Privacy and your rights

1. Who is responsible

The controller of the personal data described here is SIA BARGO, registration number 42403048572, Krišjāņa Valdemāra iela 105-57, Rīga, LV-1013, Latvia, which runs unbin.lv.

Write to privacy@unbin.lv about anything in this notice. We have not appointed a data protection officer. The person responsible for data protection at SIA BARGO is its board member.

2. In short

Nothing is sold. Data goes only to the recipients in section 11.

3. People in public procurement and register data

What is shown. unbin.lv reads public records and computes figures from them:

• the notices of the Procurement Monitoring Bureau (IUB);
• the Electronic Procurement System (EIS): calls, procurement procedure documents, tenders, results and contracts;
• the Enterprise Register's open data: companies, filed annual accounts, officers, beneficial owners, members and shareholders;
• the Ministry of Finance's de minimis register;
• calls that contracting authorities publish only on their own websites.

Of people, it shows:

• officers: board members and others with the right to represent a company. The name as registered, the governing body and position, how they may represent the company, and since when. A person's page lists the companies the register names them for;
• natural persons who were awarded a contract: sworn advocates, sole traders, farms, private practices or individuals. They are named on the contract as the procurement notice names them;
• contact persons and procurement commission members named in procurement procedure documents. Signed-in readers can open those documents, as the contracting authority published them, while tenders can still be submitted. The files are then deleted.

Beneficial owners, members and shareholders are never named as owners. A signed-in reader's network shows, without a name, only that one person holds such a role in two or more of the companies drawn.

Who sees names. Names of people are shown only to signed-in readers. A reader without an account sees that a person holds a role or won a contract, not who. Personal codes and dates of birth are never shown. A person who won a contract has no page of their own. Political parties, religious communities and trade unions are left out, so that no one's political, religious or trade-union affiliation is shown.

Why, and the legal basis. To show who competes for public contracts, who wins them, and who can bind the companies that win them. The legal basis is our legitimate interests and those of our readers (GDPR Art. 6(1)(f)). The state publishes this data so that anyone can see who is paid from public funds and who may act for a company. It concerns people in that public, commercial role, not their private life. We weighed these interests against the people's interests, and the limits above are the result of that weighing.

Why you were not told directly. We do not hold contact details for the people in these records. Writing to each of them would take disproportionate effort, so this notice is published instead (GDPR Art. 14(5)(b)).

How long. Officers' data is replaced with every load of the register, and a role the register removes leaves unbin.lv on the next load. A contract and the name of the natural person who won it are kept as long as the service shows that contract's history. Procurement procedure documents are deleted once tenders can no longer be submitted. The lines that AI read from them are kept, after personal data has been removed.

Objecting. If you do not want to be shown, write to privacy@unbin.lv with the link to the page. A winner's name is then removed from every contract. If the register itself is wrong, the correction belongs to the Enterprise Register, and unbin.lv follows it on its next load.

4. Visitors

What is recorded. unbin.lv records what is read on it:

• the pages you open, what you search, click and copy, how long and how far you read;
• the page that sent you here, and any campaign tag in the link;
• an identifier kept in a cookie;
• with it, your IP address, browser, device, language, time zone and screen size.

Why. To understand how the product is used, and to see which visitors and companies are interested in it so that we can get in touch. If you send us a message or sign in, what you read here is kept with your name and e-mail.

Legal basis. Our legitimate interests (GDPR Art. 6(1)(f)): to know how the product is used and who is interested in it. You can object to this use at any time by writing to privacy@unbin.lv (Art. 21); we then stop recording your visits and delete what was recorded of them.

Other cookies. A session cookie keeps you signed in, and a cookie remembers your language.

How long. Nothing recorded of your visits is kept longer than 24 months after your last visit.

5. Account holders and team members

What we hold:

• your e-mail, your name, your password, your sessions and your role (owner or member);
• your alerts, the tenders you follow, when you last opened each of them (to mark what has changed since), and how you are told of them (e-mail, the bell, a messaging app you connect, a calendar feed);
• what you use: questions asked against the allowance, and pages viewed against the Free plan's daily limit;
• security records: sign-ins, password changes, failed attempts;
• your phone number, if you gave one at sign-up (optional, not verified), and whether you agreed to be phoned or texted about our offers;
• your company's registration number, and information showing whether the company or the phone number has already had a trial.

We protect this data with appropriate technical and organisational measures.

Why, and the legal basis:

• to provide the service under the terms (GDPR Art. 6(1)(b)). For an invited colleague, the contract is the company's, and the basis is our and the company's legitimate interest in providing it to the people the company chose (Art. 6(1)(f));
• to keep it secure and to count the allowance and the daily limit (Art. 6(1)(f));
• to send the mails that belong to the service: confirmation, invitations, password reset, alerts, trial and renewal reminders, receipts (Art. 6(1)(b));
• to keep one trial per company and prevent misuse: we keep the registration number and information showing whether the company or the phone number has already had a trial (Art. 6(1)(f), recital 47); to reach you about your account by phone; and, only if you ticked the box, to phone or text you about our offers (Art. 6(1)(a); ISPL Art. 9(3)).

How long:

• a sign-up whose e-mail is not confirmed within 3 days is deleted;
• an invitation not accepted within 7 days lapses;
• your phone number goes when your account goes; the registration number and the information showing whether the company or the phone number has already had a trial are kept 24 months from the day the trial began;
• when a trial or a paid plan ends, the account moves to the Free plan, and its board, alerts and follows are paused and kept;
• if no one signs in to the company's account for 24 months, we tell the owner, and delete the account 30 days later if still no one signs in;
• when you delete your account, it is deleted at once, with your sessions, alerts, messaging-app connection, questions to the AI and what was recorded of your visits. Your comments and entries in your team's board keep your name while the team has an account. If you are the team's last member, the team goes too, with its board;
• deleted data stays in encrypted backups for up to 6 months, then the backups rotate out.

6. Payments and invoices

What we hold: the company's invoicing details (name, address, registration and VAT numbers), the name and e-mail of the person who manages payments, the plan, the seats, the invoices and credit notes, and the payment status. We do not see or keep card numbers or bank account numbers. Stripe holds them. We keep only Stripe's references, the card brand, its last four digits and its expiry date.

Why, and the legal basis: to take payment and invoice under the contract (GDPR Art. 6(1)(b)); to keep invoices and accounting records as the Value Added Tax Law (Article 133) and the Accounting Law (Article 28) require (Art. 6(1)(c)).

How long: invoices, credit notes and payment records for 5 years from the invoice date, or longer where the Accounting Law requires, even after the account is deleted.

Stripe. Payments are processed by Stripe Payments Europe, Limited (Ireland). Stripe processes payment data for us, and is itself the controller for what it must do by law, such as preventing fraud and money laundering. Stripe's own privacy notice applies to that: stripe.com/privacy.

7. What a team writes in its own account

Notes, comments and hand-offs on a team's board may name people. For that data, the customer company is the controller and we are its processor. We process it only to provide the service, under Annex A of the terms of service. A person named in a team's notes should first write to that company. We will help the company answer.

8. Questions to the AI, and the documents it reads

The documents. The contracting authorities' procurement procedure documents, procurement commission reports and contract amendments are read by an AI service. Before they are sent to it, we remove personal data from them. Nothing about visitors or accounts is sent with them.

Your questions. A question you ask about a tender is sent to the AI service that answers it. With it go:

• the conversation's earlier questions and answers;
• passages from that tender's documents;
• our data on the tender;
• when the question is about your own company, our figures for it, without its name or registration number.

Before the question is sent, we remove personal data from it. Your name, e-mail and account are not sent. Do not type personal or confidential data into a question.

The AI service is provided by an AI service provider in the People's Republic of China, which processes the data there. The European Commission has not decided that China protects personal data adequately, and the provider has not given us the safeguards the GDPR sets for transfers (Art. 46). We therefore send it no personal data, by design, as described above. The provider's terms do not exclude using what it receives to improve its models. Do not write into a question anything about a person, or anything your company would not want processed on those terms. We name the current provider on request at privacy@unbin.lv.

How long. A question and its answer are kept 30 days so that you can read them again. Only you see them, and they are deleted with your account. We do not use them to train AI models of our own.

Marking. Lines and answers written by AI are marked as such in the service (EU AI Act, Article 50).

9. Contacts of companies that bid in public procurement

We offer unbin.lv to companies that take part in public procurement, by e-mail and by phone.

Where the contact comes from. From the procurement notices that IUB and EIS publish: the contact point a tenderer or winner gave (a name, a work e-mail address, a phone number), with the company's name and registration number. We add what unbin.lv itself computes about the company's public procurement, such as the contracts it won and the buyers it bids for. This is the data we use to write to the company about what unbin.lv shows of its market.

Why, and the legal basis. To offer our service to companies for which it is relevant. The legal basis is our legitimate interest in direct marketing to businesses (GDPR Art. 6(1)(f); recital 47). We have recorded the weighing of that interest against the contact person's interests. In short:

• we write only about the company's own public procurement;
• we prefer the company's general address (info@, birojs@) to a person's;
• we do not build a profile of the person;
• we stop at the first objection.

What we do not do. We do not send commercial e-mails to sole traders or to other natural persons who have not agreed to them (Information Society Services Law, Article 9(1) and (6)). We do not call a number unless we know it belongs to a company.

Your first message from us says who we are, where we got your contact, and why we write. It links to this notice and gives a one-click way to object.

Objecting. You can object at any time, free of charge (Art. 21(2)–(3)): use the link in any of our messages, reply "stop", or write to privacy@unbin.lv. We then stop at once. We keep your e-mail address or phone number on a do-not-contact list, with the date, so that we never contact you again. That list is kept for as long as we do outreach (Art. 6(1)(f), to respect your objection).

How long. Outreach contact data is deleted 12 months after our last message if you have not answered. If you answer, it is kept while we are in touch, and then as section 10 says.

10. Messages and requests to us

If you write to us, or send the form on the site, we keep what you write and your contact details to answer you (GDPR Art. 6(1)(f)). It is deleted 24 months after we last dealt with it. A data protection request and our answer are kept for 3 years, to show how it was handled.

11. Who receives the data

12. Transfers outside the European Economic Area

• The AI service provider (People's Republic of China): we send no personal data by design (section 8). No adequacy decision covers China, and the provider has not given safeguards under GDPR Art. 46.
• A messaging app you choose: only if you choose to receive messages there.
• Providers with access from the United States: where a provider may access data from the United States, it relies on the EU–US Data Privacy Framework or on standard contractual clauses.

13. Your rights

Under the GDPR you have the right:

• to know what is held about you and get a copy (Art. 15);
• to have it corrected (Art. 16);
• to have it erased (Art. 17);
• to have its use restricted while a request is settled (Art. 18);
• to take your account's data with you (Art. 20);
• to object to processing based on legitimate interests, including being shown on unbin.lv (Art. 21(1));
• to object at any time to direct marketing (Art. 21(2));
• to withdraw consent at any time, without affecting what was done before (Art. 7(3)).

Write to privacy@unbin.lv, with the link to the page you mean if it is about a page. We may ask you to confirm who you are. We answer within one month; if a request is complex, we may extend that by two more months and tell you why (Art. 12(3)).

No decision that has legal or similarly significant effects on you is made by automated means alone (Art. 22).

14. What you must give

To create an account you must give an e-mail address and your company's registration number, and to buy a paid plan the company's invoicing details. Without them we cannot provide the service. Everything else is optional.

15. Where to complain

If you think we have not handled your data or your request lawfully, you may complain to the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv, or to the authority where you live or work.

16. Changes to this notice

The date at the top changes with every change. We e-mail account owners before a change that affects them.

---