Terms of use

Effective from: 2026-09-06 · Version 1.1

This is an English translation of the Latvian terms of use. In the event of any discrepancy, the Latvian version prevails.

Version 1.1 amends version 1.0 (effective from 2026-09-02) as follows: the Trial Period is one month (Annex A); the Customer's obligation to check data prepared in the Service and the procedure for reporting errors have been clarified (clauses 2.5 and 2.6), as has the limitation of liability (clause 10.1). For Customers who accepted version 1.0, the amendments take effect in accordance with the procedure set out in Section 13 of the Terms.

1. General provisions

1.1. These terms of use (the Terms) set out the procedure for using the Balvantis platform – the website balvantis.com, the web application and the mobile app (together, the Service) – provided by SIA "GisIT", unified registration No. 40203674620, registered address: Zāļu iela 5, Baloži, Ķekava Municipality, LV-2112, Latvia (the Company).

1.2. For the purposes of these Terms, the Customer is a legal person or a person engaged in business activity in whose name an organization has been created in the Service. A User is a natural person to whom the Customer has granted access to the Service within its organization.

1.3. The Terms, together with their annexes, the privacy policy and the data processing agreement (clause 8.2), form the agreement between the Company and the Customer (the Agreement).

1.4. The Terms are accepted by confirming consent to them during registration. A person who creates an organization or accepts the Terms on behalf of the Customer confirms that they are authorized to represent the Customer.

1.5. The Service is intended solely for legal persons and for natural persons for the purposes of their business or professional activity; it is not offered to consumers within the meaning of the Latvian Consumer Rights Protection Law. By accepting the Terms, the Customer confirms that it will use the Service solely for the purposes of its business or professional activity.

2. Description of the Service

2.1. The Service is a business management platform which, depending on the plan available to the Customer, includes management of employees and shift schedules, working time recording, payroll calculations and preparation of reports, invoicing, management of expense documents and bank transactions, inventory accounting, document storage, management of clients and locations, and a mobile app for employees.

2.2. Certain features rely on automated document reading (artificial intelligence) tools. The results they prepare are advisory in nature: they are reviewed and approved by the User, and the Customer is responsible for the correctness of approved data.

2.3. The Service is an aid for organizing the Customer's business activity. The Company does not provide accounting, tax or legal advice; the Customer is responsible for fulfilling the obligations set by laws and regulations, including the content and submission of reports.

2.4. The Company is entitled to develop and improve the Service. Customers are informed at least 30 days in advance of changes that materially reduce the functionality of the Service, except for changes required for security reasons or by laws and regulations.

2.5. Calculations, statements, reports and files intended for submission (including those intended for the State Revenue Service's Electronic Declaration System) prepared in the Service are based on the data entered by the Customer and the settings chosen by the Customer (together, the Results). Before using the Results – in particular before submitting them to public authorities, making payments to employees or third parties, or taking other decisions based on the Results – the Customer checks their completeness, correctness and mutual consistency. The Results are not a confirmation by the Company of their correctness or of their compliance with laws and regulations, and the Company does not guarantee that the Service detects all inconsistencies in the Customer's data.

2.6. If the Customer discovers an error in the operation of the Service or an inconsistency in the Results, the Customer notifies the Company without delay at the support e-mail address given in clause 15.3 or in the Service, attaching a description of the error and the information needed to reproduce it. The Company assesses the reported error and remedies it within a reasonable period according to its impact. Remedying the error and, to the extent technically possible, correcting the data affected by the error in the Service is the Customer's sole remedy in the event of an error in the operation of the Service, except as otherwise provided in clause 10.3.

3. Account and organization

3.1. During registration and use of the Service, the Customer provides true and up-to-date information and updates it in good time.

3.2. Access credentials (password, sessions) are confidential. The Customer ensures that Users do not disclose them to third parties and notifies the Company without delay of any detected unauthorized access or of access credentials coming into the possession of third parties.

3.3. The Customer manages the Users of its organization and their roles and is responsible for the Users' actions in the Service as for its own actions.

