Privacy policy

Purpose and scope of the Privacy Policy.
1. The Privacy Policy (hereinafter, the “Policy”) describes and provides information to identifiable natural persons (hereinafter, the “Data Subject”) on how SIA GoWEB (hereinafter, the “Controller”) processes the Data Subject’s personal data where they have submitted an application to become an employee of SIA GoWEB, wish to receive services or purchase goods by concluding a contract, attend events organized by the Controller and its cooperation partners, visit or plan to visit the Controller’s premises and the adjacent territory, contact the Controller using the telephone numbers or communication channels provided (email, post, have submitted a complaint or suggestion, as well as visit the social networks administered by the Controller).
2. In this Policy, the Controller has described the measures taken to ensure that the interests and freedoms of the data subject are protected, while at the same time ensuring that their data are processed fairly, lawfully and in a manner transparent to the data subject.
3. The Policy applies to the processing of natural persons’ data regardless of the form and/or environment in which the natural person provides personal data (when entering the territory and/or premises, by telephone, orally, etc.) and of the source from which the personal data are obtained, and likewise regardless of the Controller’s systems (video, etc.) in which they are processed.
4. If this Policy is updated (revised), the amendments to this Policy take effect on the date specified in the notices of changes to this Policy. To ensure transparent and fair data processing, the current version of the Policy will be posted on the Controller’s website in the privacy policy section and at the Controller’s office.
The Controller.
1. SIA GoWEB (unified registration no. 40103297996, contact information: Kāpu iela 95-24, Jūrmala, Latvia, LV-2008, email address: info@bettrweb.com, websites www.bettrweb.com and www.bettrweb.lv).
Applicable legislation.
1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter, the “Regulation”).
2. The Personal Data Processing Law.
3. Other applicable legislation in the field of processing and protection of natural persons’ data.
Purposes of personal data processing.
1. In carrying out its business activities, the Controller has determined that it has several purposes for processing personal data, which we invite you to review separately:
  1. For the purpose of ensuring the Controller’s personnel recruitment and legitimate interests;
    What personal data does the Controller process?
    The categories of personal data processed by the Controller depend on the personal data the Data Subject has submitted to the Controller. For example, all information included in the CV submitted by the Data Subject, such as: first name, surname, date of birth, residential address, employment and study/education history, language skills and their use, additional knowledge/skills, interests/hobbies, telephone number, email address, photograph or other information identifying the Data Subject, as well as information obtained from previous employers who have provided references about the Data Subject, where the Data Subject has unambiguously permitted contact with the relevant previous employers. If the Data Subject is invited to a job interview, the information provided during the job interview, the completed tests and other assessments are considered the Data Subject’s personal data.
    What is the legal basis for processing personal data?
    Data processing for the purpose of ensuring personnel recruitment is carried out on the basis of points (a) and (f) of Article 6(1) of the Regulation, i.e.:
    a) the Controller is entitled to process personal data if the Data Subject has given consent to the processing of their personal data for one or more specific purposes. A person’s consent is their free will and independent decision, given voluntarily, thereby permitting the Controller to process personal data for the purposes set out in this Policy. A person’s consent is binding if it is given orally (for example, before the CV is submitted and in this Policy the person is informed that personal data will be processed). By submitting a CV, the Data Subject agrees that their personal data will be used to achieve the purposes specified in this Policy. A person has the right to withdraw their previously given consent at any time using the contact information provided in this Policy. The withdrawal of consent does not affect the lawfulness of data processing carried out while the person’s consent was valid. Withdrawing consent cannot stop data processing that is carried out on other legal bases, for example, on the basis of the legitimate interests of the Controller and third parties;
    b) upon receiving your CV and/or application, the Controller acquires a legal interest in processing the CV and/or application received from you by evaluating the information provided in it, organizing the interview procedure, conducting interviews and securing evidence that substantiates the lawful conduct of the relevant recruitment process. In the event of a dispute, the information obtained in the recruitment process may be used to demonstrate the lawful conduct of the relevant recruitment process (for example, to investigate cases where complaints have been received about the recruitment process, and to secure evidence in the event of complaints and claims).
    What is the period of personal data processing?
    When choosing the criteria for storing personal data, the Controller takes into account the following circumstances:
    a) whether the personal data retention period is set by or follows from the laws and regulations of the Republic of Latvia and the European Union;
    b) for what period the relevant personal data must be stored to ensure the exercise and protection of the legitimate interests of the Controller or a third party;
    c) as long as the consent given by the person to the processing of personal data has not been withdrawn and there is no other legal basis for data processing, for example, to fulfill obligations binding on the Controller;
    d) the Controller needs to protect the vital interests of the Data Subject or another natural person, including life and health. All information obtained when the Data Subject, as a candidate, applies for vacancies and/or provides additional information, for example, during interviews, will be stored in full or in part in the Controller’s database for no longer than six months to ensure the Controller’s legal interests. In accordance with the data minimization principle, the Controller undertakes to delete the relevant information once the legal interest has been achieved. If the Controller receives complaints about a specific recruitment process, all information processed in the recruitment process will be retained until the complaint has been examined and the final court judgment has entered into force and been enforced. After the end of the retention period, the personal data will be irreversibly deleted.
    Who has access to the information and to whom is it disclosed?
    Recipients of personal data may be employees authorized by the Controller, Processors, and law enforcement and supervisory authorities.
    a) The Controller has an obligation to provide information about the processed personal data to law enforcement authorities, the court or other state and local government authorities, if this follows from laws and regulations and the relevant authorities are entitled to the requested information, where it has had to be specifically requested;
    b) if the personal data must be transferred to the relevant third party within the framework of a concluded contract in order to perform a function necessary for the performance of the contract (for example, staff interviews conducted by recruitment companies; for the exercise of the Controller’s legitimate interests);
    c) in accordance with a clear and unambiguous request of the Data Subject;
    d) for the protection of lawful interests, for example, when bringing an action before a court or other state institutions against a person who has infringed the Controller’s lawful interests.
  2. For the purpose of ensuring accurate provision of services, performance of contractual obligations and the Controller’s legitimate interests;
    What personal data does the Controller process?
    The categories of personal data processed by the Controller depend on the Controller’s services used by natural persons. For example, when the data subject receives or expresses a wish to receive services provided by the Controller, or to purchase materials and goods from the Controller, in accordance with the requirements of laws and regulations and the Controller’s legitimate interest, the Controller has the obligation and the right to process the data subject’s identifying information and information confirming the person’s identity. For example, if you return goods or raise a claim about their quality, the Controller is obliged to examine your claim, as a result of which the Controller needs to identify the complainant, i.e. the person to whom a reply must be prepared. In this case, to achieve the purpose of providing services, the Controller may process a scope of personal data that includes the first name, surname, personal identity number, contact information, information about the services received and to be received and the range of goods, etc. The relevant information is recorded in documentation and stored in the Controller’s data processing system. When the Data Subject receives services or purchases goods, personal data are processed in accordance with the contract concluded between the Parties.
    What is the legal basis for processing personal data?
    Data processing for the purpose of providing services or selling goods is carried out on the basis of points (b), (c) and (f) of Article 6(1) of the Regulation, i.e. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; processing is necessary for compliance with a legal obligation to which the Controller is subject. Also, in certain cases, to ensure the legitimate interests of the Controller and third parties (for example, to investigate cases where complaints have been received about the quality of service provision or about goods sold, to carry out follow-up checks to improve service provision, and to secure evidence in the event of complaints and claims).
    What is the period of personal data processing?
    When choosing the criteria for storing personal data, the Controller takes into account the following circumstances:
    a) whether the personal data retention period is set by or follows from the laws and regulations of the Republic of Latvia and the European Union;
    b) for what period the relevant personal data must be stored to ensure the exercise and protection of the legitimate interests of the Controller or a third party;
    c) as long as the consent given by the person to the processing of personal data has not been withdrawn and there is no other legal basis for data processing, for example, to fulfill obligations binding on the Controller;
    d) the Controller needs to protect the vital interests of the Data Subject or another natural person, including life and health. When providing services or selling goods, the Controller complies with special laws and regulations that impose an obligation to retain certain data; for example, the Accounting Law imposes an obligation to retain source documents for transactions for five years. In view of the above, the controller follows the periods set out in laws and regulations. In turn, when providing services or selling goods for which a warranty period is set, information on aspects of service provision will be retained for at least 2 years, taking into account the limitation period applicable to the relevant legal relationship. If you would like more detailed information, please contact the Controller using the contact information provided above. After the end of the retention period, the personal data will be irreversibly deleted.
    Who has access to the information and to whom is it disclosed?
