GDPR

Controller. For the personal data of people who visit our website, contact us or work with us, SIA Project Nidos decides how it is used. Our Privacy Policy covers that processing in full.

Processor. When we implement or support a system for a client — a CRM, a helpdesk, an integration, an AI solution, an online shop — we handle personal data the client is responsible for: their customers, leads and staff. The client is the controller, and we act only on the client's instructions.

Every service agreement that involves personal data includes a data processing agreement under Article 28 GDPR. Under it we:

• process the data only on your documented instructions, and only for the project;
• bind everyone on our team who handles it to confidentiality;
• keep it secure with the measures in section 04 and any agreed for the project;
• engage another processor only with your prior written authorisation, and on the same terms;
• help you respond to requests from data subjects and meet your own obligations, including impact assessments where needed;
• delete or return the data when the work ends, as you choose, unless the law requires us to keep it;
• give you the information you need to check that we comply, and allow for audits.

Your data stays in the systems you run and license — your CRM, helpdesk, shop or accounting software — and we work in them with the access you give us.

Where a project needs data to pass through anything else — a migration file, an integration service, or an AI model provider for an AI solution — the data processing agreement names that service, where it processes data and when anything it holds is deleted, before any personal data reaches it.

The website, the contact form and our CRM are protected by:

• HTTPS on every page, enforced with HSTS;
• staff passwords stored only as bcrypt hashes;
• staff sessions in HttpOnly, Secure, SameSite=Strict cookies that expire after 8 hours;
• role-based access to the CRM, with an audit log of changes;
• rate limits on sign-in, the contact form and our API;
• a strict Content Security Policy, and no third-party scripts on the website;
• access limited to the staff who need it.

For our own operations we use:

The sub-processors for a client project are listed in that project's data processing agreement, and we ask before adding one.

Our own infrastructure is in the United States (section 05). Those transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

For client projects we prefer tools and hosting regions inside the EU and EEA. Any transfer outside them is agreed in the data processing agreement, with its safeguard, before it happens.

As a processor, we tell the client without undue delay once we become aware of a breach affecting their data (Article 33(2) GDPR), with what we know at the time, so they can meet their own 72-hour deadline.

For data we control, we notify the Data State Inspectorate within 72 hours where the law requires it (Article 33(1)), and the people affected when the risk to them is high (Article 34).

We have not appointed a Data Protection Officer, as Article 37 GDPR does not require one for the processing we do. Data protection questions go to support@projectnidos.eu, or by post to SIA Project Nidos, Paula Lejiņa iela 4 - 42, Riga, LV-1029, Latvia.

Our supervisory authority: