Privacy policy
This is an English translation of the Latvian privacy policy. In the event of any discrepancy, the Latvian version prevails.
1. General provisions
1.1. This privacy policy (the Policy) describes how SIA "GisIT" processes personal data in connection with the Balvantis platform – the website balvantis.com, the web application and the mobile app (together, the Service).
1.2. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, the GDPR), the Latvian Personal Data Processing Law and other applicable laws and regulations of the Republic of Latvia.
1.3. The Service is intended solely for legal persons and for natural persons for the purposes of their business or professional activity.
2. Controller and contact details
2.1. The controller of the personal data processing described in Section 4 of this Policy is SIA "GisIT", unified registration No. 40203674620, registered address: Zāļu iela 5, Baloži, Ķekava Municipality, LV-2112, Latvia (the Company).
2.2. Contact for personal data processing matters: [email protected].
2.3. No data protection officer has been designated within the meaning of Article 37 of the GDPR, as the scope of the Company's activities does not require one; the contact person for data protection matters can be reached at the e-mail address given in clause 2.2.
3. The Company's roles in data processing
3.1. Depending on the data set, the Company is either a controller or a processor within the meaning of the GDPR:
| Data set | Company's role | Controller |
|---|---|---|
| Service user accounts, organization details, billing | Controller | The Company |
| Early access applications on the website | Controller | The Company |
| Security (audit) logs and website visit statistics | Controller | The Company |
| Customers' employee data – personnel data, remuneration, absences, documents, working time and location data | Processor | the respective customer (employer) |
| Customers' business data – expense documents, waybills, bank transactions, customers' contact persons | Processor | the respective customer |
3.2. Where the data subject is an employee of a customer of the Company, the employer is responsible, as controller, for the processing of the relevant data. In that case, data subject rights (access, rectification, erasure, etc.) are exercised by contacting the employer; the Company processes the data only on the documented instructions of the controller and provides the controller with the assistance necessary to fulfil requests. If such a request is received by the Company, it is forwarded to the relevant controller and the data subject is informed accordingly.
4. Processing for which the Company is the controller
4.1. Service accounts and organizations
- Data categories: first name, surname, e-mail address, phone number and profile picture (if provided), password hash, role in the organization, language and interface settings, the mobile app's device push identifier (if notifications are enabled); organization details.
- Purpose: conclusion and performance of the Service contract, access management.
- Legal basis: Article 6(1)(b) of the GDPR (performance of a contract).
- Providing this data is necessary for the conclusion and performance of the contract; without it, a Service account cannot be created or used.
4.2. Billing
- Data categories: invoice details, payment status. Payment card data is not available to the Company and is not stored by it – it is processed by the payment service provider Stripe (see Section 8).
- Purpose and legal basis: performance of a contract (GDPR 6(1)(b)) and compliance with accounting laws and regulations (GDPR 6(1)(c)).
4.3. Early access applications
- Data categories: e-mail address (mandatory), name and company name (optional), source and time of the application. The IP address and browser data are not stored with the application.
- Purpose: communication about access to the Service during its launch.
- Legal basis: the data subject's consent, given by submitting the application form (GDPR 6(1)(a)). Consent may be withdrawn by writing to [email protected]; the application is then deleted.
- No commercial communications are sent to the addresses given in applications unless separate consent has been obtained.
4.4. Security (audit) logs
- Data categories: records of significant actions in the system – user, time, IP address, browser identifier, changes made.
- Purpose: information security, incident investigation, traceability of changes.
- Legal basis: the legitimate interests of the Company and its customers (GDPR 6(1)(f)) in ensuring system security.
- Retention period: 2 years from the date of the record. The period has been set taking into account that the log serves the investigation of security incidents and the traceability of changes while claims arising from employment relationships are not time-barred (Section 31 of the Latvian Labour Law); after the period ends, records are deleted automatically.
4.5. Website visit statistics
On the public website, visit statistics are collected with Umami, a tool run on the Company's server in cookieless mode: nothing is stored on the visitor's device, and the data is not transferred to third parties and does not leave the Company's server.
The following information is processed: the page visited, the referrer, the approximate country, the device type, the browser and the operating system. The IP address is not stored – it is used only at the moment the request is processed, including to determine the country.
Each visit is stored as a separate record linked to a technical session identifier. The identifier is an irreversible hash of the request's technical parameters and a server-side random value that is changed once a day; after the change, earlier records can no longer be linked to a specific visitor. The Company uses these statistics only in the form of aggregated figures and takes no action aimed at identifying individual visitors.