    Recipients of personal data may be employees authorized by the Controller, Processors, and law enforcement and supervisory authorities. The Controller has an obligation to provide information about the processed personal data:
    a) to law enforcement authorities, the court or other state and local government authorities, if this follows from laws and regulations and the relevant authorities are entitled to the requested information, where it has had to be specifically requested;
    b) if the personal data must be transferred to the relevant third party within the framework of a concluded contract in order to perform a function necessary for the performance of the contract (for example, in the case of a warranty or insurance contract; for the exercise of the Controller’s legitimate interests), or if it is necessary to improve service and ensure the quality of services provided to the client by engaging service providers;
    c) in accordance with a clear and unambiguous request of the Data Subject;
    d) for the protection of lawful interests, for example, when bringing an action before a court or other state institutions against a person who has infringed these lawful interests of the Controller.
  3. Coverage of events organized by the Controller and its cooperation partners in the media and on social networks for the purpose of promoting the brand and increasing its recognition;
    What personal data does the Controller process?
    At events and event venues organized by the Controller and its cooperation partners where photos and video recordings of the event are made, photo and video images of participants and visitors may be processed by storing them in the Controller’s archives and posting them on the website, on social networks administered by the Controller and in other informational materials of the Controller.
    What is the legal basis for processing personal data?
    For the purpose of covering events organized by the Controller in the mass media and on social networks to ensure the Controller’s recognition, personal data are processed on the basis of point (f) of Article 6(1) of the Regulation, i.e. the Controller has a legitimate interest in covering the events it organizes, or in which it takes part, in the mass media and on social networks, thereby ensuring the recognition of its brands. When choosing what information to publish, the Controller always applies the highest ethical standards, thereby seeking to ensure that the publications do not infringe the rights and freedoms of data subjects. At the same time, the Controller is aware that it may not know all the facts and circumstances; therefore, to ensure fair data processing, it does not prevent any data subject from contacting the Controller at any time using the information provided in order to object to the data processing. At the same time, the Controller explains that if you take part in various public events, for example, by giving interviews or knowingly being photographed and filmed, it will presume, prima facie, that you have no objection to the relevant information being published.
    What is the period of personal data processing?
    The Controller plans to store the information obtained indefinitely. Also, to comply with the principle of fair data processing, the Controller explains that, given that the purpose of this data processing is to publish information about the Controller’s events, the materials obtained will be publicly available and any third party will be able to access them.
    Who has access to the information and to whom is it disclosed?
    Recipients of personal data may be employees authorized by the Controller, processors, and law enforcement and supervisory authorities. Where the personal data must be transferred to the relevant third party within the framework of a concluded contract in order to perform a function necessary for the performance of the contract (for example, in the case of an insurance contract, for the exercise of the Controller’s legitimate interests; to a service provider to carry out video editing work), or where it is necessary to improve service and ensure the quality of services provided to event visitors. The Controller informs you that the Processors it has chosen (google.com (google analytics), facebook.com, etc.) are considered companies operating outside the Member States of the European Union and the European Economic Area; therefore, the Controller invites you to review these companies’ privacy policies or to contact the Controller separately with a request for additional information about the terms of cooperation.
  4. Prevention or detection of criminal offenses in connection with the protection of property, ensuring the protection of the legal interests of the controller and third parties in the event of infringements, and protection of the vital interests of persons, including life and health;
    What personal data does the Controller process?
    When the Data Subject enters/accesses the Controller’s premises or its territory where video surveillance is carried out, their video image and the time when they visited the premises and/or territory may be processed. Video surveillance is not carried out in areas where data subjects expect increased privacy, in rest areas, changing rooms, etc. The recording areas of the video surveillance cameras are focused on corridors, entrances/exits, vehicles and their flow in the Controller’s territory.
    What is the legal basis for processing personal data? Video surveillance is carried out for the purpose of preventing or detecting criminal offenses in connection with the protection of persons and property, the protection of the legal interests of the Controller or a third party, and the protection of the vital interests of persons, including life and health. Video surveillance is carried out on the basis of points (d) and (f) of Article 6(1) of the Regulation, i.e. processing of personal data is necessary in order to protect the vital interests of the data subject or of another natural person (for example, video surveillance where the processing of personal data is necessary to protect a person’s life and health in connection with the prevention and/or detection of criminal offenses); to ensure the legitimate interests of the Controller and third parties (for example, to prevent or detect criminal offenses in connection with the protection of property, and to secure evidence in the event of disputes).
    What is the period of personal data processing?
    Video surveillance recordings made for the purpose of preventing or detecting criminal offenses in connection with the protection of persons and property, the protection of the legal interests of the Controller or a third party, and the protection of the vital interests of persons, including life and health, will be stored for a period not exceeding 30 days, unless the relevant video recording shows possibly unlawful conduct or conduct that may help the Controller or third parties to secure their legal interests. In this case, the relevant video recording may be extracted and retained until the legal interest has been secured.
