Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

WebRuins SIA
Registration number: 40203729219
Registered address: Rīga, Latvia
Email: info@webruins.com
Phone: +371 20731905

We are registered in the Republic of Latvia and operate in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the Personal Data Processing Law of Latvia, and all applicable EU data protection legislation.

2. Data We Collect

We collect personal data only to the extent necessary to provide our services.

2.1 Contact and Enquiry Data. When you submit an enquiry, we collect your name, email address, and the content of your message.

2.2 Client and Contract Data. When you engage us for services, we collect your name, company name, billing address, VAT number (where applicable), email address, and telephone number.

2.3 Payment Data. Payment processing is handled by Stripe, Inc. We do not store your full payment card details. Stripe’s privacy policy applies: stripe.com/privacy.

2.4 Technical Data. We may collect your IP address, browser type, and device information for security purposes and to improve our service. We do not use tracking cookies without your explicit consent.

2.5 Communications Data. We retain records of email correspondence and project-related communications for the duration of the contractual relationship and as required by law.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

• (a) Contract performance — processing necessary to enter into or perform a contract with you (Article 6(1)(b)).
• (b) Legitimate interests — processing necessary for our legitimate business interests, such as responding to enquiries and preventing fraud, provided such interests are not overridden by your rights (Article 6(1)(f)).
• (c) Legal obligation — processing required to comply with applicable laws, including Latvian accounting and tax legislation (Article 6(1)(c)).
• (d) Consent — where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing (Article 6(1)(a)).

4. How We Use Your Data

We use your personal data for the following purposes:

• Responding to enquiries and communicating about potential projects
• Performing and managing service contracts
• Processing payments and issuing invoices
• Complying with legal and regulatory obligations (Latvian tax law requires retention of accounting documents for five years)
• Protecting against fraud and unauthorised access
• Improving our website and services

We do not sell, rent, or transfer your personal data to third parties for their own marketing purposes.

5. Data Sharing and Third Parties

We may share your personal data with the following categories of recipients, strictly to the extent necessary:

5.1 Payment Processors. Stripe, Inc. processes payment data on our behalf as a data processor under EU Standard Contractual Clauses.

5.2 Hosting and Infrastructure. Our website may be hosted on servers within the European Economic Area (EEA), under data processing agreements compliant with GDPR Article 28.

5.3 Professional Advisors. We may disclose data to accountants, auditors, or legal advisors where required by law.

5.4 Legal Authorities. We will disclose personal data to competent authorities when required by law or court order.

We do not transfer personal data outside the EEA unless adequate safeguards are in place as required by Chapter V of the GDPR.

6. Data Retention

We retain personal data only for as long as necessary:

• Enquiry and contact data: 12 months from last contact, or until deletion is requested
• Contract and client data: 5 years from the end of the contractual relationship (Latvian accounting law)
• Invoice and financial records: 5 years as required by Latvian law
• Technical/log data: up to 12 months

Upon expiry of the applicable retention period, data will be securely deleted or anonymised.

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access (Article 15) — request a copy of the data we hold about you
• Right to rectification (Article 16) — request correction of inaccurate data
• Right to erasure (Article 17) — request deletion where there is no longer a lawful basis
• Right to restriction (Article 18) — request that we limit how we use your data
• Right to data portability (Article 20) — request your data in a structured, machine-readable format
• Right to object (Article 21) — object to processing based on legitimate interests
• Right to withdraw consent — withdraw at any time where processing is based on consent

To exercise any right, contact us at info@webruins.com. We will respond within 30 days.

8. Cookies

Our website uses only technically necessary cookies required for basic functionality. We do not use advertising or behavioural tracking cookies. If we introduce non-essential cookies in the future, we will request your explicit consent.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, or unauthorised access. In the event of a personal data breach posing a risk to your rights and freedoms, we will notify the Data State Inspectorate of Latvia within 72 hours and, where required, notify you directly.

10. Supervisory Authority

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with:

Data State Inspectorate of Latvia (Datu valsts inspekcija)
Website: www.dvi.gov.lv
Email: info@dvi.gov.lv
Address: Blaumaņa iela 11/13-15, Rīga, LV-1011

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy with a revised date. Where changes are material, we will notify active clients by email.

12. Contact

For any questions regarding this Privacy Policy:
info@webruins.com · +371 20731905