Privacy policy

This Privacy Policy explains how SIA "m2cena" collects, uses, stores and protects your personal data when you use the m²cena platform. We have written it in plain language — you have the right to know what happens to your data without wading through legal jargon.

1. Who we are and how to reach us

The data controller is:

Company: SIA "m2cena"
Registration No.: 40203754061
Registered address: Rīga, Viestura prospekts 12 - 21, LV-1034
E-mail: info@m2cena.lv
Phone: +371 28632825, +371 29151476
Website: m2cena.lv

This policy applies to everyone who visits m2cena.lv or uses the services offered there (referred to below as the “Data subject” or “you”).

Personal data is any information about an identified or identifiable natural person. Processing is any operation with that data — collection, recording, use, viewing, storage or erasure.

Data minimisation. We collect and keep only the data genuinely needed to provide the service, perform our contractual obligations or pursue our legitimate interests. If we do not need it, we do not ask for it.

2. How we obtain data

We obtain personal data:

when you enter it on the website — registering, requesting an analysis or filling in the contact form;
when you write to us at info@m2cena.lv or call us;
automatically, when your browser communicates with our server (IP address, technical logs);
from Google, if you register or sign in with a Google account — we then receive your e-mail address and account identifier.

We do not collect personal data on paper.

You are responsible for making sure the data you provide is correct and up to date. If it changes, please update it in your account or let us know. We are not liable for damage caused by inaccurate data provided to us.

3. What data we process

Account data: e-mail address and a cryptographic derivation of your password. We never see or store the password itself. If you sign in with Google — your Google account identifier.
Service data: the address or listing link of the property you ask us to analyse, your analysis history, your saved search filters (name, location, price and area ranges) and your analysis credit balance.
Payment data: transaction amount, currency, status, date, reference number, the payment platform's transaction identifier and the subscription renewal token. We never see or store payment card details — they are processed by a licensed payment institution (see section 7).
Communication data: if you write via the contact form — name, e-mail address, subject, message text, language and IP address.
Technical data: IP address, browser and device information, request logs and cookies (see section 8).
Site usage data: which pages were opened and when, a shortened IP address, the browser description and — if you are signed in — your account. Recorded only with your consent (the Analytics switch in the cookie banner), on our server, without cookies and without any script in your browser, and used only to see how many people use the site and which pages they use.

If you decline to provide account and payment data, we cannot create an account, accept a payment or prepare an analysis — that data is necessary to enter into and perform the contract.

We do not process special categories of data (health, religion, political opinions and the like), personal identity numbers, dates of birth or delivery addresses — our service does not need them.

4. Purposes and legal basis of processing

Performance of a contract (GDPR Article 6(1)(b)): creating and running your account, preparing analyses, managing subscriptions, notifications about your saved filters and transactional e-mails (registration confirmation, payment confirmation, password reset).
Compliance with a legal obligation (GDPR Article 6(1)(c)): accounting and tax record-keeping requirements.
Legitimate interests (GDPR Article 6(1)(f)): IT infrastructure security, prevention of fraud and abuse, answering your questions and establishing or defending legal claims.
Consent (GDPR Article 6(1)(a)): measuring how the site is used (section 3) starts only once you switch Analytics on in the cookie banner, and stops when you switch it off. Marketing e-mails, should we ever send them, will be sent only with your explicit prior consent. Any consent may be withdrawn at any time; withdrawing it does not affect the lawfulness of processing carried out beforehand.

We are entitled to verify the accuracy of the data provided against publicly available registers.

5. Automated processing and the informative nature of analyses

Our platform uses automated statistical models and public register data to provide real-estate market context. To analyse listing text and photographs we use automated language models — they receive only the content of the public listing, not your personal data.

This automated processing concerns the property, not you: it produces no legal effects for you and is not used to make automated decisions about you within the meaning of GDPR Article 22.

The analyses we produce are informative and serve as an aid to a private buyer's decision. They are not the opinion of a certified valuer and cannot be relied on as a legally binding document at financial institutions or in official transactions. You have the right to express your point of view, contest a result produced by the algorithm or ask for an explanation by writing to info@m2cena.lv.

