Privacy Policy
Effective Date: September 14, 2026
1. Data Controller Identification
SIA “Duck typing” (Reg. No. 44103114326, Address: Viestura iela 10 – 21, Cēsis, Cēsu nov., LV-4101, Latvia) acts as a Data Controller under Regulation (EU) 2016/679 (GDPR) for administrative, account management, and billing data.
For operational data processed by Clients inside BASETIME regarding their team members or projects, SIA “Duck typing” acts as a Data Processor.
Contact: For any privacy question or request, contact us at info@basetime.pro or by post at the address above.
If you use BASETIME through your employer or another organisation (the “Client”), that organisation is the controller of the data entered into its workspace. We receive your name and email address from the Client when you are invited.
2. Personal Data Categories and Purposes
| Category | Data Elements | Processing Purpose | Legal Basis (GDPR) |
|---|---|---|---|
| Account & Identity | Full name, business email, company title, VAT number. | Account setup, contract execution, support. | Art. 6(1)(b) — Contract (sole proprietors); Art. 6(1)(f) — Legitimate Interest (Users of client companies). |
| Financial & Billing | Bank details, billing address, transaction history. | Commercial invoicing, tax compliance. | Art. 6(1)(c) — Legal Obligation |
| Technical & Logs | IP address, browser type, audit logs, login timestamps. | System security, debugging, fraud prevention. | Art. 6(1)(f) — Legitimate Interest |
| Support | Messages, attachments, contact details | Responding to support requests | Art. 6(1)(b) — Contract; Art. 6(1)(f) — Legitimate Interest |
| Website & Cookies | Cookie identifiers, device and browser data | Operating the website; analytics only with consent | Art. 6(1)(f) — Legitimate Interest; Art. 6(1)(a) — Consent for non-essential cookies |
| Customer Communications | Name, business email | Service notices; product updates to existing customers | Art. 6(1)(b) — Contract; Art. 6(1)(f) — Legitimate Interest, with opt-out at any time |
| Legal Compliance & Defence | Identification records, access timestamps, system logs, transaction invoices. | Compliance with statutory legal obligations, police orders, and the establishment or defence of legal claims. | Art. 6(1)(c) (Legal Obligation) and Art. 6(1)(f) (Legitimate Interests). |
Our legitimate interests are securing the Platform, preventing fraud and misuse, providing the service to our business Clients and their Users, improving our service, and informing existing customers about our products. You may object to such processing at any time.
Account and billing data are necessary to conclude and perform the Contract; without them we cannot provide the service.
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you.
Recipients: hosting and infrastructure providers, our email delivery provider, banks and payment providers, our accountants, auditors and legal advisers, and public authorities where required by law. Our current sub-processors are listed at https://basetime.pro/data-processing-agreement-dpa/#sub-processors
3. Sub-Processors and Data Location
3.1. All primary database environments and system backups reside within the European Economic Area (EEA).
3.2. Hosting Infrastructure: DigitalOcean, LLC (Netherlands (EU)).
3.3. No international data transfers outside the EEA take place without strict compliance with GDPR Chapter V safeguards.
4. Retention Periods
Tax & Billing Records: Kept for five (5) years pursuant to the Latvian Law on Accounting, after which they are permanently deleted.
Operational Platform Data: Kept for the duration of the Contract and the 30-day retrieval period set out in Section 15 of the Terms of Service, then permanently erased. Backup copies are overwritten within thirty (30) days in the regular backup cycle.
Technical Security Logs: Kept for twelve (12) months.
Access Request Form Inquiries: Kept for up to twelve (12) months for onboarding communication, or deleted immediately upon request.
5. Data Subject Rights
Individuals have the right to request access, rectification, erasure, processing restriction, data portability, and to object to processing.
To exercise your rights, contact info@basetime.pro. We respond within one month; for complex requests, this may be extended by two further months, in which case we will inform you. We may ask you to verify your identity. For data a Client entered into its workspace, please contact that Client; requests we receive about such data are forwarded to the Client. You may also lodge a complaint with the Data State Inspectorate or with the supervisory authority in the EU or EEA country where you live or work.
Supervisory complaints may be lodged with:
Datu valsts inspekcija (Data State Inspectorate)
Address: Elijas iela 17, Rīga, LV-1050, Latvia | Email: info@dvi.gov.lv
6. Changes to this Policy
We may update this Privacy Policy. We announce material changes by email or in the Platform before they take effect. The effective date at the top shows the current version.
7. Cookies and Tracking Technologies
We maintain a strict architectural separation between our public marketing website (basetime.pro) and the authenticated software application environment:
– Marketing Website (basetime.pro): We use Google Site Kit (Google Analytics 4) solely on our public landing page to measure website traffic and user engagement. These analytics cookies are deployed strictly on the basis of your prior consent (Art. 6(1)(a) GDPR) collected via our cookie banner. You can withdraw or adjust your consent preferences at any time through your browser settings or the cookie preferences panel.
– Application Environment (base.basetime.pro and customer workspaces): Inside the authenticated BASETIME platform, no third-party tracking, profiling, advertising, or Google Analytics cookies are deployed. The application strictly uses first-party, essential session tokens and CSRF security cookies necessary to authenticate users, protect sessions, and deliver the service. Under Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC), strictly necessary operational cookies do not require prior consent.