Privacy Policy

1. General Provisions

1.1. This Privacy Policy sets out how SIA SAM MARTIN GROYP, registration No. 40203520646, registered address: Matīsa iela 16-2, Rīga, Latvia, LV-1001 (hereinafter – the Controller), processes the personal data of natural persons in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR), the Personal Data Processing Law and other applicable legislation in the field of personal data protection.

1.2. The purpose of this Privacy Policy is to provide data subjects with clear, transparent and legally accurate information about the purposes and legal bases of personal data processing, the categories of personal data, retention periods, recipients of personal data, transfers of data outside the European Union or the European Economic Area, the rights of data subjects, and the procedure for communicating with the Controller.

1.3. The Controller operates in the information technology sector and, in the course of its business activities, may develop, maintain and administer websites, software solutions, servers, hosting environments, backup solutions, email infrastructure, technical support systems and other digital services for clients.

1.4. Depending on the nature of the specific service, the Controller may act both as a personal data controller and as a personal data processor on behalf of a client, where the client determines the purposes and means of the processing.

1.5. Where the Controller provides a client with server maintenance, hosting, system administration, backup, incident analysis, email infrastructure, cloud services, user support or other technical services, the Controller may process personal data to the extent necessary for the provision of the service, security, continuity and performance of contractual obligations.

1.6. The Controller’s services, websites and related information society services are intended only for adults (aged 18 and over). The Controller does not knowingly collect or process children’s personal data where a service is offered directly to children, and takes proportionate measures to restrict the use of the services by minors without a lawful basis.

1.7. If the Controller determines that a service is in fact being used by a person under 18 and there is no legal basis for data processing (for example, the consent of a legal representative), the Controller may delete the data or convert it into anonymous form, and may restrict such person’s further access to the services.

2. Controller and Contact Information

2.1. The personal data controller is SIA SAM MARTIN GROYP, registration No. 40203520646, registered address: Matīsa iela 16-2, Rīga, Latvia, LV-1001.

2.2. Email for communication regarding personal data processing: [email protected].

2.3. For matters related to this Privacy Policy, personal data processing, the exercise of data subject rights, the handling of requests or other personal data protection issues, the data subject may contact the Controller by writing to [email protected].

3. The Controller’s Role in Data Processing

3.1. The Controller processes personal data as an independent controller where the Controller itself determines the purposes and means of processing, for example in relation to the data of business partners, client contact persons, suppliers, prospective clients, website visitors, accounting documents and communications.

3.2. The Controller may also act as a personal data processor within the meaning of Article 28 of the GDPR, where the client is the personal data controller and the Controller, on the client’s instructions, provides IT infrastructure, website hosting, database maintenance, server administration, technical monitoring, data storage, backups, system maintenance or other related technical services.

3.3. Where the Controller acts as a processor, personal data is processed in accordance with the agreement with the client, the client’s documented instructions and applicable legal requirements.

3.4. If, in a particular cooperation model, the Controller and the client jointly determine the purposes or essential means of personal data processing, the relationship between the parties may be regulated as a joint controller relationship in accordance with the requirements of the GDPR.

4. Categories of Personal Data

4.1. Depending on the service provided, the type of cooperation and the purpose of processing, the Controller may process the following categories of personal data:

4.1.1. identification data, such as first name, last name, job title or representation status;

4.1.2. contact information, such as email address, phone number, correspondence address, company name and other contact details;

4.1.3. contract and payment data, such as the content of contracts, order information, invoices, payment information, cooperation history and other information related to the provision of the service;

4.1.4. communication data, such as email correspondence, support requests, enquiries, incident reports, chat transcripts, call notes and other communication records;

4.1.5. technical data, such as IP address, device identifiers, browser parameters, authentication information, access times, session information, system event logs, error records and security event information;

4.1.6. website and service usage data, such as user actions in the technical environment, login records, administrative actions, configuration changes, changes to access rights, system audit records and other usage data;

4.1.7. server, hosting and infrastructure operation data, such as log files, resource usage information, backup information, monitoring and availability data, incident diagnostic data and service continuity data;

4.1.8. data of clients’ end users, to the extent it comes into the Controller’s possession when providing hosting, system administration, email, backup, database maintenance, website maintenance or other technical services in the clients’ interests and in accordance with the client’s instructions;

4.1.9. other personal data that the data subject or client provides to the Controller in the course of cooperation, an enquiry, contract performance or service provision.

