Effective date: 1 October 2026
1. Who we are
The controller of your personal data is Lailio SIA, registration No. 40103682655, Mūkusalas iela 41, 4th floor, Riga, LV-1004, Latvia (“Lailio”, “we”). Group companies Lailio Solutions SIA (40103698660) and Lailio Software SIA (42403039599) may act as joint or separate controllers when you contract with them directly.
For any privacy question or request, contact us at info@lailio.com or by post at the address above.
2. What data we process and why
| Situation | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Contact and consultation forms | name, company, e-mail, phone, message | answering your request, preparing an offer | steps prior to a contract / legitimate interest, Art. 6(1)(b), (f) |
| E-mail and phone communication | contact details, correspondence | client and partner communication | contract / legitimate interest, Art. 6(1)(b), (f) |
| Job applications (cv@lailio.com) | CV, contact details, information you provide | recruitment | steps prior to a contract; consent for keeping your CV for future vacancies, Art. 6(1)(b), (a) |
| Website operation | IP address, browser data, server logs | security, availability, abuse prevention | legitimate interest, Art. 6(1)(f) |
| Analytics cookies | pseudonymous usage data | understanding and improving the website | consent, Art. 6(1)(a) |
| Marketing cookies | pseudonymous identifiers, conversion data | measuring and personalising advertising | consent, Art. 6(1)(a) |
Cookies and similar technologies are described in our Cookie Policy. Analytics and marketing cookies are only used after you have given consent in the cookie banner.
3. Recipients
We share personal data only as far as necessary with:
- service providers acting on our behalf (hosting, e-mail, helpdesk and CRM systems, IT support) under data processing agreements;
- analytics and advertising providers, only with your consent: Google Ireland Ltd (Google Analytics 4, Google Ads, Google Maps), Microsoft Ireland Operations Ltd (Clarity), Hotjar Ltd, LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag);
- public authorities where required by law.
4. Transfers outside the EU/EEA
Some providers (e.g. Google, Microsoft, LinkedIn) may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission.
5. How long we keep data
- enquiries and correspondence: up to 3 years after the last contact, unless a contract follows;
- contract and accounting records: as required by Latvian law (generally 5–10 years);
- job applications: until the end of the recruitment, or up to 12 months with your consent;
- cookie data: see the Cookie Policy; your cookie choice is stored for 12 months.
6. Your rights
You have the right to access, rectify and erase your data, to restrict or object to processing, to data portability, and to withdraw consent at any time (for cookies via Cookie settings in the website footer). Withdrawal does not affect processing carried out before it.
You may lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija, Elijas iela 17, Riga, LV-1050, www.dvi.gov.lv) or the supervisory authority of your country of residence.
7. Security
We apply technical and organisational measures appropriate to the risk, including access control, encryption in transit and regular security reviews, in line with our ISO/IEC 27001 practices.
8. Changes
We may update this policy. The current version is always published on this page with its effective date.