5. Processing for which the Company is the processor
5.1. On behalf of the customer (controller), the following data categories are processed in the Service:
- employees' basic data – first name, surname, personal identity number, contact details, bank account number (IBAN), position, files of employment contracts and other personnel documents;
- remuneration data – rates, calculations, payments, balances;
- absence data, including health data within the meaning of Article 9 of the GDPR: the fact, type and period of incapacity for work. Diagnoses are not entered into the system and are not available to the Company. Absence information is not visible to other users of the organization – only to the employee concerned and to users to whom the customer has granted access rights to personnel data;
- working time and location data – see clause 5.3;
- work performance data – notes and photos of shifts and jobs (proof of work), photos of receipts and goods, inventory movements and stocktaking data;
- communication data – messages and their attachments in the Service's internal chat, company announcements and their acknowledgements;
- business documents – expense supporting documents, waybills, bank account statements and transactions, contact details of the customer's business partners.
5.2. The legal basis for processing is determined by, and is the responsibility of, the customer as controller (for example, for the personal identity number – a legal obligation under Section 40 of the Labour Law; for incapacity data – GDPR 9(2)(b) in conjunction with employment and social insurance laws and regulations). The Company processes the data only on the customer's documented instructions on the basis of a data processing agreement (Article 28 of the GDPR) and does not use it for its own purposes.
5.3. Location (GPS) data
5.3.1. If the customer has activated the feature, the employee's location is recorded only in the period from the recording of the start of the shift (check-in) to the recording of the end of the shift (check-out). Outside this period, location data is neither collected nor accepted – the server rejects it.
5.3.2. The purpose of processing is the recording of working time and site visits and the planning of work at geographically dispersed sites. The data is not used to evaluate employees' behaviour; no profiling is carried out.
5.3.3. Location data is automatically and irreversibly deleted after 90 days.
5.3.4. The employer is obliged to inform employees about the use of the feature before activating it. Questions about the basis for and necessity of the processing should be addressed to the employer.
5.3.5. While data is being shared, the mobile app on an Android device continuously displays a non-removable notification that location is being shared. See also Section 11.
6. Automated document reading (artificial intelligence services)
6.1. The Google Gemini API (paid service tier) is used for the automated reading of certain documents: images and PDF files of expense supporting documents, waybill documents, bank transaction descriptions.
6.2. The data is processed briefly, only to fulfil the specific request; under the Gemini API paid service terms and Google's data processing agreement, Google does not use this data to improve its products or to train models.
6.3. Legal basis for the transfer to the USA: the EU–U.S. Data Privacy Framework (DPF) and the European Commission's standard contractual clauses (SCC).
6.4. Results prepared automatically are always reviewed and approved by the user; the customer may choose not to use these features, and they can be switched off.
6.5. Automated individual decision-making, including profiling, that would produce legal effects concerning the data subject or similarly significantly affect them (Article 22 of the GDPR) is not carried out in the Service.
7. Cookies and storage of information on the terminal device
7.1. The Service uses only strictly necessary and functional cookies. Under Section 7.¹(2) of the Latvian Law on Information Society Services, consent is not required for such storage, and therefore no consent dialog (banner) is shown:
| Name | Purpose | Retention | Characteristics |
|---|---|---|---|
balvantis_api_token | Maintaining an authenticated session in the web application | 8 hours | httpOnly, SameSite=Lax, HTTPS only |
balvantis_theme | Interface theme choice | 365 days | functional |
balvantis_locale | Language choice | persistent | functional |
7.2. No cookies are used on the public website; the interface theme choice is saved in the browser's localStorage at the user's direct choice and contains no personal data. Visit statistics work without cookies (see clause 4.5).
7.3. Analytics or marketing cookies are not used. Should they be introduced, consent would be requested before their use.
8. Sub-processors and data recipients
8.1. The following categories of processors and sub-processors are engaged to provide the Service:
| Service provider category | Function | Data processed | Location / transfer safeguards |
|---|---|---|---|
| Hosting service provider | Server infrastructure | All Service data | EU |
| File storage service provider | Storage of uploaded documents and files | Uploaded documents and files | EU, private access |
| Stripe (payment service provider) | Payment processing | Billing and payment data | EU/USA; DPF and SCC |
| Google LLC (Gemini API, paid tier) | Automated document reading (see Section 6) | Images of expense documents, waybills, transaction descriptions | USA; DPF and SCC |
| Enable Banking (bank account access provider) | Bank account connection | Account statements and transactions | EU |
| Expo (EAS) | Delivery of mobile app push notifications (see clause 11.4) | Device push identifier, notification title and text | USA; SCC |
8.2. The full list of sub-processors naming the specific service providers is made available to customers under the data processing agreement, including notification of changes to the list.
8.3. No e-mail sending service is currently used; before one is introduced, the list will be updated and customers will be informed in accordance with the procedure set out in the data processing agreement.
8.4. Data is disclosed to national and local government authorities only in the cases and in the manner provided for by laws and regulations.