4.2. The Controller processes only personal data that is relevant, adequate and necessary for achieving the specific purpose, in compliance with the principles of data minimisation and accountability.

5. Sources of Personal Data

5.1. Personal data is mainly obtained directly from the data subject, client, business partner or their authorised representatives, for example when concluding a contract, filling in application forms, submitting requests, sending emails or using the services provided by the Controller.

5.2. Personal data may also be obtained from publicly available registers, information systems used by the client, technical infrastructure, server logs, monitoring solutions, backup systems, authentication systems and other technical sources necessary for the provision of the service, to the extent that this is lawful and necessary.

5.3. Where the Controller acts as a personal data processor, personal data may be obtained from the client or from the systems, infrastructure and services used by the client that the Controller technically maintains or administers on the client’s behalf.

6. Purposes of Personal Data Processing

6.1. The Controller may process personal data for the following purposes:

6.1.1. identification of clients, suppliers and business partners and the commencement of cooperation;

6.1.2. preparation, conclusion, performance, administration and termination of contracts;

6.1.3. handling of client requests, consultations, applications and technical support enquiries;

6.1.4. maintenance and administration of websites, applications, servers, hosting services, databases, email solutions, APIs, integrations and other IT infrastructure;

6.1.5. granting of access rights, authentication, authorisation and user account management;

6.1.6. monitoring of system operation, error resolution, performance analysis, security monitoring, incident investigation and ensuring the stability of the technical environment;

6.1.7. creation of backups, restoration, data recovery and ensuring business continuity;

6.1.8. management of information and cybersecurity risks, prevention of unauthorised access, performance of security audits and protection of services;

6.1.9. accounting, tax, legal obligations, claims, evidence and internal management;

6.1.10. statistics, quality control, service improvement, system optimisation and usage analysis;

6.1.11. fulfilment of obligations laid down in legislation, including cooperation with state and municipal authorities, law enforcement bodies and supervisory authorities;

6.1.12. commercial communications, to the extent permitted under applicable law and, where necessary, with appropriate consent obtained.

6.2. The Controller may send commercial notifications about its services to existing clients on the basis of legitimate interests, in compliance with the Information Society Services Law and by providing a simple opt-out option in every notification (for example, an “unsubscribe” link or contacting [email protected]).

6.3. Where commercial communication is based on the data subject’s consent, the data subject has the right to withdraw consent at any time using the opt-out mechanism indicated in the notification received.

7. Legal Bases for Personal Data Processing

7.1. Depending on the specific situation, the legal basis for personal data processing may be:

7.1.1. conclusion and performance of a contract, or taking steps at the request of the data subject prior to entering into a contract, pursuant to Article 6(1)(b) of the GDPR;

7.1.2. compliance with a legal obligation binding on the Controller, pursuant to Article 6(1)(c) of the GDPR;

7.1.3. the legitimate interests of the Controller or a third party, pursuant to Article 6(1)(f) of the GDPR, for example in connection with network and information security, defence of claims, ensuring service quality, technical stability, fraud prevention, system audits and the organisation of business operations;

7.1.4. the data subject’s consent, pursuant to Article 6(1)(a) of the GDPR, where in a specific case the processing is based on consent, for example for sending certain marketing notifications or using non-essential cookies.

7.2. Where the Controller acts as a personal data processor on behalf of a client, personal data is processed on the basis of the client’s documented instructions and the contract, in compliance with Article 28 of the GDPR and by concluding an appropriate data processing agreement (DPA).

8. Special Provisions for IT Services and Hosting Environments

8.1. When providing website hosting, virtual or physical servers, database maintenance, email infrastructure, system administration, cloud services or other IT services, the Controller may process technical and usage-related personal data generated during the operation of the service, including access data, system logs and security event records.

8.2. To ensure the security, availability, integrity and stability of systems, the Controller may carry out network traffic monitoring, server load monitoring, error diagnostics, backups, disaster recovery, vulnerability assessment, configuration reviews and other proportionate technical security measures.

8.3. In the event of technical incidents, cybersecurity threats, unauthorised access attempts, service disruptions or system errors, the Controller may access the relevant technical information and, to a limited extent, personal data, insofar as this is objectively necessary for detecting, analysing, resolving and documenting the incident.

