Privacy and cookie policy

This is a translation. In case of any discrepancy, the Latvian version prevails.

1. General information

This privacy and cookie policy (the Policy) explains how INKOMERC HOLDING, AS processes the personal data of natural persons who visit the website https://www.inkomerc.lv/ (the Website), who get in touch through the Website's contact form or the contact details given on the Website, and who use the links and functions available on the Website.

The Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, GDPR), the Personal Data Processing Law, the Law on Information Society Services and other applicable requirements.

2. Controller and contact details

The personal data controller is INKOMERC HOLDING, AS, registration No. 40003052057, registered address: Cesvaines iela 15B, Riga, LV-1073, Latvia (the Controller).

Data protection officer: questions about personal data processing and data subject requests can be sent to info@inkomerc.com or to the Controller's registered address, stating that the message is addressed to the data protection officer.

3. Technical operation and security of the Website

When you visit the Website, the web server and systems related to the Website may automatically process your IP address, the date and time of the request, the address or resource opened, technical information about your browser and device, operating system, language setting, referring address, server response status and error information.

The purpose of this processing is to keep the Website running, available and secure, to diagnose technical errors, to prevent misuse and to protect the Controller's information systems. The legal basis is the Controller's legitimate interests under Article 6(1)(f) GDPR.

Server and security log data are kept for no longer than 90 days and then deleted or anonymised, unless they must be kept longer because of a specific security incident, dispute or legal obligation.

4. Use of Google Analytics

The Website uses Google Analytics 4 with the measurement ID G-P8PMT8LPPL. The service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics may process a randomly generated client identifier, information about the pages and sessions visited, the time and duration of the visit, approximate location, device, browser and operating system information, language, referral source, scrolling, opening of external links and other actions on the Website. The Controller does not send the visitor's name, email address or other directly identifying information to Google Analytics.

Google Analytics is used to obtain statistics on how the Website is used, to assess how useful its content is and to improve the Website. Analytics cookies and the related data processing are enabled only after the visitor has freely given consent under Article 6(1)(a) GDPR. Consent can be refused or later withdrawn without affecting the availability of the Website's basic functions.

User-level and event-level data collected in the Google Analytics account are kept for 90 days, in line with the Controller's Google Analytics configuration. Aggregated statistics that no longer allow a specific visitor to be identified may be kept longer.

5. Contacting the Controller

If a person contacts the Controller using the email address, phone number or other contact details given on the Website, the Controller processes the contact details provided, the content of the message and the related correspondence.

In the Website's contact form, a person provides their name, email address and message and, optionally, their organisation and phone number. The information entered in the form is sent to the Controller's email, and a copy is kept on the Website's server so that the message is not lost if email delivery fails. The purposes and retention periods set out in this section apply to form data.

The data are used to answer the question, handle the request, prepare or perform a contract, provide customer service and protect the Controller's legal interests. Depending on the content of the communication, the legal basis is Article 6(1)(b), (c) or (f) GDPR.

If the communication does not lead to a contractual relationship or a dispute, it is kept no longer than necessary to handle the matter and for reasonable follow-up communication. If the communication relates to a contract, a legal obligation, a complaint or a possible claim, the data are kept for the relevant process and the applicable limitation or document retention periods.

6. External resources and links

The Website uses or links to external resources, including Google Fonts and Google Maps. When an external resource is loaded or an external link is opened, the service provider may receive the visitor's IP address, technical information about the browser, the time of the request and the referring address.

Google Maps is available on the Website as an external link, not as an embedded map. When the link is opened, the visitor moves to the Google Maps environment, where further data processing is governed by Google's applicable terms and privacy policy.

The Controller is not responsible for the content of other websites or for the personal data processing they carry out. Before using external services, visitors are advised to read the privacy information of the respective service provider.

7. Cookies and similar technologies

A cookie is a small text file that is stored on the visitor's device when a website is opened. Similar technologies may store or read information in the browser's local or session storage.

Necessary cookies and similar technologies may be used for the basic operation and security of the Website and to store the visitor's cookie choice. Consent is not required for them where they are technically necessary to provide the service requested by the visitor.

Analytics cookies are not necessary for the basic operation of the Website. They may be stored on the visitor's device only after consent has been obtained.

8. List of cookies used on the Website

Cookies may expire sooner if the visitor deletes them, the browser applies a shorter period or consent is withdrawn. If new cookies are introduced on the Website or their purposes change, this list is updated before those cookies are used.

9. Managing consent

On the first visit to the Website, the visitor can accept or reject analytics cookies equally easily. Analytics cookies are not enabled until the visitor has given consent.

The visitor can change or withdraw consent at any time using the “Cookie settings” link in the Website footer. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

The visitor can also delete or block cookies in the browser settings. Blocking cookies may affect some functions of the Website, but rejecting analytics cookies does not restrict the Website's basic functions.

10. Recipients of personal data

Where necessary, personal data may be disclosed to:

• the Controller's employees and authorised persons who need the data to perform their duties;
• providers of hosting, maintenance, information technology and security services for the Website;
• Google Ireland Limited and the sub-processors involved in providing Google services;
• providers of legal, audit, insurance or other professional services, where necessary to protect the Controller's rights;
• national and local government authorities, courts or law enforcement authorities in the cases provided for by law.

Service providers may process personal data only in accordance with the Controller's instructions, the contract and applicable data protection requirements, except where they act as independent controllers for the processing concerned.

11. Transfer of personal data outside the European Economic Area

When Google services are used, personal data may be processed outside the European Union and the European Economic Area, including in the United States. In such cases, the transfer relies on an applicable European Commission adequacy decision, the EU–US Data Privacy Framework for certified recipients, the European Commission's standard contractual clauses or another mechanism that complies with Chapter V GDPR.

Information about the transfer mechanisms Google uses at any given time is available in Google's privacy and data processing terms.

12. Rights of the data subject

In the cases provided for by the GDPR and other laws, the data subject has the right to:

• receive information about the processing of their personal data and access it;
• request the correction of inaccurate data or the completion of incomplete data;
• request the erasure of personal data or the restriction of processing;
• object to processing based on the Controller's legitimate interests;
• withdraw consent at any time where processing is based on consent;
• receive their data in a structured, commonly used and machine-readable format where the right to data portability applies;
• lodge a complaint with a supervisory authority.

Requests can be submitted using the contact details given in section 2 of the Policy. Before fulfilling a request, the Controller may ask for additional information to verify the person's identity. Requests are handled within the time limits set by the GDPR.

13. Complaints

If a person believes that their personal data are being processed improperly, they are encouraged to contact the Controller or the data protection officer first.

The data subject has the right to lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija): Elijas iela 17, Riga, LV-1050; website https://www.dvi.gov.lv/; email pasts@dvi.gov.lv.

14. Automated decision-making

The Controller does not carry out automated individual decision-making, including profiling, through the Website that would produce legal or similarly significant effects for the visitor.

15. Updates to the Policy

The Policy is reviewed at least once a year and before or after significant changes to the Website's functionality, the services used, cookies, data flows or applicable requirements. The current version of the Policy is published on the Website with its effective date.

16. Final provisions

The Policy enters into force on the day it is approved. The version published on the Website applies from the effective date stated in it.