Privacy policy

Controller

The controller of personal data is [Operator name — to be completed], [Address — to be completed]. For questions about your data, write to hello@latviaplaces.com.

What we process

• When you browse: the hosting provider’s server logs (IP address, browser, time) for security and troubleshooting. We use no analytics or advertising cookies.
• Map: map images load from OpenFreeMap’s servers, which see your IP address.
• Spam protection: on public forms, Cloudflare Turnstile checks browser signals.
• Account: your email address and sign-in records, if you create an account.
• Business submissions: the place’s details, the contact person’s name, email, phone and notes.
• Enquiries to businesses: the name, email, phone and message you send to a business.

Why, and on what basis

• To provide the service — your account, reviewing submissions, forwarding enquiries to businesses (GDPR Art. 6(1)(b)).
• For security and to prevent abuse (legitimate interests, Art. 6(1)(f)).
• To publish business details — with your confirmation in the submission (Art. 6(1)(a)).

Who receives data

Our service providers process data for us: Supabase (database and sign-in, EU region), Vercel (hosting), Resend (sending email), Cloudflare (Turnstile) and OpenFreeMap (maps). Your enquiry is sent to the business you address. Where data leaves the EEA, we rely on standard contractual clauses or the EU–US Data Privacy Framework.

How long we keep it

• Account data — until the account is deleted.
• Submissions — 24 months after the decision.
• Enquiries — 12 months.
• Server logs — according to the providers’ terms.

Your rights

You may ask for access to your data, correction or deletion, restriction of processing, object to processing, receive your data in a portable format and withdraw consent. Write to hello@latviaplaces.com. You also have the right to complain to Latvia’s Data State Inspectorate (www.dvi.gov.lv).