3.4. The Company accesses the data of the Customer's organization only to provide the Service, to provide support at the Customer's request, and in cases provided for by laws and regulations.

4. Acceptable use

4.1. It is prohibited to use the Service:

• to enter, store or distribute content that does not comply with laws and regulations;
• to distribute malicious code or for actions that disrupt the operation of the Service, including deliberately creating excessive load;
• to access the data of other customers' organizations or to circumvent access rights;
• for security testing, vulnerability scanning or intrusion attempts without the Company's prior written permission;
• to decompile the Service or its parts, to create derivative products, or to give access to third parties outside the Customer's organization, except to the extent that this is mandatorily permitted by laws and regulations.

4.2. The Customer is responsible for the content of the data entered into the Service and for the legal basis for its processing, including informing its employees before activating the location data feature (see the data processing agreement).

4.3. In the event of a material breach of this Section, the Company is entitled to act in accordance with Section 11.

5. Intellectual property rights

5.1. All rights to the Service, its software, design and documentation belong to the Company or its licensors.

5.2. For the term of the Agreement, the Customer is granted a simple (non-exclusive), non-transferable licence to use the Service for the needs of its business activity to the extent set out in the Agreement.

5.3. The data entered by the Customer into the Service remains the property of the Customer (or of the relevant data subjects and controllers). The Company acquires the right to process it solely to provide the Service in accordance with the Agreement.

5.4. If the Customer provides suggestions or feedback about the Service, the Company is entitled to use them without compensation to improve the Service.

6. Fees and payment

6.1. After the organization account has been created, the Service is available free of charge for the Trial Period set out in Annex A, during which this Section does not apply. After the end of the Trial Period, use of the Service is subject to a fee in accordance with this Section; if the Customer does not activate a paid plan, clause A.3 of Annex A applies.

6.2. The fee for the Service is determined in accordance with the price list shown in the Service or in an offer. Prices are stated exclusive of value added tax, which is applied at the rate set by laws and regulations.

6.3. Payments are made through the payment service provider Stripe (payment card or SEPA direct debit) or, if separately agreed, by bank transfer against an invoice. Payment card data is not available to the Company.

6.4. If payment is not received by the due date, the Company sends a reminder and grants an additional period of 14 days. After the additional period ends, the Company is entitled to restrict access to the Service until payment is received; the data is not deleted during this time, and Section 12 applies to it.

6.5. Customers are informed of changes to the price list at least 30 days in advance; changes take effect from the next billing period. If the Customer does not agree to the changes, it is entitled to terminate the Agreement by the day they take effect.

7. Availability of the Service

7.1. The Company uses reasonable efforts to maintain continuous availability of the Service but does not guarantee a specific level of availability unless otherwise agreed in writing.

7.2. Customers are informed in advance, where possible, of planned maintenance that may materially affect availability. Maintenance is planned outside normal working hours where possible.

8. Data protection

8.1. The processing of personal data in the Service is described in the Company's privacy policy, available on the website balvantis.com.

8.2. With regard to data that the Company processes on behalf of the Customer as controller, the Parties are bound by a data processing agreement (Article 28 of the GDPR), which is Annex B to these Terms and is accepted together with the Terms.

8.3. The Customer ensures that there is a legal basis for its entry and processing of personal data in the Service and that data subjects are informed in accordance with laws and regulations.

9. Confidentiality

9.1. The Parties undertake not to disclose to third parties the other Party's confidential information that has become known in the course of performing the Agreement, except in cases provided for by laws and regulations. The obligation remains in force for 3 years after termination of the Agreement.

9.2. Information that is publicly available or has become known independently of the other Party is not considered confidential.

10. Limitation of liability

10.1. The Company is not liable for: (a) indirect losses, including lost profit and business interruption; (b) loss of data caused by the Customer's actions; (c) losses, tax or duty payments, fines, late payment charges and other consequences arising from the Customer using, submitting or acting on the Results referred to in clause 2.5 without checking them or contrary to the outcome of the check, regardless of whether the cause of the inconsistency is the data entered by the Customer, the settings chosen by the Customer or an error in the operation of the Service.