    Who has access to the information and to whom is it disclosed?
    Recipients of personal data may be employees authorized by the Controller, Processors, and law enforcement and supervisory authorities.
  5. Storage and recording of incoming and outgoing communication (emails, letters, and in certain cases requests received on the social network profiles administered by the Controller) to ensure the fulfillment of obligations applicable to the Controller and the Controller’s legitimate interests.
    What personal data does the Controller process?
    When you use the various options for contacting the Controller in writing, information related to the specific letter, request or application will be stored. Although the Controller encourages the use of official means of communication, there may be situations where you have chosen to contact the Controller via social network platforms. In such cases, you should be aware that additional information displayed on the relevant social network may come into the Controller’s possession.
    What is the legal basis for processing personal data?
    Information about the fact and content of communication is stored on the basis of points (c) and (f) of Article 6(1) of the Regulation, i.e. where you have submitted a claim or request that gives rise to the Controller’s obligation to examine your request, the legal basis for data processing is that legal obligation, whereas for ensuring the legitimate interests of the Controller and third parties (for example, to investigate cases where complaints have been received about the quality of customer service, and to secure evidence against possible claims), the legal basis for data processing is the Controller’s legitimate interests.
    What is the period of personal data processing?
    To achieve the purpose, the Controller will store the relevant information for a period not exceeding two years, unless the relevant information needs to be used to secure the Controller’s legal interests for a longer time (for example, in the event of a dispute, the retention of evidence). In this case, the relevant documents and records will be retained until the legal interest has been secured.
    Who has access to the information and to whom is it disclosed?
    Recipients of personal data may be employees authorized by the Controller, Processors, law enforcement and supervisory authorities, and the court.
How will the data subject be informed about the processing of their personal data?
The Data Subject is informed about the personal data processing described in this Policy using a multi-layered approach that includes the following methods:
a) notices are placed at video surveillance locations warning Data Subjects (pedestrians, drivers, visitors, employees, etc.) that video surveillance is carried out in the Controller’s territory, providing basic information about the video surveillance and informing them of the options for obtaining more detailed information;
b) when visiting the website, the Data Subject can read a notice about which cookies are used and is also invited to read this Policy;
c) this Policy of the Controller is publicly available online on the Controller’s website and at the Controller’s office from the office administrator.
d) at public events where photo and video materials may be taken for the purpose of promoting the brands represented by the Controller, the information specified in this policy will be posted at the data processing locations.
Rights of the Data Subject.
1. The Data Subject has the right to request from the Controller access to their personal data and to receive clarifying information about what personal data concerning them the Controller holds, for what purposes the Controller processes such personal data, the categories of recipients of the personal data (persons to whom the personal data have been disclosed or are intended to be disclosed, provided that laws and regulations in the specific case permit the Controller to provide such information (for example, the Controller cannot provide the Data Subject with information about the relevant state institutions that are conducting criminal proceedings, subjects of operational activities or other institutions about which laws and regulations prohibit the disclosure of such information)), information about the period for which the personal data will be stored, or the criteria used to determine that period.
2. If the Data Subject believes that the information held by the Controller is outdated, inaccurate or incorrect, the Data Subject has the right to request the rectification of their personal data.
3. The Data Subject has the right to request the erasure of their personal data, or to object to the processing, if the person believes that the personal data have been processed unlawfully or are no longer necessary in relation to the purposes for which they were collected and/or processed (exercising the principle of the right “to be forgotten”).
4. The Controller informs you that the Data Subject’s personal data cannot be erased if the processing of personal data is necessary:
  a) for the Controller to protect the vital interests of the Data Subject or another natural person, including life and health;
  b) to protect the Controller’s property;
  c) for the Controller or a third party to establish, exercise or defend lawful (legal) interests;
  d) for archiving purposes in accordance with the laws and regulations in force in Latvia governing the creation of archives.
5. The Data Subject has the right to obtain from the Controller restriction of the processing of the Data Subject’s personal data where one of the following applies:
  a) the Data Subject contests the accuracy of the personal data, for a period enabling the Controller to verify the accuracy of the personal data;
  b) the processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
  c) the Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defense of legal claims;
  d) the Data Subject has objected to processing, pending verification of whether the legitimate grounds of the controller override the legitimate grounds of the data subject.
6. Where the processing of the Data Subject’s personal data has been restricted in accordance with point 6.5, such personal data shall, with the exception of storage, only be processed with the Data Subject’s consent, or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of important public interest.
7. The Controller informs the Data Subject before the restriction of processing of the Data Subject’s personal data is lifted.
