Privacy Policy
What personal data SIA “Lasso.lv” processes when you use advertise.lv, why, on what legal basis, who receives it, how long it is kept and the rights you can exercise.
Last updated 4 September 2026 · Version 1.0
Published in Latvian and English. In case of discrepancy, the Latvian text prevails.
Controller: SIA “Lasso.lv”, reg. no. 40103439557, Buldurpungas iela 4, Rīga, LV-1024, Latvia
Contact for privacy matters: [email protected]
1. Who we are and what this covers
1.1 SIA “Lasso.lv” operates advertise.lv, an online marketplace for advertising space. We are the controller of the personal data described here. We have not appointed a data protection officer; we are not required to.
1.2 This Policy covers personal data we process about visitors to the website, hosts, advertisers, their representatives and people who contact us. It does not cover what a host or an advertiser does with personal data in their own business — each of us is an independent controller of the data we hold.
2. What we collect, why, and on what basis
2.1 Account and contract data
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Name, e-mail, telephone, password (hashed), account settings | Creating and running your account, authenticating you | Art. 6(1)(b) — performance of a contract; for a company’s named contact, Art. 6(1)(f) — our legitimate interest in having a working contact | 90 days after account closure |
| Company name, registration number, legal address, VAT number, bank details | Contracting, invoicing, payment | Art. 6(1)(b) and Art. 6(1)(c) — legal obligation | 5 years from the end of the financial year |
| Whether you are a registered trader or a private individual | Disclosure on listings | Art. 6(1)(c) | while the listing is live, then 5 years |
2.2 Advertiser identification required by law
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| For a company: name (firma), registration number, legal address. For an individual: given name, surname and personal identity number (personas kods) | Section 12(5) of the Advertising Law prohibits us from accepting advertising for dissemination without requesting this information. Section 12(6) then requires us to produce it to entitled authorities, and makes us liable for the content of the advertisement if we cannot | Art. 6(1)(c) — compliance with a legal obligation, under Section 12(5) | 5 years |
We never publish this data, never show it to hosts, and disclose it only to authorities entitled by law to request it. It is held with access restricted to the people who need it. We keep it for five years: the Advertising Law sets no period, so we have aligned it with the retention required for accounting records and with the period in which a supervisory authority might ask about a past advertisement. If we could not produce it, Section 12(6) would make us liable for the content of the advertisement itself.
2.3 Listings and content you publish
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Listing text, photographs, location, pricing, and any personal data you include in them | Publishing your listing — this is the service you asked for | Art. 6(1)(b) | while live, then 12 months |
| Creative you submit | Displaying it, and evidencing what was displayed | Art. 6(1)(b) and Art. 6(1)(f) | 5 years (evidential) |
Listings are public and may be indexed by search engines. Do not include personal data in a listing that you would not want published. If a photograph shows an identifiable person, you must have their consent — the Terms of Service require it.
2.4 Bookings and messages
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Booking requests, order forms, delivery reports | Making and performing bookings | Art. 6(1)(b) | 5 years (financial records) |
| Messages between hosts and advertisers on the Platform | Providing the messaging service | Art. 6(1)(b) | 24 months after the last message in the thread |
2.5 Fraud prevention and anti-circumvention monitoring
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Automated screening of Platform messages and listings for contact details, and for indications that a deal is being moved off the Platform; the resulting flags; human review of flagged items only | Preventing fraud, and protecting the commission that funds the Platform, which we can only earn if transactions we introduce are concluded on it | Art. 6(1)(f) — our legitimate interests | Flags: 12 months, or until a related claim is resolved |
We want to be direct about this because it involves your messages. We run automated pattern checks on messages and listings. A person reads a message only when a check flags it. We do this to detect two things: fraud, and attempts to take a deal off the Platform to avoid our fee — which the Anti-Circumvention Agreement prohibits. We do not read messages routinely, we do not use message content for marketing or profiling, and a decision to suspend an account is always taken by a person, never automatically.
You can object to this processing at any time (see section 7). We will stop unless we can demonstrate compelling legitimate grounds — which, for fraud prevention, we usually can, but we will consider each objection on its own facts. We have written an assessment balancing this processing against your interests; ask and we will summarise it.
2.6 Communications with us
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Support enquiries, complaints, notices of illegal content, statements of reasons and your responses | Answering you, and keeping a record of moderation decisions | Art. 6(1)(b), Art. 6(1)(c) and Art. 6(1)(f) | 3 years; moderation decisions 5 years |
2.7 Marketing
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| E-mail address, and which of our messages you opened or clicked | Sending you news about the Platform and available advertising space | Consent — Art. 6(1)(a), or where you are an existing customer and the message concerns similar services, Art. 6(1)(f) together with Section 9(2) of the Information Society Services Law | until you unsubscribe, then a suppression record indefinitely so we do not contact you again |
Every marketing message has a free unsubscribe link. Service messages — booking confirmations, delivery reports, invoices, password resets — are not marketing and continue regardless; they are sent on the basis of our contract with you.
