IK “Somnium”
Registration No. 53602024551
Privacy policy
This policy describes how IK “Somnium” processes personal data on atbalstatelpa.lv, in bookings, payments, correspondence and consultations. Processing is governed by the General Data Protection Regulation (GDPR) and Latvia’s Personal Data Processing Law.
1. Controller and contact details
1.1. The personal data controller is IK “Somnium”, registration number 53602024551, represented by Vita Reinfelde (the Controller). Address: Maldoņi 1, Rundāle parish, Bauska municipality, LV-3921. Email for data enquiries: vita@atbalstatelpa.lv. Phone: +371 29 993 163.
2. Data processed, purposes and legal bases
- 2.1. Booking and service: first name, last name, email, selected service, date, time, meeting link and booking status. Phone number, if provided; for an organisation’s introductory call, also the organisation’s name. Basis: steps before entering into a contract and performance of a contract, Article 6(1)(b) GDPR.
- 2.2. Payments and accounting: payer details, service, amount, currency, transaction identifier, payment and refund status, and invoice details. Basis: performance of a contract and accounting obligations, Article 6(1)(b) and (c) GDPR. Full card details and online banking credentials are processed by the payment provider; our booking system does not store them.
- 2.3. Correspondence and reminders: contact information, message content, booking details and correspondence history. Basis: steps taken at the data subject’s request, performance of a contract and a legitimate interest in answering enquiries, points (b) and (f).
- 2.4. Global DISC: name, email, questionnaire responses and the resulting profile used to provide the consultation. Basis: performance of a contract, point (b). The questionnaire is completed on a separate DISC platform. The website’s booking form does not collect these responses.
- 2.5. Acceptance of terms and withdrawals: document version, accepted wording, time of acceptance and withdrawal, and the notice. Basis: performance of a contract, legal obligations and a legitimate interest in documenting the agreement, points (b), (c) and (f).
- 2.6. Website and administration security: IP address and technical request data needed for server operation, login and session data. Basis: a legitimate interest in protecting the system, point (f).
2.7. Required fields are marked on the form. Your name and email are needed to confirm the booking and send the link; providing a phone number is voluntary. In correspondence, include only the information needed and avoid unnecessary sensitive data or information about other people.
3. Professional confidentiality and supervision notes
3.1. Information about work situations, relationships and professional challenges is confidential professional information and is strictly protected. Working notes are anonymised or pseudonymised, stored with restricted access and not passed to third parties. If notes still allow a person to be identified, personal data protection requirements apply. Cases discussed in meta-supervision are anonymised. Sessions are not recorded without a separate agreement.
4. Data recipients and processors
4.1. Data is not sold or shared with partners for their marketing. To the extent needed to provide the service, data is received by:
- 4.2. Google Calendar and Google Meet — bookings, invitations and online meetings; Google Cloud EMEA Limited.
- 4.3. Klix, AS “Citadele banka” — payment processing and refunds. The payment provider may also act as an independent controller for its own legal obligations.
- 4.4. Microsoft Azure — infrastructure for the website and booking server.
- 4.5. Email service provider — booking emails, reminders and correspondence.
- 4.6. Global DISC platform aicq.icq.global — questionnaires and profile preparation.
- 4.7. Accounting service provider or system — data needed for accounting records.
- 4.8. Google Fonts and jsDelivr — delivery of the website’s fonts and visual components. The browser connects to these resources and sends technical data needed for the request, such as the IP address.
4.9. An authorised technical maintainer may also have access solely to carry out maintenance tasks. Data is provided to public authorities where required by law. Transfers outside the EU/EEA use the relevant GDPR mechanism, such as a European Commission adequacy decision or standard contractual clauses. Data subjects may ask the Controller for information about specific recipients and safeguards.
5. Retention periods
- 5.1. Booking contact information and correspondence history are retained for three years after the service is provided; if no service is provided, after the scheduled meeting or the end of correspondence. This information is then deleted from the website database.
- 5.2. Accounting and payment data are retained for five years from the end of the transaction year, unless legislation requires a longer retention period for a particular document. They may be stored separately from the booking database.
- 5.3. Global DISC responses and profiles are retained until the service is completed, or longer if there is a separate agreement and a basis for processing.
- 5.4. Professional working notes are kept only as long as needed for the specific process, then deleted or irreversibly anonymised.
- 5.5. Technical logs and backups are retained in line with the systems’ security and recovery cycle. After restoration, data deletion deadlines are reapplied.
- 5.6. If there is an outstanding request, dispute or legal obligation, the relevant data may be retained until it is resolved or the obligation is fulfilled.
5.7. Deleting booking data from the website does not itself delete records in Google Calendar, the email account or the accounting system. The Controller manages the retention and deletion of those copies separately.
6. Data subject rights
6.1. Data subjects have the right to request access to and a copy of their data, correct inaccurate data, request erasure or restriction of processing and, where provided for by law, receive data in a portable format. Where processing is based on legitimate interests, data subjects have the right to object. Consent given for specific processing may be withdrawn without affecting the lawfulness of earlier processing.
6.2. Requests should be submitted to the Controller at vita@atbalstatelpa.lv. Only additional information reasonably necessary to verify identity may be requested. A response is normally provided within one month; if a legally permitted extension is needed, the data subject will be informed. A request for erasure does not remove the obligation to retain legally required accounting records.
6.3. Data subjects have the right to complain about a possible infringement to the Data State Inspectorate. The website’s booking system does not make decisions based solely on automated processing that have legal or similarly significant effects. The DISC profile is used during a consultation and discussed with the consultation provider.
7. Cookies and external links
7.1. Visitor analytics and marketing tracking are not currently enabled on the website. The administration panel uses the necessary cookie at_admin to maintain Vita’s login session for up to 12 hours. It is not used for advertising. Clients do not need to create an account to make a normal booking.
7.2. Google, Klix and DISC services may use their own technical cookies and privacy terms. Social media links open the relevant network’s website only when clicked. If optional analytics or marketing cookies are introduced later, consent will be requested before activation and this information will be updated.
8. Changes to this policy
8.1. The current version is available on this page. A PDF copy of the document in use at the time is attached to the booking confirmation.
Legal basis: GDPR; Accounting Law. Privacy policy guidance: Data State Inspectorate.