8. The Data Subject has the right to lodge a complaint with the Data State Inspectorate if they believe that the Controller has processed their personal data unlawfully; at the same time, the Controller invites you to first write to the email address info@bettrweb.com so that a solution can be found promptly if your right to the protection of personal data has been infringed.
9. The Data Subject may submit a request for the exercise of their rights in the following ways:
  a) in writing, in person at the Controller’s premises, presenting an identity document (for example, a passport or ID card, etc.), as the Data Subject has an obligation to identify themselves;
  b) by email, signing it with a secure electronic signature. In this case, it is presumed that the data subject has identified themselves by submitting a request signed with a secure electronic signature. At the same time, the Controller reserves the right, in case of doubt, to request additional information from the data subject if it considers this necessary. Electronically prepared applications should be sent to the email address: info@bettrweb.com;
  c) by post. The reply will be prepared and sent by registered letter, thereby ensuring that unauthorized persons cannot receive this mail item. At the same time, the Controller reserves the right, in case of doubt, to request additional information from the data subject if it considers this necessary.
10. The Data Subject has an obligation, as far as possible, to specify in their request the date, time, place and other circumstances that would help fulfill their request.
11. After receiving a written request from the Data Subject regarding the exercise of their rights, the Controller:
  a) verifies the person’s identity;
  b) evaluates the request, and if:
  the request can be fulfilled, for example, viewing video materials, the Data Subject, as the requester, may receive a copy of the video recording or other data;
  additional information is required to identify the Data Subject requesting the information, the Data Subject will be asked to provide additional information so that the information in which the Data Subject is identifiable can be selected correctly (for example, the time of visits to the premises, use of services, goods purchased);
  the information has been deleted, or the person requesting the information is not the Data Subject, or the person cannot be identified, the request may be rejected in accordance with this Policy and/or laws and regulations;
  in the event that the Controller has received a request but you have not left your contact information so that the Controller could contact you while the request is being examined and inform you of the outcome of the examination of the Request, the Controller undertakes to prepare a written reply within one month, which will be available at the Controller’s office. The relevant reply letter will be kept at the Controller’s office for collection for no longer than two months from the date the request was submitted.
Cookies.
1. Cookies are small text files that a website stores in the visitor’s browser. On www.bettrweb.com the Controller uses the following cookies:
  a) necessary cookies, without which the website does not work properly and which store the visitor’s choice in the cookie notice (pressidium_cookie_consent, retention period 6 months). They are used on the basis of point (f) of Article 6(1) of the Regulation, i.e. the Controller’s legitimate interest in keeping the website working;
  b) analytics cookies (Google Analytics 4: _ga and _ga_RDPYPZVGRH, retention period 2 years), which measure website visits in aggregate and show how the website is used. They are used only with the visitor’s consent, on the basis of point (a) of Article 6(1) of the Regulation;
  c) marketing cookies (LinkedIn Insight Tag: li_fat_id, bcookie, lidc, UserMatchHistory, retention periods from 1 day to 1 year; Meta pixel: _fbp, retention period 3 months), which measure visits that come from LinkedIn and Meta advertising and allow the Controller to show its ads to people who have visited the website. They are used only with the visitor’s consent, on the basis of point (a) of Article 6(1) of the Regulation.
2. On the Controller’s behalf, analytics data is processed by Google Ireland Limited, and marketing data by LinkedIn Ireland Unlimited Company and Meta Platforms Ireland Limited. Where data is transferred to the United States, the transfer is based on the EU-U.S. Data Privacy Framework and on standard contractual clauses approved by the European Commission.
3. The visitor may withdraw consent at any time by deleting the cookies in their browser settings. The cookie notice will then be shown again and a new choice can be made. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
How are personal data protected?
1. The Controller ensures, continuously reviews and improves personal data protection measures to protect the personal data of natural persons against unauthorized access, accidental loss, disclosure or destruction. To ensure this, the Controller applies appropriate technical and organizational requirements, including the use of firewalls.
2. The Controller carefully vets all service providers that process the personal data of natural persons on behalf of and on the instructions of the Controller, and assesses whether its cooperation partners (personal data processors) apply appropriate security measures so that the processing of natural persons’ personal data takes place in accordance with the Controller’s delegation and the requirements of laws and regulations.
3. In the event of a personal data breach that is likely to result in a high risk to the rights and freedoms of the data subject, the Controller will notify the relevant Data Subject, where possible, or the information will be published on the Controller’s website or in another possible way, for example, through the media (TV, radio, newspapers, social networks, etc.).

Version: November 7, 2026.