Open-tracking: we do not use tracking pixels in marketing e-mail, and we send no marketing e-mail at present. If that changes, we will ask for your consent to it separately, because reading information from your device requires consent.
2.8 Website, cookies and analytics
Cookies and similar technologies are covered by the Cookie Policy. In summary: strictly necessary cookies are set without consent; analytics and any marketing technologies are set only with your consent, which you can withdraw at any time.
Server logs (IP address, browser, pages requested, timestamps) are kept for 30 days for security and troubleshooting, on the basis of our legitimate interest in keeping the Platform secure.
3. Who we share data with
3.1 We do not sell personal data. We share it only as follows:
| Recipient | Role | What |
|---|---|---|
| Hosts and advertisers | independent controllers | The contact details and company information needed to conclude and perform a booking. Advertiser identification data under section 2.2 is never shared. |
| Hostinger International Ltd. (web server) and Supabase, Inc. (database, sign-in and file storage) | processor | Everything stored on the Platform, at rest in the EEA |
| Brevo (Sendinblue) | processor | E-mail addresses and message content for transactional and marketing e-mail |
| Accountant, auditor, legal advisers | processors or independent controllers depending on role | As needed |
| Authorities | — | Where we are legally required to disclose: PTAC, the Competition Council, the Data State Inspectorate, the State Revenue Service, courts and law enforcement |
3.2 We have written data processing agreements with each of our processors, as Article 28 of the GDPR requires.
3.3 Transfers outside the EEA. We prefer providers that store data in the EEA. Where a provider processes data in the United States, we rely on the EU–US Data Privacy Framework where the provider is certified under it, and on the European Commission’s standard contractual clauses in every case as a fallback. Ask us and we will tell you which providers this affects and give you a copy of the safeguards.
4. How long we keep data
4.1 The tables above give the period for each category. Where several apply, the longest governs. The main drivers are:
- 5 years for anything with a financial trace — bookings, invoices and payment records. This comes from the Accounting Law and the Law on Taxes and Duties.
- 5 years for the advertiser identification data. The Advertising Law sets no period; we have aligned it with the accounting floor and with the period in which a supervisory authority might ask about a past advertisement.
- 10 years for accounting registers, and until the company ceases for annual accounts.
- 90 days after account closure for profile data with no financial trace, after which we delete or anonymise it.
4.2 We may keep data longer where a dispute, claim, investigation or legal obligation requires it, and only for as long as that requires.
5. Security
5.1 We use access controls, encryption in transit, hashed passwords, restricted administrative access, logging and regular backups. Advertiser identification data under section 2.2 is held with additional access restrictions.
5.2 If a personal data breach is likely to result in a risk to your rights and freedoms, we notify the Data State Inspectorate within 72 hours of becoming aware of it, and we tell you directly where the risk is high.
6. Automated decision-making
6.1 We do not make decisions producing legal or similarly significant effects about you solely by automated means. Automated checks may flag content or behaviour for review, but a person makes the decision to refuse content, suspend an account or terminate access, and you can respond to that decision under clause 6.6 of the Terms of Service.
7. Your rights
7.1 You have the right to:
- access the personal data we hold about you, and receive a copy;
- rectify data that is inaccurate or incomplete;
- erase data, where one of the grounds in Article 17 of the GDPR applies — note that we cannot erase data we are legally required to keep, in particular the advertiser identification data and financial records;
- restrict processing in the circumstances set out in Article 18;
- data portability for data you provided to us, processed by consent or under a contract, in a structured, commonly used, machine-readable format;
- object to processing based on our legitimate interests, including the monitoring described in section 2.5 — and to object to direct marketing at any time, which we will always honour without exception; and
- withdraw consent at any time, where processing is based on consent. Withdrawal does not affect processing carried out before it.
7.2 To exercise a right, write to [email protected]. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. We may ask you to confirm your identity.
7.3 You can also download your own data from your account at any time, as described in clause 8.3 of the Terms of Service.
7.4 Complaints. If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, dvi.gov.lv, and to seek a judicial remedy.
8. Children
8.1 The Platform is for business use and is not directed at children. We do not knowingly process the data of anyone under 18. If you believe we hold data about a child, tell us and we will delete it.
9. Changes to this Policy
9.1 We may change this Policy. We publish the current version here with its date, and we notify registered users of material changes by e-mail at least 15 days before they take effect.