Privacy policy

We collect personal data in one place: the enquiry form on this site. Below is what we collect, why, how long we keep it and what you can do about it. There is no advertising pixel, no mailing list and no account on this site. Detailed statistics through Google Analytics are switched on only with your consent; a plain visit counter runs for everyone, but it stores nothing in your browser and identifies no one.

Who processes the data

The controller, in GDPR terms, is Wasp Systems SIA, registration number 40203763878, registered at Anniņmuižas bulvāris 43 – 7A, Rīga, LV-1067.

For anything to do with your data, write to hello@waspsystems.eu. We have no data protection officer: article 37 does not require one of us — the processing is neither systematic nor large-scale — so requests go to the same address.

What we receive

Only what you type in, and the minimum technical trace of sending it.

• Your name — so we know what to call you.
• Your email — so we can answer.
• What you wrote — the text of your enquiry.
• Company and phone — optional. The form sends without them.
• The technical trace — IP address, browser and the time, which is how we tell people from spam bots.

We do not ask for and do not want the special categories in article 9 — health, beliefs, origin. Please do not put them in the free-text field; it is not for that.

Why, and on what basis

The bases are from article 6:

• To answer your enquiry and talk about the work. Your consent, article 6(1)(a) — the box you tick before sending; and once the conversation reaches terms, steps taken before a contract, article 6(1)(b).
• To protect the form from spam and abuse. Our legitimate interest, article 6(1)(f): the site has to keep working.
• Accounting and tax — only if we end up working together. That is a legal obligation, article 6(1)(c).

We do not use any of this for mailing lists and we do not pass it on for advertising. If we ever want to write to you about anything other than your own enquiry, we will ask separately first.

How long we keep it

Three periods, because there are three purposes. We choose the first; the law chose the other two.

• An enquiry that did not become a project — 12 months from the last message, then it is deleted.
• Correspondence and the contract for a project — three years after it ends, which is the limitation period for claims arising from commercial transactions.
• Accounting records — five years, as the accounting act requires. We have no choice there.

You can ask us to delete things sooner at any time — see section 6. We will delete everything except what the law obliges us to keep: article 17(3)(b) sets that case out expressly, and promising otherwise would not be true.

Who else sees it

We do not sell data and we do not pass it to anyone for their own purposes. It is reachable by the suppliers without whom the site and the mail do not run — processors, in GDPR terms, each bound by a contract under article 28:

• Hetzner Online GmbH (Germany) — site hosting and database
• Google Ireland Limited (Ireland) — Google Workspace business email and Google Analytics visitor statistics

The site and its database are in the European Economic Area. Mail is with Google’s Irish entity, but Google may handle messages on servers in the United States; that transfer runs under Chapter V, on the European Commission’s adequacy decision (the EU–US Data Privacy Framework) and standard contractual clauses.

Separately: data may be disclosed on a lawful demand from a public authority. That is not our decision and not our choice, but it would be dishonest not to say so.

Your rights

Under articles 15 to 22 you can:

• find out what data of yours we hold, and get a copy of it;
• have anything inaccurate corrected;
• ask for it to be deleted — within the limits set out in section 4;
• restrict the processing, or object to it;
• receive your data in a machine-readable form and take it elsewhere;
• withdraw your consent at any time — under article 7(3) that does not make what was processed before the withdrawal unlawful.

An email to hello@waspsystems.eu is enough. We answer within a month, which is the period in article 12(3); if a request is complicated the period can be extended, and we will say so and say why. We do not charge for any of it.

If our answer does not satisfy you, you may complain to a supervisory authority. In Latvia that is the State Data Inspectorate — Datu valsts inspekcija.

Visit counter

We need to know how many people come to the site and what they read. Doing that does not require finding out who those people are, and it does not require storing anything in their browser. So we do neither.

Our counter records only this:

• the address of the page opened and the language it was in;
• where you came from — the domain, not the particular page;
• the campaign tag, if the link carried one;
• the kind of device: desktop, phone or tablet;
• the time zone set in your browser, which tells us roughly what part of the world you are reading from. Not coordinates and not a city: ‘Europe/Riga’ says exactly what it says;
• the time, and a few actions on the page — which tab you opened, whether you reached the form;
• your answer to the cookie question — the answer itself, not who gave it. It tells us what share of visitors Google Analytics sees, without which its numbers have nothing to be compared against.

So that one person opening three pages is not counted as three, we compute a short fingerprint: the IP address and the browser string are hashed together with a secret key. The IP address itself is stored nowhere. The key changes once a day and yesterday’s is kept nowhere, so yesterday’s fingerprint cannot be matched to today’s, not even by us. The fingerprint cannot be turned back into an IP address.

We consider such records not to be personal data: they cannot be traced to a person. Were they, the basis would be Article 6(1)(f) GDPR — our legitimate interest in knowing the traffic to our own site. The counter needs no consent under the ePrivacy Directive either: consent there is required for writing to your device and reading from it, and it writes nothing there.

If you would rather not appear even in that count, turn on Global Privacy Control or Do Not Track in your browser — the counter sees the signal and sends nothing. We deliberately offer no personal opt-out: remembering your refusal would mean storing a record in your browser, which is exactly what the counter avoids.

Rows are kept for a year and then deleted automatically. A year, so that a month can be compared with the same month a year earlier.

Cookies and browser storage

Everything the site keeps in your browser is set out in a separate document — the cookie policy. It lists what exactly, why, for how long and how to change your mind.

In short: the necessary entries are what make the site and the form work, and they need no consent. Google Analytics sets no cookies before you agree. Our own counter never sets them at all — it is described in the previous section.

Automated decisions

We take no automated decisions about you and do no profiling within the meaning of article 22. Enquiries are read by people.

Children

This site is addressed to businesses and is not intended for children. We do not knowingly collect data about anyone under 16; if such data has reached us by mistake, write to us and we will delete it.

Changes

If this policy changes, the version date at the top of the page changes with it. Where a change materially affects data already collected, we will tell the people it affects separately.