9. Retention periods
| Data category | Retention period |
|---|---|
| Location (GPS) data | 90 days; automatic deletion |
| Security (audit) logs | 2 years |
| Technical server logs (access and error records) | As long as necessary for monitoring security and technical operation |
| Early access applications | 12 months from the application or until consent is withdrawn |
| Account and customer data in the Service | The term of the contract; after termination, a 30-day data export period, then deletion |
| Billing (accounting) documents | The retention periods for accounting documents set by laws and regulations |
10. Transfers outside the EEA
Data is stored and processed in the European Union / European Economic Area. Data is transferred outside the EEA only to the service providers listed in Section 8 (Stripe, Google, Expo) and, in the course of push notification delivery, to the notification service of the device's operating system (see clause 11.4), on the basis of certification under the EU–U.S. Data Privacy Framework (DPF) and/or the European Commission's standard contractual clauses (SCC) in accordance with Chapter V of the GDPR. More detailed information about transfers and the safeguards applied can be obtained by writing to the e-mail address given in clause 2.2.
11. Mobile app
11.1. Location is shared only during an active shift (see clause 5.3). For sharing to work also when the app is not open, the operating system requires the background location permission ("Always"); outside a shift, location is neither shared nor recorded.
11.2. If only the "While using the app" permission is granted, sharing works while the app is open.
11.3. When the app session ends (on signing out), location data temporarily buffered on the device is deleted.
11.4. Push notifications are delivered through the Expo service (see Section 8), which passes the notification to the notification service of the device's operating system – the Apple Push Notification service (on iOS devices) or Google Firebase Cloud Messaging (on Android devices) – for delivery to the device. Notifications contain only work-related information: names of persons, dates, names of shifts, places and conversations, and the title and opening text of company announcements. The content of chat messages is not included in push notifications. Notifications can be switched off in the app or in the device settings.
11.5. The camera and the device's photos are used only on the user's action: to add proof-of-work photos, receipts and other documents, images of goods or chat attachments, and to scan barcodes of goods. The app reads only the images the user selects; no images are saved while scanning a barcode. Added images are stored in the Service together with the related record (see clause 5.1).
11.6. Chat messages sent in the app and their attachments are stored in the Service and are visible to the participants of the conversation within the organization.
11.7. Maps in the app are loaded from a map server hosted by the Company itself (maps.balvantis.com); map requests are not passed on to third parties. If the user chooses to open an address in the device's map app (for example, to plan a route), the address is passed to that app, and its further processing is governed by that app's terms.
11.8. The app shows no advertising and uses no analytics or tracking tools. The app contains no third-party software development kits (SDKs) other than Expo (app operation and push notifications) and MapLibre (map display on the device without sending data to third parties).
12. Data subject rights
12.1. With regard to processing for which the Company is the controller (table in clause 3.1), the data subject has the right to: access their personal data; request its rectification or erasure; request restriction of processing; receive the data in a structured, commonly used and machine-readable format (data portability); object to processing based on legitimate interests; withdraw consent without affecting the lawfulness of processing carried out before its withdrawal.
12.2. Requests are submitted by writing to [email protected]. Before fulfilling a request, the Company verifies the identity of the person submitting it; a response is given no later than one month from receipt of the request.
12.3. Deactivation of an account does not in itself constitute erasure of data; erasure is carried out on request or within the periods set in Section 9.
12.4. The data subject has the right to lodge a complaint with the supervisory authority – the Data State Inspectorate of Latvia (www.dvi.gov.lv).
12.5. Where the data subject is an employee of a customer of the Company, the rights are exercised by contacting the employer as controller (see clause 3.2).
13. Account and data deletion
13.1. Service user accounts are created and managed by the customer (employer), and therefore the mobile app has no account deletion function. A user who wishes to delete their account or their data may:
- contact their employer – the organization's administrator can immediately revoke the user's access and delete the employee record with its data in the Service's web application;
- write to [email protected] from the account's e-mail address, stating the organization.
13.2. The Company fulfils a request received at [email protected] within 30 days of its receipt. Data that the Company processes as controller (Section 4) is deleted by the Company itself. If the request concerns data that the Company processes as processor on behalf of the employer (clause 3.2), the Company forwards the request to the employer within this period, carries out the deletion on the employer's instruction and informs the person who submitted the request.
13.3. Deletion does not apply to data whose retention is required by laws and regulations: accounting and billing documents, including payroll calculations, which are retained for the periods set by laws and regulations, and security (audit) logs, which are retained for the period set in Section 9. Such data is retained solely to fulfil the relevant obligation and is deleted once the period ends. Location data is in any case deleted after 90 days (clause 5.3.3). Data in backup copies is deleted in the course of the backup rotation cycle.
13.4. This procedure is also described on the mobile app support page balvantis.com/en/app.
14. Data security
The Company implements appropriate technical and organizational measures, including: encryption at rest of sensitive fields (personal identity number, IBAN); access according to roles and granted rights with data masking in the interface; an httpOnly session mechanism; data transmission only over an encrypted (HTTPS) connection; file storage in private storage in an EU region; an audit log of actions; server-side restriction of location data collection; automated data deletion procedures.
15. Amendments to the Policy
Customers are informed of material amendments to this Policy by e-mail or in the Service at least 14 days before they take effect. The current version of the Policy, with its effective date, is always available on this page.