Privacy policy

Effective from 26 October 2026.

This policy explains what personal data SIA «PP Cuibes16 Hospitality» processes on the website cuibes16.wdteam.co, why we do so, who we share it with and what your rights are. If anything remains unclear, write to cuibes16@ppproperty.lv.

1. Who processes your data

Controller	SIA «PP Cuibes16 Hospitality»
Registration number	50203780051
VAT registration number	LV50203780051
Address	Čuibes iela 16, Rīga, LV-1063
E-mail	cuibes16@ppproperty.lv
Phone	+371 22159392

We have not appointed a data protection officer, as our activities do not meet the criteria of Article 37 of the General Data Protection Regulation (GDPR). For privacy-related questions, write to cuibes16@ppproperty.lv. We reply within one month.

2. What data we process, why and for how long

2.1. Visiting the website

Every visit leaves a technical record in the web server logs: IP address, date and time, requested address, referring address, browser and device description, response code and amount of data transferred.

• Purpose: operating the website, diagnosing errors, protecting against attacks.
• Legal basis: our legitimate interest in maintaining a secure and functional website (Article 6(1)(f) GDPR).
• Retention period: 14 days, after which the records are deleted automatically. In the event of a security incident, we keep the relevant records until the investigation is completed.

2.2. Contact form

In the website’s contact form you enter your name, contact details (e-mail or phone) and a message.

• Purpose: to answer your question, prepare a quote and agree on a service.
• Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR). If you write on behalf of a company, the basis is our legitimate interest in responding to the enquiry (f).
• Retention period: the message is delivered to our e-mail. We keep it for up to 24 months after our last communication. If we start working together, the data moves to the regime described in section 2.4.

2.3. Booking request

In the booking form you enter details of your stay (room type, number of people, dates, whether you wish to register your residence) and the data needed to prepare the contract. For a private person: first name, surname, date of birth, citizenship, personal code or identity document number, home address, phone number, e-mail. For a company: name, registration and VAT number, legal address, authorised signatory, contact person, phone number, e-mail and, if provided, the list of residents (first name, surname, citizenship).

• Purpose: to review the request, confirm the bed, and prepare and conclude the accommodation contract.
• Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); for residents’ data provided by a company — legitimate interest in fulfilling the company’s request (point (f)).
• Retention period: the request is stored in the website’s administration area and automatically deleted after 180 days; a copy is sent to our e-mail. If a contract is concluded, the data are handled as described in section 2.4.

2.4. Clients and business partners

We process the names and contact details of contact persons, contract and invoice data, and correspondence.

• Purpose: performance of contracts, payments, accounting, defence of legal claims.
• Legal basis: performance of a contract (b), legal obligation (c), legitimate interests (f).
• Retention period: accounting documents for 5 years; contracts and related correspondence for 10 years after the contract ends; other correspondence for up to 24 months.

2.5. Cookie consent record

When you make a choice in the cookie banner, a proof of consent is stored: an identifier, the permitted categories, the banner version, the language, the page address, an anonymised IP address (the last part replaced with zeros), a browser description and the time. The legal basis is our legal obligation to be able to demonstrate consent (Article 7(1) GDPR). Retention period: up to 24 months. More details: Cookie Policy.

2.6. Feedback and bug report button

At the edge of the website there is a button you can use to send us feedback or report an error. When you send a report, we store the text you entered, your contact details (if you provide them), the page address, technical data about your browser and screen and, if you choose so, a screenshot. Legal basis: our legitimate interest in improving the website (f). Retention period: up to 24 months.

3. Who we share data with

We do not sell personal data or share it for advertising purposes. Data is accessible only to employees who need it for their work and to the following service providers (processors):

Recipient	Purpose	Location
WD Team, SIA (WebDev)	Website development, hosting and technical maintenance	Latvia (EU)
Hetzner Online GmbH	Server and data centre hosting the website and its database	Germany (EU)
Cloudflare, Inc.	Domain Name System (DNS)	USA / global network
Twilio Inc. (SendGrid)	Delivery of e-mails sent by the website	USA
Bugzio (WD Team, SIA)	Cookie consent management, feedback and bug reports; server in Germany	Germany (EU)
Google Ireland Limited / Google LLC	Google Maps map (only after consent)	Ireland (EU) / USA
Accounting service provider	Invoicing and bookkeeping	Latvia (EU)

We may also disclose data to public authorities where required by law, and to legal advisers where necessary to defend legal claims.

4. Transfers of data outside the EU/EEA

Some of our service providers are located in the USA. When transferring data, we rely on the European Commission’s adequacy decision on the EU-U.S. Data Privacy Framework and/or on standard contractual clauses with supplementary safeguards (encryption in transit, data minimisation).

5. Your rights

You have the right to:

• access your data and receive a copy of it;
• have inaccurate data rectified;
• have your data erased if it is no longer needed or the processing is unlawful;
• restrict processing;
• object to processing based on legitimate interests;
• receive your data in a portable format;
• withdraw your consent at any time where processing is based on consent;
• lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija) (Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv).

To exercise any of these rights, write to cuibes16@ppproperty.lv. We reply within one month; in complex cases we may extend this period by a further two months, in which case we will inform you.

6. Security

The website operates only over an encrypted HTTPS connection. The server has a firewall and receives regular security updates; administrative access is restricted. Backups are stored in the EU. If a personal data breach were to occur that poses a high risk to your rights, we will inform you and the Data State Inspectorate within the time limits set by law.

7. Children’s data

The website is not intended for children under the age of 13. If we learn that we have collected data from a younger child without parental consent, we will delete it.

8. Automated decision-making

We do not carry out profiling and do not make decisions that have legal effects on you based solely on automated processing.

9. Changes

We update this policy from time to time. The current version is always available at this address, with the effective date shown at the top of the page.

10. Contact

SIA «PP Cuibes16 Hospitality» · Čuibes iela 16, Rīga, LV-1063 · cuibes16@ppproperty.lv · +371 22159392