10.2. The Company's total liability for all claims arising out of or in connection with the Agreement does not exceed the amount actually paid by the Customer for the Service during the 12 months preceding the event giving rise to the claim.

10.3. The limitations in this Section do not apply to liability for wilful misconduct or gross negligence, or to other liability that cannot be excluded or limited under the laws and regulations of the Republic of Latvia.

10.4. This Section does not limit the rights of data subjects or the Parties' liability under Article 82 of the GDPR; the allocation of liability between the Parties in the event of data processing breaches is governed by the data processing agreement.

11. Suspension and termination

11.1. The Customer is entitled to terminate the Agreement at any time by notifying the Company or by using the functionality available in the Service. Prepayment for a billing period that has begun is not refunded unless otherwise agreed.

11.2. The Company is entitled to suspend the access of the Customer or of an individual User to the Service if: (a) there has been a material breach of the Terms, in particular of Section 4; (b) this is necessary for the security of the Service or of other customers; (c) the payment delay referred to in clause 6.4 has occurred. The Customer is informed of the suspension and its reason and, if the breach can be remedied, is given a reasonable period to remedy it.

11.3. The Company is entitled to terminate the Agreement if the Customer does not remedy a material breach within the given period or if access has been restricted under clause 6.4 for longer than 60 days.

11.4. The Company is entitled to terminate the Agreement by discontinuing the Service as a whole, giving at least 90 days' notice and providing the data export set out in Section 12.

12. Data after termination of the Agreement

12.1. After termination of the Agreement, the Customer has 30 days to obtain the data it entered into the Service in the form of an export. After this period, the data is deleted from active systems; data in backup copies is deleted in the course of the backup rotation cycle.

12.2. Retention obligations set by laws and regulations (for example, for accounting documents) are not affected by this clause.

13. Amendments to the Terms

13.1. The Company is entitled to amend the Terms. Customers are informed of material amendments by e-mail or in the Service at least 30 days before they take effect.

13.2. If the Customer does not agree to the amendments, it is entitled to terminate the Agreement by the day the amendments take effect; continued use of the Service after that day confirms consent to the amendments.

14. Governing law and dispute resolution

14.1. The Agreement is governed by the laws and regulations of the Republic of Latvia.

14.2. The Parties resolve disputes by negotiation. If no agreement is reached within 30 days, the dispute is settled by a court of the Republic of Latvia according to the Company's registered address.

15. Final provisions

15.1. If any provision of the Terms is found to be invalid, this does not affect the validity of the remaining provisions.

15.2. The Customer is not entitled to transfer the rights and obligations arising from the Agreement to a third party without the Company's consent, except for a transfer in the course of the Customer's reorganization to its successor in rights and obligations, of which the Company is informed.

15.3. Notices to the Customer are given to the e-mail address stated in the organization's contact details or in the Service. Notices to the Company are sent to [email protected].

Annex A. Trial period terms

A.1. This annex applies to every Customer during the time the Service is provided to it free of charge – from the creation of the organization account until the end of the period set out in clause A.3 or the activation of a paid plan, whichever occurs first (the Trial Period). In the event of a conflict during the Trial Period, the provisions of this annex prevail over the main body of the Terms.

A.2. During the Trial Period, the Service is provided free of charge and "as is" and "as available" – without any service level (SLA) or functionality guarantees. No payment information is required to start the Trial Period, and no fee is charged automatically at the end of the Trial Period.

A.3. The Trial Period is one month (30 days) from the creation of the organization account. When it ends, the Customer, at its choice:

• moves to a paid plan in accordance with the price list in force at that time, or
• terminates the Agreement; in that case, Section 12 of the Terms applies (30-day data export period, followed by deletion).

Until the choice is made, the Customer's data in the Service is available in read-only mode – new data cannot be entered and existing data cannot be changed. If a paid plan has not been activated within 60 days after the end of the Trial Period, the Company is entitled to terminate the Agreement, applying Section 12 of the Terms. The end date of the Trial Period is visible to the Customer in the Service from the time the account is created. The Parties may extend the Trial Period by agreement.