8.4. If the service ordered by the client includes the maintenance of the client’s websites, databases, mailboxes, user accounts or other systems, the Controller may technically process the personal data contained in them only to the extent necessary to ensure the functioning, security, backup, transfer, migration, restoration or troubleshooting of the service.

8.5. The Controller does not determine the purposes of processing of the clients’ end users’ data, unless the nature of the specific cooperation or legislation provides otherwise; in such cases the client is generally considered the controller and the Controller the processor.

8.6. The Controller may use sub-processors, such as providers of data centre, hosting, cloud, email, monitoring, backup, cybersecurity or infrastructure services, where necessary for the provision of the service and where appropriate data protection requirements are observed.

9. Cookies and Similar Technologies

9.1. If cookies or similar technologies are used on the Controller’s website or in solutions provided to a client, they may be used to ensure the basic functionality of the site, security, session management, user authentication, saving language preferences, analytics, performance improvement or other technically necessary functions.

9.2. Users must receive clear and comprehensive information about the purposes of cookie use, and where required by applicable law, an option is provided to give or refuse consent to the use of the relevant cookies.

9.3. The use of non-essential cookies may be based on the data subject’s consent, whereas technically necessary cookies may be used to ensure the operation and security of electronic services in accordance with applicable regulations.

10. Personal Data Retention Periods

10.1. The Controller retains personal data no longer than necessary to achieve the relevant processing purpose, perform contractual obligations, protect legal rights or fulfil obligations laid down in legislation.

10.2. Retention periods may differ depending on the data category and purpose; for example, contract data, accounting documents, technical logs, backups, access records, support requests and security incident data may be retained for different periods, taking into account the legal basis, technical necessity, security considerations and legal requirements.

10.3. Personal data contained in backups may be retained until subsequent backup cycles or longer if necessary for system restoration, incident investigation, business continuity or compliance with legal requirements.

10.4. When personal data is no longer necessary for the relevant purpose, it is deleted, anonymised, overwritten or archived in accordance with applicable legal provisions and technical capabilities.

11. Recipients of Personal Data

11.1. Personal data may be disclosed to the Controller’s employees, authorised persons and business partners only to the extent necessary for performing job duties or contractual obligations, in compliance with the principle of confidentiality and appropriate security measures.

11.2. Personal data may be transferred to data processors or sub-processors, such as providers of hosting, data centre, cloud, backup, email, cybersecurity, accounting, legal, customer support, monitoring, document management or other related services, to the extent necessary for the provision of services.

11.3. In cases provided for by legislation, personal data may be transferred to state and municipal authorities, courts, law enforcement bodies, supervisory authorities or other persons, where such an obligation arises from law or is necessary to protect the Controller’s rights, legitimate interests or security.

12. Data Transfers Outside the European Union or the EEA

12.1. If personal data is transferred outside the European Union or the European Economic Area in the course of providing services, the Controller ensures that such transfer takes place only in accordance with the applicable requirements of the GDPR and that appropriate data protection mechanisms are applied.

12.2. Such mechanisms may include a European Commission adequacy decision, standard contractual clauses, binding corporate rules or other personal data protection instruments recognised by the GDPR.

13. Personal Data Security

13.1. The Controller implements appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, damage, disclosure or unauthorised access.

13.2. Depending on the nature of the specific service, such measures may include access control, user authentication, access rights management, network segmentation, data encryption, firewalls, backups, event logging, vulnerability management, software updates, incident management, employee confidentiality obligations and other proportionate security measures.

13.3. Having assessed the risks to the rights and freedoms of natural persons, the Controller implements security measures in accordance with the level of security set out in Article 32 of the GDPR.

13.4. If the Controller identifies a personal data breach, it acts in accordance with applicable legislation, including assessing the obligation to notify the supervisory authority and, where necessary, the affected data subjects.

14. Data Subject Rights

14.1. The data subject has the right to request access to their personal data, rectification, erasure, restriction of processing, to object to processing, and to exercise the right to data portability, to the extent such rights arise from applicable law.

14.2. Where personal data processing is based on consent, the data subject has the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

14.3. To exercise their rights, the data subject may submit a request by writing to [email protected].

14.4. The Controller examines the request without undue delay and responds within the period laid down in legislation, usually no later than one month from receipt of the request, unless the specific situation justifies an extension of the deadline under the GDPR.