6. How long we keep data

We keep personal data for as long as at least one of the following applies:

the data is needed for the purpose it was obtained for;
there is a legal obligation to keep it;
we or you can still pursue legitimate interests — for example, bring or defend a claim;
your consent is still in force, where processing is based on it.

Specific periods:

Accounting and tax documents: 5 years after the end of the relevant year, under the Latvian Accounting Law.
Contractual and claim-related data: until the civil limitation period expires — no longer than 10 years.
User account and analysis history: for as long as the account is active. After the account is deleted, the data is irreversibly erased or anonymised, keeping only what accounting and tax legislation requires.
Communication data: until your query is resolved, plus a reasonable period afterwards if needed in case of claims.
Technical logs: no longer than necessary for security and operational monitoring.
Site usage data: 12 months, after which it is deleted automatically.

Once these circumstances end, the personal data concerned is irreversibly erased or anonymised.

7. Data recipients

To meet our obligations to you, we may pass your personal data to processors who process it on our behalf and strictly on our instructions. Data processing agreements are in place with all of them.

Maksājumu apstrādi nodrošina maksājumu platforma https://makecommerce.lv/, tāpēc mūsu uzņēmums maksājumu izpildei nepieciešamos personas datus nodod platformas īpašniekam Maksekeskus AS.

(In English: payment processing is provided by the payment platform https://makecommerce.lv/, therefore our company passes the personal data necessary to execute the payment to the platform's owner, Maksekeskus AS.) Maksekeskus AS is a licensed payment institution registered in Estonia. You enter your card details directly on the platform — they never reach us.

Other categories of recipients:

IT infrastructure and cloud providers — for maintaining servers and databases.
E-mail delivery provider — for delivering transactional e-mails.
Accounting service provider — for accounting and tax obligations.

Upon a justified request, we may pass data to state and law-enforcement authorities, and we may use it to establish, exercise or defend legal claims.

We do not sell your data and we do not pass it to advertising networks. Your personal data is processed within the European Union and the European Economic Area — we do not transfer it to third countries. Should that ever become necessary, we would do so only on the basis of a European Commission adequacy decision or standard contractual clauses, and we would update this policy beforehand.

8. Cookies

The website uses cookies and similar technologies. Exactly which ones, why and for how long is explained in the Cookie Policy.

9. Data security

We implement organisational and technical measures to protect personal data against accidental or unlawful destruction, alteration, disclosure and any other unlawful processing. Data is transmitted encrypted, passwords are stored only in cryptographically derived form, and access is limited to the staff and partners who need it to do their work. We review our security procedures regularly; nevertheless, no method of transmitting data over the internet can guarantee absolute security.

10. Your rights

Under the GDPR and the laws of the Republic of Latvia you have the right to:

access your personal data and receive information about its processing, as well as receive a copy in electronic format;
rectify incorrect, inaccurate or incomplete data;
erase your data (“to be forgotten”), except where the law requires us to keep it;
port your data to another controller in a structured, machine-readable format;
restrict processing or object to processing based on our legitimate interests;
withdraw consent given earlier;
lodge a complaint with the State Data Inspectorate.

You can submit a request by writing to info@m2cena.lv or by sending it to our registered address, Rīga, Viestura prospekts 12 - 21, LV-1034. We respond within one month of receiving the request and confirming your identity.

If you believe your rights have been infringed, please contact us first — most matters can be settled straight away. You also have the right to lodge a complaint with the supervisory authority:

Datu valsts inspekcija (State Data Inspectorate), Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv

11. Final provisions

This Privacy Policy has been drawn up in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation) and the applicable laws of the Republic of Latvia and the European Union.

We are entitled to make changes to this policy. The current version is always available on this page at m2cena.lv, and changes take effect when they are published. We will notify you separately about material changes.

This policy is provided in Latvian, English and Russian.

In case of any conflict, the Latvian version of these terms shall prevail.