Privacy Policy
This policy explains what personal data ZenomyTech SIA collects through zenomy.tech and in the course of client work, why, and what rights you have under the EU General Data Protection Regulation (GDPR).
Who we are
The controller of your personal data is ZenomyTech SIA, a company registered in the Republic of Latvia, registration no. 40203586239, VAT ID LV40203586239.
For any privacy question or request, write to [email protected].
What we process and why
Inquiries and contact forms
When you contact us by email or through a form on our site, we process your name, email, phone number (if given), organisation, and whatever you tell us about your request, such as website addresses and the technology they run on.
Purpose: to answer you and prepare an offer. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in replying to business inquiries (Art. 6(1)(f)).
Booking a call
If you book a consultation through our Google Calendar booking page, Google processes the name, email and any notes you enter, and we receive them to hold the meeting. Legal basis: Art. 6(1)(b).
Client engagements
When we work for you, we process the contact details of your representatives, contract and project correspondence, and technical information about your systems needed to do the work. Legal basis: performance of a contract (Art. 6(1)(b)).
Where the work requires access to your systems, we may come across personal data that you hold, for example your website's users or customers. For that data you remain the controller and we act as your processor (Art. 28 GDPR): we process it only on your documented instructions and only to the extent needed for the agreed work. We sign a data processing agreement on request.
Security checks
We never test a system without the written permission of a person authorised to represent its owner. Checks we run before an engagement never attempt to exploit a vulnerability: they do not modify data or disrupt the service.
Invoicing and accounting
We keep invoices, payment records and the related contact details because Latvian accounting and tax law requires it. Legal basis: legal obligation (Art. 6(1)(c)).
Website operation and analytics
Our hosting and network provider processes technical data such as IP addresses in server logs to deliver the site and protect it from abuse. Legal basis: legitimate interest in a secure, working website (Art. 6(1)(f)).
We measure visits with a self-hosted instance of Plausible Analytics. It does not use cookies, does not track you across sites and stores no personal data; we only see aggregate figures such as page views and referrers.
Confidentiality of client information
Information we receive about your systems, the vulnerabilities we find and any access credentials you hand over are used only to carry out the agreed checks and fixes. In particular:
- We do not disclose this information to third parties or use it for any other purpose.
- We do not publish vulnerabilities we find, neither under your name nor anonymously, without your written consent.
- Please do not send passwords through web forms or plain email. If access is needed, we agree on a secure handover channel with you.
- Access credentials are stored encrypted and deleted when the work is finished. We recommend that you change them afterwards.
Who else receives the data
We do not sell personal data. We share it only with service providers that help us run the business, and only to the extent they need:
- Cloudflare, Inc.: website hosting, network security and email routing.
- Google: email inbox and calendar bookings.
- Tally BV (Belgium): web forms.
- Mollie B.V. (Netherlands) and our bank: payments, when you pay by card or bank transfer.
- Our accountant, if we use one, and public authorities such as the State Revenue Service, where the law requires it.
Some of these providers are based in, or may process data in, the United States. In those cases transfers rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
How long we keep it
- Inquiries that do not lead to a contract: up to 12 months after our last contact.
- Contract and project records: for the duration of the engagement and afterwards for as long as legal claims may arise.
- Accounting documents: for the period required by Latvian accounting law.
- Access credentials: deleted when the work is finished.
Your rights
You have the right to access your personal data, have it corrected or erased, restrict or object to its processing, and receive it in a portable format. Where processing is based on your consent, you can withdraw it at any time without affecting earlier processing.
To exercise any of these rights, write to [email protected]. We reply within one month.
If you believe we process your data unlawfully, you can lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija), dvi.gov.lv, or the supervisory authority in your own EU country.
Cookies
zenomy.tech itself does not set cookies. Embedded third-party services, such as Tally forms, may store technically necessary data in your browser under their own privacy policies.
Changes
We may update this policy when our services or the law change. The date at the top shows the latest version.