DATA PROTECTION
Privacy Policy.
What we collect, why we collect it, how long we keep it, and what you can make us do about it.
01 Who we are
This website is operated by Qix Service IT SIA, a limited liability company registered in the Commercial Register of the Republic of Latvia on 19 August 2026 under registration number 40203771606, with its registered address at Dārzu iela 25, Rēzekne, LV-4601, Latvia.
For the personal data described in this policy, Qix Service IT SIA acts as the data controller — meaning we decide why and how that data is processed. Where we build and host systems on behalf of a client, we generally act as a processor for the data inside those systems, governed by the contract with that client rather than by this policy.
02 What we collect
We collect as little as we can get away with while still running a business.
Information you give us
- Your name, email address and — if you provide it — your company name and phone number, when you submit the contact form or write to us directly.
- The content of your enquiry: the project description, timeline, package of interest, and anything else you choose to include.
- Correspondence with us by email, phone or messaging apps, including attachments you send.
- Billing details necessary to issue an invoice: legal name, address, registration or personal identification number where legally required, and bank details.
Information collected automatically
- Standard server log data, which may include your IP address, browser type, referring page, and the date and time of the request. This is generated by the hosting infrastructure.
- Cookie and local-storage data, described in detail in our Cookies Policy. Only strictly necessary storage is used unless you consent to more.
What we do not collect
- We do not collect special category data (health, biometrics, political opinions, and so on), and we ask you not to send it.
- We never see or store your payment card details. Payments to us are made by bank transfer against an invoice.
03 Why we use it
Every processing activity has a lawful basis under Article 6 of the GDPR:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Replying to your enquiry and preparing a quote | Name, email, company, message | Steps prior to entering a contract (Art. 6(1)(b)) |
| Delivering a project you have engaged us for | Contact and project data | Performance of a contract (Art. 6(1)(b)) |
| Issuing invoices and keeping accounts | Billing details, invoice records | Legal obligation (Art. 6(1)(c)) |
| Keeping the website secure and available | Server logs, IP address | Legitimate interests (Art. 6(1)(f)) |
| Optional analytics or embedded content | Cookie identifiers | Your consent (Art. 6(1)(a)) |
| Establishing or defending legal claims | Relevant correspondence and records | Legitimate interests (Art. 6(1)(f)) |
Where we rely on consent, you can withdraw it at any time — see Your rights. Withdrawing consent does not affect processing that already happened while the consent was valid.
We do not use your data for automated decision-making or profiling, and we do not sell it. Ever.
04 How long we keep it
- Enquiries that do not become projects: up to 12 months from the last message, then deleted.
- Client project records and correspondence: for the duration of the engagement and up to 3 years afterwards, in line with the general limitation period for claims.
- Accounting records, including invoices: retained for the period required by Latvian accounting and tax law, which is generally 5 years.
- Server logs: typically 30 days, unless a specific security incident requires longer.
- Cookie consent record: stored in your own browser, and cleared when you clear site data.
When a retention period ends, data is deleted or irreversibly anonymised.
06 International transfers
We prefer providers inside the European Economic Area. Where a provider processes data outside the EEA — for example certain cloud regions or email infrastructure — we rely on an adequacy decision by the European Commission, or on Standard Contractual Clauses together with any additional safeguards required.
You can ask us which providers are involved in your specific engagement, and we will tell you.
07 Your rights
Under the GDPR you have the right to:
- Access — obtain confirmation of whether we process your data, and a copy of it.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — have data deleted, where there is no overriding legal reason to keep it.
- Restriction — have processing paused while a dispute about accuracy or lawfulness is resolved.
- Portability — receive data you provided in a structured, machine-readable format.
- Object — object to processing based on legitimate interests, on grounds relating to your situation.
- Withdraw consent — at any time, where processing is based on consent.
To exercise any of these, write to us using the details in section 11. We respond within one month. There is no charge unless a request is manifestly unfounded or excessive, and we will say so plainly if we think that is the case rather than quietly ignoring it.
08 Security
We apply technical and organisational measures appropriate to the risk, including: encryption in transit (HTTPS) across the whole site, access limited to the people who genuinely need it, credentials stored in a password manager rather than in documents or source code, secrets kept out of repositories, and regular updates of the software we depend on.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and inform you without undue delay where the risk is high.
09 Children
This is a business-to-business website. It is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
10 Changes to this policy
We may update this policy as the business or the law changes. The version number and "last updated" date at the top of this page always reflect the current version. Where a change materially affects your rights, we will take reasonable steps to bring it to your attention rather than relying on you to notice.
11 Contact & complaints
For any question about this policy or to exercise your rights:
- Qix Service IT SIA, Dārzu iela 25, Rēzekne, LV-4601, Latvia
- Email: hello@qixserviceit.lv
- Phone: +371 20 000 000
If you are not satisfied with our response, you have the right to lodge a complaint with the Latvian supervisory authority, the Data State Inspectorate (Datu valsts inspekcija), or with the authority in your country of residence.