Privacy Policy
Effective from
This policy explains how SIA "AA" (brand "CVN") processes personal data when you visit cvn.lv, send a request, contact us or use our moving, freight, furniture assembly, storage and disposal services.
We process data under the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Latvian Personal Data Processing Law. We only collect the data we need to answer your request and do the job well.
1. Controller and contact details
The controller of your personal data is SIA "AA", reg. No. 40203373798, VAT No. LV40203373798, registered address: Bauskas iela 15-5, Jūrmala, LV-2010. Office: Kārļa Ulmaņa gatve 2 k-3, Rīga, LV-1004.
For any question about personal data, write to info@cvn.lv or call +371 28 62 62 63. We are not required to appoint a data protection officer; these matters are handled by the company management.
2. What data we process
- Request data: name, phone, e-mail, addresses (from / to), preferred date, selected service, your description and attached files (e.g. photos of items or rooms, documents).
- Calculator data: the parameters you enter (rooms, floors, lift, heavy items, distance) and the estimated price, if you send a request from the calculator.
- AI chat data: your chat messages and, if you enter them, name, phone and e-mail. Please do not share sensitive information in the chat (health data, personal ID code, bank details).
- Communication data: call details (number, time, duration) and the content of e-mails and messages you send us.
- Service data: job addresses and access details (floor, lift, door code), working time, crew notes, photos of items and damage, your signature on the acceptance report, payment method and amount (we do not store card details).
- Invoicing data: for companies — company details and contact person.
- Request source: how you reached the site — campaign parameters (UTM), Google or Meta click ID (gclid, fbclid), referring site and landing page.
- Technical data: IP address, browser and device in server security logs.
- Cookies and similar technologies — see the Cookie Policy.
We receive the data from you. If someone else orders the service (e.g. an employer or relative) and names you as the on-site contact, we receive your contact details from them.
3. Why we process data and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|
| Answer your request, call, e-mail or chat message; prepare a quote | Art. 6(1)(b) — steps prior to a contract at your request | 12 months after the last contact if no contract is made |
| Plan and perform the service: schedule, crew, vehicle, acceptance report, photos, contact on the day | Art. 6(1)(b) — performance of a contract | During the contract and 3 years after the service (for possible claims) |
| Invoicing, accounting and taxes | Art. 6(1)(c) — legal obligation (Accounting Law) | At least 5 years after the source document |
| Handling complaints, damage and disputes; insurance claims | Art. 6(1)(f) — legitimate interest in defending our rights | Until the complaint or dispute is finally resolved |
| Learning which channel a request came from (UTM, gclid) and measuring advertising | Art. 6(1)(f) — legitimate interest in knowing which channels work | As long as the request is kept |
| Website security: protection against spam and abuse | Art. 6(1)(f) — legitimate interest | Server logs — up to 30 days |
| Website analytics and advertising (Google Analytics, Google Ads, Meta Pixel, Microsoft Clarity) | Art. 6(1)(a) — your consent in the cookie banner | See the Cookie Policy |
| Offers and news by e-mail or SMS | Art. 6(1)(a) — consent | Until consent is withdrawn |
Where we rely on legitimate interests, we have assessed that they do not override your rights. You can object to such processing (see section 7).
4. Who we share data with
We do not sell personal data. Only CVN staff who need the data for their work can see it (e.g. the crew sees the address and on-site contact, not the full request history). Data is also processed by service providers acting on our behalf under a data processing agreement:
| Recipient | Why | Where |
|---|---|---|
| Hetzner Online GmbH | Servers running the website and the CVN CRM system | Germany / Finland (EU) |
| IT contractor developing and maintaining the website and CRM | Technical support, bug fixing | EU |
| Google Ireland Ltd (Google Workspace) | E-mail — copy of requests to info@cvn.lv, correspondence with clients | EU; possible transfer to the US |
| OpenAI | AI chat answers — chat messages are sent to generate a reply; under the OpenAI API terms they are not used to train models | US |
| Google Ireland Ltd (Analytics, Ads, Tag Manager) | Analytics and advertising — only with consent | EU; possible transfer to the US |
| Meta Platforms Ireland Ltd | Meta Pixel ad measurement — only with consent | EU; possible transfer to the US |
| Microsoft Ireland Operations Ltd | Microsoft Clarity usability analytics — only with consent | EU; possible transfer to the US |
| Telecom operator, SMS provider | Calls and text messages about your order | EU |
| Accounting service provider, bank | Invoices, payments, accounting | Latvia |
| Insurer, lawyers | Only in case of damage or a dispute | Latvia |
| Public authorities, courts | Only where required by law | Latvia |
If your order is performed or invoiced by another company related to CVN, this is stated in the quote or invoice, and that company is an independent controller for that contract.
5. Transfers outside the European Economic Area
Some of the providers above (OpenAI, Google, Meta, Microsoft) may process data in the US. Such transfers rely on the European Commission adequacy decision on the EU–US Data Privacy Framework or on Standard Contractual Clauses approved by the European Commission. On request we will provide information about the safeguards used.
6. How long we keep data
Retention periods are listed in the table in section 3. After that, data is deleted or anonymised. If a request cannot be delivered to the CRM immediately, it is kept temporarily on a protected server and resent automatically; backup copies are deleted after 30 days at the latest.
7. Your rights
- Access — confirm whether we process your data and get a copy.
- Rectification — correct inaccurate or complete incomplete data.
- Erasure — ask us to delete data that is no longer needed or unlawfully processed (except data we must keep by law, such as invoices).
- Restriction — temporarily pause processing, e.g. while we check accuracy.
- Portability — receive the data you provided in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests and, at any time, to direct marketing.
- Withdrawing consent — at any time, without affecting earlier processing. Cookie consent can be changed via "Cookie settings" in the site footer.
Send your request to info@cvn.lv. We reply free of charge within one month (in complex cases this may be extended by two further months, and we will tell you). To avoid disclosing data to the wrong person, we may ask you to confirm your identity, e.g. by calling from the number given in the request.
If you think your data is processed unlawfully, please contact us first and we will try to resolve it. You also have the right to lodge a complaint with the Data State Inspectorate of Latvia (www.dvi.gov.lv).
8. Do you have to provide data
To answer a request we need at least a phone number or e-mail; to perform the service we need the addresses and date. Without them we cannot prepare a quote or do the job. All other fields and files are optional.
9. Automated decision-making
We do not make decisions that significantly affect you solely by automated means, and we do not profile you for such decisions. The calculator price is an estimate; the final quote is prepared by a CVN employee. The AI chat provides information about our services but makes no decisions and concludes no contracts.
10. Data security
The website works only over encrypted HTTPS; servers are located in the European Union; access to the CRM is personal and limited by role; requests are delivered to the CRM over a cryptographically signed connection; forms are protected against automated abuse. If a personal data breach is likely to result in a high risk to your rights, we will inform you without undue delay.
11. Children
Our services are intended for adults. We do not knowingly collect personal data of children. If you believe a child has sent us their data, contact us and we will delete it.
12. Changes to this policy
We may update this policy when our services, tools or the law change. The current version is always published on this page with its effective date below. We will inform existing clients of material changes by e-mail or on the website.