14.5. The Controller has the right to request additional information to verify a person’s identity in order to ensure that information is not disclosed to an unauthorised person.

14.6. If, in a particular data processing relationship, the Controller acts solely as a processor on behalf of a client, the Controller may forward the data subject’s request to the relevant client or handle it in cooperation with the client, taking into account the roles and obligations of the parties under the GDPR.

15. Lodging Complaints

15.1. If the data subject believes that the processing of their personal data violates the requirements of applicable law, they have the right to first contact the Controller by writing to [email protected].

15.2. The data subject also has the right to lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija), which is the personal data protection supervisory authority in Latvia.

15.3. Contact information of the Data State Inspectorate: Elijas iela 17, Rīga, LV-1050, Latvia; email: [email protected]; phone: +371 67223131.

15.4. The Data State Inspectorate recommends contacting the personal data controller that carries out the processing before submitting a complaint.

16. Call Recordings and Alternative Communication

16.1. When providing customer support and communication, the Controller may record telephone calls, internet calls, voice messages or other electronic communications where necessary for the provision of services, quality control, dispute resolution, security and the protection of the Controller’s legitimate interests, in compliance with the GDPR and other applicable legislation.

16.2. Call recordings are usually retained for up to 90 days from the date of recording, unless in a specific case dispute resolution, quality control, protection of the Controller’s rights or limitation periods laid down in legislation justify a longer retention period.

16.3. Before a call is recorded, the data subject is informed of the recording, and recordings are retained only for as long as necessary to achieve the relevant purpose, resolve disputes, carry out quality control or comply with legal requirements.

16.4. If the data subject does not wish a particular call to be recorded, they may choose alternative means of communication by writing to [email protected] or by using, for example, the WhatsApp number +371 28 706 247.

16.5. Call recordings and voice messages are considered personal data, and the data subject’s rights under the GDPR apply to them in full, including the rights of access, rectification, erasure, restriction of processing and objection, to the extent compatible with the purpose of the recording and applicable legislation.

17. Form Submissions and Data Processing

17.1. Various electronic forms (for example, contact forms, application forms, service request forms, support request forms) may be available on the Controller’s websites, applications or solutions provided to clients, in which the data subject provides personal data so that the Controller can deliver the requested service, communication or other specific purpose.

17.2. When filling in a form, the data subject usually provides identification and contact information as well as other data related to the request, which the Controller processes in order to respond to the request, provide a service, handle a submission, prepare a quote or take other steps initiated by the data subject.

17.3. The legal bases for processing personal data submitted via forms may be the conclusion or performance of a contract, compliance with a legal obligation binding on the Controller, the Controller’s legitimate interests (for example, ensuring communication, defending claims, improving service quality) or the data subject’s consent, where relevant information is provided in the specific form.

17.4. Personal data received as a result of form submissions is retained only for as long as necessary to achieve the relevant purpose, ensure communication, perform contractual obligations, protect the Controller’s rights or fulfil obligations laid down in legislation, after which it is deleted, anonymised or archived in accordance with the procedure set out in this Privacy Policy.

17.5. The data subject is entitled at any time to contact the Controller to find out what data about them has been collected, for what purposes it is used and what the retention period for such data is, as well as to exercise other rights provided for by the GDPR in relation to personal data submitted via forms.

18. Online Chat on the Website

18.1. An online chat is available on the evoex.eu website, through which the data subject can communicate with the Controller’s support team. The chat is provided from the Controller’s client portal (portal.evoex.eu), and the conversation is stored on the Controller’s servers in the European Union (Finland).

18.2. A conversation is started by writing a message. Optionally, the data subject may provide their name, email address and phone number (for example, to receive a reply by email) and attach files.

18.3. To ensure a quality response and security, technical data is also automatically processed during the conversation: the IP address and the approximate location derived from it (country, city, region), device type, browser and operating system, screen size, language and time zone, the page from which the message is written, the website pages viewed during this visit, the referral source (for example, search engine or advertising campaign parameters) and the number of visits. This data is transmitted only when the data subject opens the chat.

