Privacy Policy

Last updated: April 10, 2026

1. Introduction

SIA "Vietne" ("we", "us", "our") operates the Otnox platform at otnox.com and getotnox.com. This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable Latvian data protection laws.

By using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, company name, job title, and password (hashed) when you register for an account.
• Usage data: pages visited, features used, search queries, tender interactions, timestamps, and session duration.
• Device & technical data: IP address, browser type and version, operating system, screen resolution, and referring URL.
• Payment data: processed securely by our payment provider (Stripe). We do not store full card numbers on our servers.
• Communication data: content of support requests, feedback, or other messages you send to us.
• Cookie data: as described in Section 5 below.

3. How We Use Your Data

We process your personal data for the following purposes and legal bases:

• Service delivery (contract performance): to provide, maintain, and improve the Otnox platform, including AI-powered tender matching, alerts, and analytics.
• Account management (contract performance): to create and manage your account, process subscriptions, and handle billing.
• Communication (legitimate interest): to respond to your inquiries, send service notifications, and provide customer support.
• Analytics & improvement (legitimate interest): to understand how our platform is used and improve its features and performance.
• Legal compliance (legal obligation): to comply with applicable laws, regulations, and legal processes.
• Marketing (consent): to send promotional emails only when you have explicitly opted in. You can unsubscribe at any time.

4. Data Sharing & Third Parties

We do not sell your personal data. We share data only with the following categories of recipients, under appropriate safeguards:

• Cloud infrastructure: Google Cloud Platform (EU region) for hosting and data storage.
• Authentication: Firebase Authentication for secure login.
• Payment processing: Stripe for subscription billing (PCI DSS compliant).
• Analytics: privacy-focused analytics tools to understand usage patterns.
• Email services: for transactional and, where consented, marketing communications.

All third-party processors are bound by Data Processing Agreements (DPAs) and are required to comply with GDPR.

5. Cookies

We use the following categories of cookies:

• Essential cookies: required for the platform to function (authentication, session management). These cannot be disabled.
• Functional cookies: remember your preferences (language, display settings).
• Analytics cookies: help us understand usage patterns. Set only with your consent.

You can manage cookie preferences through your browser settings or our cookie consent banner.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy:

• Account data: retained while your account is active, and for up to 30 days after account deletion.
• Usage data: retained for up to 24 months, then anonymized or deleted.
• Payment records: retained for 7 years as required by Latvian tax and accounting regulations.
• Communication data: retained for up to 24 months after the last interaction.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest
• Access controls and role-based permissions
• Regular security assessments
• Secure password hashing (bcrypt/scrypt)
• Hosting in EU-based data centers (Google Cloud, europe-west region)

8. Your Rights Under GDPR

As a data subject in the EU/EEA, you have the following rights:

• Right of access (Art. 15): request a copy of your personal data.
• Right to rectification (Art. 16): correct inaccurate or incomplete data.
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten").
• Right to restrict processing (Art. 18): limit how we use your data.
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent (Art. 7): withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@getotnox.com. We will respond within 30 days.

9. International Data Transfers

Your data is primarily stored within the European Union (Google Cloud, europe-west region). If any data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

10. Children's Privacy

Otnox is a business-to-business service and is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or a prominent notice on our platform. The "Last updated" date at the top reflects the most recent revision.

12. Supervisory Authority

If you are unsatisfied with our handling of your data, you have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija):

13. Contact

For any questions or requests regarding this Privacy Policy or your personal data: