data State Inspectorate of Latvia or use other legal remedies provided by law.
9. Automated decision-making and children's data
This version of the website does not carry out solely automated decision-making producing the effects referred to in GDPR Article 22, nor does it profile visitors for advertising purposes. The website is not intended for the targeted collection of personal data from children. If children's data is received without justification, this is assessed and the data is erased where necessary.
10. Cookies and changes to this document
A separate Cookie Policy describes the website's browser storage, its purposes and how to change settings. This policy is updated when actual data processing, service providers or legal requirements change. In the event of material changes, information will be provided in accordance with the GDPR and consent will be sought again if required.