Privacy policy

1. Who processes the data

The website firmatlas.eu and its API (Firmatlas, "we") are run by the Firmatlas administration. All questions about personal data, including requests for access, correction and deletion, are handled through the form at /contact/.

2. When you simply read the site

No registration is needed to read the site. We use no advertising or analytics trackers, do not sell data and do not build visitor profiles.

To understand which pages are useful, the site counts visits with its own counter, which sends the page address and the event type. The server recognises unique visitors by a hash of the IP address and browser with a salt that changes every day; the counter does not store the IP address, and the hash cannot be linked to you the next day.

Like any web server, our server and delivery network keep technical logs (IP address, time, requested address, browser). They are needed for security and troubleshooting and are kept for a limited time.

3. Account

If you create an account, we store:

• your email address and interface language;
• the public part of your passkey — the secret stays on your device, and we hold no passwords;
• sessions and sign-in links: time, IP address and browser — so you can see active sign-ins and close them;
• API keys, the companies you follow and, if you provided it, your own company.

The basis is the performance of the agreement on using the account. The data is kept while the account exists. You can have the account and related data deleted on request via /contact/.

4. Messages through the form

The form at /contact/ sends your name, email address, company, subject and message, as well as your IP address and browser to protect against abuse. Before sending, the form is checked by Cloudflare Turnstile.

The basis is our legitimate interest in replying and correcting data. A message is kept as long as needed to answer it and keep a record of corrections.

5. Emails

We send sign-in links and, to account holders, emails about the companies they follow and a monthly report on their own company. You can opt out of regular emails in your account settings or via the link in the email. We send no marketing emails.

6. People in company data

Company pages show the names of board members, members and shareholders as the Latvian Register of Enterprises publishes them in its open data. We show them because management and ownership matter when checking a counterparty (legitimate interest and the public nature of the register).

We do not store personal codes or dates of birth, do not link people across companies by name and do not publish beneficial ownership data. If you see inaccurate information about yourself or object to it being shown, write to us via /contact/.

7. Who we share data with

Only with providers the site cannot work without, and only to the extent they need:

• our hosting provider — the servers the site runs on;
• Cloudflare — site delivery and form checks (Turnstile);
• Resend — email delivery;
• Esri (ArcGIS) — the map basemap: your browser loads its tiles directly from Esri's servers;
• Stripe — only if you choose to support the project: payment happens on Stripe's side, and we receive no payment details.

Where a provider is outside the EEA, transfers rely on the mechanisms provided by the GDPR (such as standard contractual clauses).

8. Cookies and browser storage

The site uses only necessary cookies: to keep you signed in and to make the site work. The full list and your choice are on /cookies/.

9. Your rights

Under the GDPR you may access your data, correct it, delete it, restrict or object to its processing, and receive it in a portable format. Send your request via /contact/; we reply within one month.

You may also lodge a complaint with a supervisory authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija).

10. Changes

We update this policy when our processing changes. The current version and its date are always published on this page.