18.4. The legal basis for processing is taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) of the GDPR) and the Controller’s legitimate interests in ensuring communication, service quality and information security (Article 6(1)(f) of the GDPR). Before starting a conversation, the data subject confirms that they have read this Privacy Policy.

18.5. The Cloudflare Turnstile service is used to prevent abuse and automated (bot) requests. Attached files are automatically checked with antivirus software and security filters, and metadata (for example, location information) is removed from images. Files that fail the check are not stored.

18.6. If the Controller’s reply is given when the data subject is no longer on the website, a notification about the reply is sent to the email address provided.

18.7. Chat conversations, attached files and technical data related to the conversation are retained for up to 12 months after the last message, unless a contract is concluded as a result of the conversation or longer retention is necessary to protect the Controller’s rights. The data subject may at any time request the deletion of the conversation and related data by writing to [email protected].

18.8. Only the Controller’s authorised employees have access to chat conversations. Chat data is not used for automated decision-making or profiling.

18.9. So that the data subject can communicate in the language most convenient to them, chat messages may be translated automatically using the artificial intelligence service Claude, provided by Anthropic PBC (USA). Only the text of the respective message is transferred for translation (including personal data if the data subject has included it in the message); the name, email address, phone number, technical data and attached files are not transferred for translation. Anthropic acts as the Controller’s processor and, under its commercial terms, does not use this data to train artificial intelligence models. Data is transferred to the USA on the basis of the safeguards provided for in Article 46 of the GDPR (standard contractual clauses approved by the European Commission). Translated messages are marked in the chat with the note “Translated by Claude AI”, and the original text is stored together with the translation for the period specified in clause 18.7. The translation is not used for automated decision-making.

19. Cybersecurity and System Maintenance

19.1. The Controller ensures that the information and communication technology systems it maintains are protected in accordance with the cybersecurity legislation in force in the Republic of Latvia, including the requirements of the National Cybersecurity Law and related Cabinet of Ministers regulations, to the extent these legal acts apply to the Controller.

19.2. The Controller maintains servers, hosting environments, databases, email infrastructure and other IT systems to a proportionate extent, taking into account technical capabilities, the level of risk and minimum cybersecurity requirements, as well as the obligations and limits of liability set out in client contracts.

19.3. The Controller implements technical and organisational measures to reduce cybersecurity risks, such as access control, authentication, security updates, backups, incident management, monitoring and other proportionate protective measures, to the extent objectively possible, taking into account the level of risk and the significance of the relevant system.

19.4. The Controller is not liable for cybersecurity incidents or system disruptions caused by circumstances that the Controller objectively cannot control (for example, the actions of third parties, the configuration of the client’s own infrastructure, the actions of the client’s users, global cyberattacks); however, the Controller takes proportionate measures to mitigate the consequences and restore the provision of services as far as is practically possible.

19.5. If the Controller qualifies as an entity under the National Cybersecurity Law (for example, a provider of an important or essential service), it fulfils, in addition to this Privacy Policy, the obligations laid down by law, including the appointment of a cybersecurity manager, submission of self-assessment reports, incident reporting to the supervisory authority and other requirements set by law.

20. Automated Decision-Making and Profiling

20.1. The Controller does not engage in automated decision-making, including profiling, that produces legal effects or similarly significantly affects the data subject within the meaning of Article 22 of the GDPR.

20.2. The Controller may carry out limited analytics and analysis of service usage data (for example, analysis of system performance, feature usage and access statistics), which is not considered profiling with a significant effect on the data subject.

21. Final Provisions

21.1. The Controller is entitled to unilaterally amend or supplement this Privacy Policy at any time by publishing the current version on its website, in the client portal or through another communication channel determined by the Controller.

21.2. The current version of the Privacy Policy takes effect from the date of its publication, unless a different effective date is specified in it.

21.3. If any part of this Privacy Policy becomes invalid, contradictory or inapplicable, this does not affect the validity of the remaining provisions; in such a case the Controller replaces the relevant provision with one that corresponds as closely as possible to the original purpose and the applicable legal framework.

21.4. This Privacy Policy applies for as long as the Controller processes personal data in the course of its business activities; specific data processing terms may be developed for individual services, contracts or projects, which apply together with this policy, to the extent they do not conflict with the GDPR and the legislation of the Republic of Latvia.

Questions about personal data processing: [email protected].