A.4. During the Trial Period, the Company is entitled to change, restrict or discontinue individual features of the Service, giving the Customer advance notice of material changes. The 30-day period referred to in clause 2.4 of the Terms does not apply during the Trial Period.

A.5. During the Trial Period, the Customer provides feedback on the Service to a reasonable extent: it answers the Company's questions about the use of the Service and reports any errors noticed in accordance with clause 2.6.

A.6. Given that the Service is provided without remuneration during the Trial Period, the Company's total liability for claims arising from events during the Trial Period is EUR 0, except for liability for wilful misconduct or gross negligence and other liability that cannot be excluded or limited under the laws and regulations of the Republic of Latvia. Clause 10.4 of the Terms remains in force during the Trial Period as well.

A.7. The Trial Period does not reduce data protection requirements: personal data is processed during the Trial Period in full GDPR mode in accordance with the privacy policy and the data processing agreement.

Annex B. Data processing agreement

Effective from: 2026-09-02. Version 1.0.

1. General provisions

1.1. This data processing agreement (the DPA) is Annex B to the Balvantis terms of use (the Terms) and an integral part of the Agreement. The DPA is accepted together with the Terms; a separate signature is not required.

1.2. The parties to the DPA are SIA "GisIT", unified registration No. 40203674620, registered address: Zāļu iela 5, Baloži, Ķekava Municipality, LV-2112, Latvia (in the Terms and hereinafter, the Company), and the Customer within the meaning of clause 1.2 of the Terms.

1.3. With regard to personal data that the Customer enters into the Service or that is created in the Service within the Customer's organization, the Customer is the controller and the Company is the processor within the meaning of the GDPR. Processing for which the Company itself is the controller (user accounts, billing, security logs) is described in the Company's privacy policy; this DPA does not apply to it.

1.4. The terms "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in Article 4 of the GDPR. In the event of a conflict between the DPA and the Terms on matters of personal data processing, the DPA prevails.

1.5. Communication under the DPA takes place in writing: to the Company – at [email protected]; to the Customer – at the e-mail address stated in the organization's contact details.

2. Subject matter, duration, nature and purpose of processing

2.1. Subject matter: processing of personal data in the course of the Company providing the Service to the Customer in accordance with the Terms.

2.2. Duration: the term of the Agreement and the termination period set out in Section 12.

2.3. Nature: collection of data from the Customer and its Users, storage, structuring, display, performing calculations, automated document reading on the User's initiative (see Appendix 1 – Google), backup, deletion – within the functionality of the Service as hosted software.

2.4. Purpose: operation of the Customer's personnel management, working time recording, payroll calculations, document storage, processing of business documents and the related Service features. The Company does not use the data for other purposes (see clause 6.8).

3. Categories of data subjects and personal data

3.1. Categories of data subjects: the Customer's employees and other natural persons engaged by the Customer for whom the Customer creates profiles or to whom it grants access; contact persons of the Customer's business partners.

3.2. Categories of personal data:

• employees' basic data – first name, surname, personal identity number, contact details, bank account number (IBAN), position, files of employment contracts and other personnel documents;
• remuneration data – rates, calculations, payments, balances;
• absence data, including health data within the meaning of Article 9 of the GDPR – the fact, type and period of incapacity for work; diagnoses are not entered into the system (see clause 5.4);
• working time and location data – shift check-in and check-out times and location data to the limited extent set out in Section 4;
• business documents – expense supporting documents, waybills, bank account statements and transactions, contact details of business partners.

3.3. The basis for processing the personal identity number is the Customer's legal obligation as employer (Article 6(1)(c) of the GDPR in conjunction with Section 40(2)(1) of the Labour Law and with accounting and tax laws and regulations); the Company applies the encryption and access restrictions set out in Appendix 2 to the personal identity number.

3.4. Enhanced technical and organizational measures apply to health data: the type of absence is visible only to the employee concerned and to Users to whom the Customer has granted access rights to personnel data; for everyone else, the absence is not visible in schedules.

4. Special provisions for location (GPS) data

4.1. The location data feature is activated by the Customer. Data is recorded only in the period from the recording of the start of the shift (check-in) to the recording of the end of the shift (check-out); outside this period, location data is neither collected nor accepted – the Service's server rejects it.

4.2. Location data is automatically and irreversibly deleted after 90 days.

4.3. The purpose of processing is the recording of working time and site visits and the planning of work at geographically dispersed sites. The data is not used to evaluate employees' behaviour or for profiling, and the Company undertakes not to use it for such purposes even at the Customer's request – such a request is considered an instruction that infringes the GDPR (clause 6.2).

4.4. The Customer as controller is responsible for choosing the legal basis for processing (including carrying out and documenting a balancing test where the basis is legitimate interests) and for informing employees before activating the feature. The Company provides a template information notice (Appendix 3); the Customer is responsible for adapting and using it.

5. Obligations and representations of the Customer (controller)

5.1. The Customer ensures that there is a legal basis for the processing carried out on its behalf and that data subjects are informed in accordance with laws and regulations.

5.2. The Customer's documented instructions within the meaning of Article 28(3)(a) of the GDPR are: (a) the configuration and use of the Service's features within the Customer's organization and (b) written instructions sent to the address given in clause 1.5. Instructions whose execution goes beyond the functionality of the Service are executed only under a separate agreement between the Parties.

5.3. With regard to health data, the Customer confirms that its basis for processing is Article 9(2)(b) of the GDPR in conjunction with employment and social insurance laws and regulations (including Section 36 of the Latvian law "On Maternity and Sickness Insurance").

5.4. The Customer undertakes not to enter into the Service's free-text fields diagnoses or other health data exceeding the scope set out in clause 3.2 (fact, type and period of incapacity for work).

5.5. The Customer is responsible for managing its Users' access rights, including granting access rights to personnel data only to the persons who need them.

6. Obligations of the Company (processor)

6.1. The Company processes personal data only on the Customer's documented instructions (clause 5.2), including with regard to transfers of data to a third country, unless required to do so by Union or Member State law to which the Company is subject; in such a case, the Company informs the Customer of that legal requirement before processing, unless that law prohibits such information.

6.2. If, in the Company's opinion, an instruction infringes the GDPR or other data protection laws and regulations, the Company informs the Customer without delay and is entitled to suspend the execution of the instruction until the matter is clarified.

6.3. The Company ensures that persons authorized to process personal data have committed themselves to confidentiality.

6.4. The Company implements the technical and organizational measures described in Appendix 2 (Article 32 of the GDPR) and maintains them in line with the risk; the measures may be improved provided that the overall level of protection is not reduced.

6.5. Taking into account the nature of the processing, the Company assists the Customer by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the obligation to respond to data subject requests (Chapter III of the GDPR): a data subject request received by the Company is forwarded to the Customer without undue delay and is not answered by the Company itself unless the Customer has instructed otherwise; at the Customer's request, the Company prepares a data extract or carries out deletion, recording this in the audit log.

6.6. The Company assists the Customer in ensuring compliance with the obligations under Articles 32 to 36 of the GDPR, taking into account the nature of processing and the information available to the Company (security, breach notification, data protection impact assessment).

6.7. At the Customer's choice, the Company deletes or returns personal data in accordance with the procedure set out in Section 12.

6.8. The Company does not use personal data processed on behalf of the Customer for its own purposes, including analytics concerning data subjects, profiling or product development beyond the Service provided to the Customer.

6.9. The Company makes available to the Customer the information necessary to demonstrate compliance with the obligations laid down in Article 28 and allows for the audits set out in Section 9.

6.10. The Company informs the Customer if and when a data protection officer is designated (Article 37(7) of the GDPR). At the time the DPA takes effect, no officer has been designated, as the scope of activities does not require one; this assessment is reviewed periodically.

7. Sub-processors

7.1. The Customer gives a general written authorization (Article 28(2) of the GDPR) to engage sub-processors. The current list is set out in Appendix 1.

7.2. The Company notifies the Customer by e-mail of intended changes to the list (addition or replacement) at least 14 days before the changes take effect. If the Customer raises justified objections within this period and the Parties do not find a solution (for example, switching off the relevant feature for the Customer's organization), the Customer is entitled to terminate the Agreement in accordance with the Terms before the changes take effect.

7.3. The Company imposes on each sub-processor, by contract, the same data protection obligations as set out in this DPA, in particular the obligation to provide sufficient guarantees of appropriate technical and organizational measures. Where a sub-processor fails to fulfil its obligations, the Company remains fully liable to the Customer for the performance of the sub-processor's obligations (Article 28(4) of the GDPR).

8. Personal data breach notification

8.1. The Company notifies the Customer of a personal data breach affecting data processed on behalf of the Customer without undue delay after becoming aware of it, aiming to do so no later than within 48 hours.

8.2. The notification includes, to the extent the information is available: the nature of the breach, the categories and approximate number of data subjects and data concerned, the likely consequences, the measures taken and planned, and a contact point for further information. The information may be provided in phases if it is not available at the same time.

8.3. Notifying the supervisory authority and data subjects is the Customer's obligation as controller; the Company does not do so on the Customer's behalf unless the Parties agree otherwise, but provides the Customer with the assistance needed. The Company documents breaches, their circumstances and the measures taken.

9. Audits

9.1. The Customer, or an auditor mandated by it who is not a competitor of the Company and has committed to confidentiality, is entitled to carry out an audit, including an inspection, of compliance with the obligations set out in this DPA.

9.2. An audit may be carried out no more than once every 12 months, with at least 30 days' notice, during the Company's normal working hours and without disproportionately disrupting the Company's operations; each Party bears its own costs. These restrictions do not apply to an audit following a material personal data breach or at the request of a supervisory authority – in that case the audit is carried out within a reasonable period.

9.3. The scope of the audit does not include other customers' data or the Company's trade secrets, insofar as they are not necessary to verify compliance with the DPA; the Company primarily demonstrates compliance through documentation and the information referred to in clause 6.9.

10. Transfers outside the EEA

10.1. Personal data is stored and processed in the European Union / European Economic Area. Data is transferred outside the EEA only to the sub-processors listed in Appendix 1, on the basis of the safeguards of Chapter V of the GDPR – certification under the EU–U.S. Data Privacy Framework (DPF) and/or the European Commission's standard contractual clauses (SCC).

10.2. A new transfer outside the EEA is introduced only in accordance with the procedure in Section 7, ensuring the safeguards of Chapter V.

11. Liability

11.1. The Parties' liability towards data subjects is governed by Article 82 of the GDPR; this DPA and the Terms neither limit nor exclude it.

11.2. A Party that has, in accordance with Article 82(4) of the GDPR, paid full compensation for the damage suffered by a data subject is entitled to claim back from the other Party that part of the compensation corresponding to its part of responsibility for the damage (Article 82(5) of the GDPR).

11.3. Section 10 of the Terms (including the exceptions in clause 10.3 concerning wilful misconduct and gross negligence) applies to the Parties' claims against each other arising from this DPA.

12. End of processing

12.1. After termination of the Agreement, data export is available to the Customer for 30 days in accordance with Section 12 of the Terms. After this period, the Company deletes the personal data from active systems; data in backup copies is deleted in the course of the backup rotation cycle as the copies expire (Appendix 2, Section 5) and, until deletion, is not used in active processing.

12.2. At the Customer's written request, the Company confirms that deletion has been carried out.

12.3. Retention obligations set by laws and regulations that apply to the Company are not affected by this Section; for such retention, the Company becomes the controller to the extent of fulfilling the legal obligation.

13. Final provisions

13.1. The DPA takes effect upon acceptance of the Terms and remains in force for the term of the Agreement and thereafter to the extent necessary to fulfil Section 12.

13.2. The procedure in Section 13 of the Terms applies to amendments to the DPA. Amendments that extend data protection guarantees or update the list in Appendix 1 in accordance with Section 7 are not considered material amendments within the meaning of clause 13.1 of the Terms.

DPA Appendix 1. List of sub-processors

Version 1.0, 2026-09-02.

Notes:

1. The payment service provider Stripe is not included in this list because the Company is the controller of the billing data processed by Stripe (see the privacy policy) – it is not data that the Company processes on behalf of the Customer.

2. No e-mail sending service is currently used; before one is introduced, the list will be updated in accordance with Section 7 of the DPA (notification and a 14-day objection window).

DPA Appendix 2. Technical and organizational measures (TOMs)

Version 1.0, 2026-09-02. The Company maintains and improves the measures without reducing the overall level of protection.

1. Encryption and data transmission

• Sensitive fields – the personal identity number and the bank account number (IBAN) – are encrypted at rest at application level; the encryption key is stored separately from the database.
• All data transmission between the user and the Service, and between components of the Service over public networks, takes place only over an encrypted (HTTPS/TLS) connection.
• Uploaded files are stored in private storage in an EU region without public access; files can be accessed only through an authorized interface of the Service.

2. Access control

• Access to data is granted according to a model of roles and rights within the Customer's organization; the data of customer organizations is segregated from each other.
• Sensitive fields are masked in the interface by default and are revealed only by a deliberate user action ("Show").
• Absence information (including health data) is visible only to the employee concerned and to Users with access rights to personnel data; it is not visible in shared schedules.
• Authentication takes place with individual accounts; the session token is stored in an httpOnly cookie (SameSite=Lax) with a limited (8 h) lifetime.

3. Location data restrictions

• Location data is accepted only during an active shift – the restriction is enforced on the server side, not only in the app.
• Automatic and irreversible deletion after 90 days by a regular automated procedure.

4. Logging and traceability

• Significant actions on data are recorded in the audit log (user, time, IP address, changes made); authentication secrets are not recorded in logs in clear form.
• The log retention period is limited in accordance with the privacy policy.

5. Backup and recovery

• Database backup copies are made regularly with automated integrity checks and a limited retention period; expired copies are deleted automatically.
• Encrypted fields (Section 1) remain encrypted in backup copies as well; encrypted storage with restricted access is used to store copies outside the server.

6. Organizational measures

• Access to the production environment is limited to a restricted group of persons; persons who process data have committed themselves to confidentiality.
• Development and test environments are separated from production; production personal data is not used in development and testing.
• An internal procedure with a breach register is in place for handling personal data breaches; a procedure is in place for handling data subject requests.

DPA Appendix 3. Template employee information notice (location data)

This is a template that the Customer as controller adapts and gives to its employees before activating the location data feature. The template is not legal advice; the Customer is responsible for the content of the information and the legal basis for processing. Square brackets mark the places to be filled in by the Customer.

Information on the processing of location data in working time recording

1. Controller: [CUSTOMER NAME, REG. NO., ADDRESS, CONTACT DETAILS].

2. For recording working time and site visits we use the Balvantis platform, in which the location is also recorded when the start (check-in) and end (check-out) of a shift are recorded. Location data is recorded only in the period from the start of the shift to the end of the shift; outside working time, the location is neither recorded nor transmitted.

3. The purpose of processing is accurate recording of time worked and site visits (Section 137 of the Labour Law) and planning of work at dispersed sites. The data is not used to evaluate your behaviour or for profiling.

4. The legal basis for processing is [the employer's legitimate interests (Article 6(1)(f) of the GDPR) – a balancing test has been carried out and is available from [CONTACT PERSON]] in conjunction with the legal obligation to record working time (Article 6(1)(c) of the GDPR, Section 137 of the Labour Law).

5. Location data is automatically deleted after 90 days.

6. The processor acting on our behalf is SIA "GisIT" (the operator of the Balvantis platform); the full list of parties involved in the processing is available in the Balvantis privacy policy (balvantis.com).

7. You have the right to request access to your data, its rectification or erasure, to object to processing based on legitimate interests (Article 21 of the GDPR), and to lodge a complaint with the Data State Inspectorate (www.dvi.gov.lv). For questions: [CONTACT PERSON, E-MAIL].