Privacy Notice

Who is responsible and how to contact us

SIA “PANDI BALT”, registration No. 40003271473, Mazā Alūksnes iela 7, Rīga, LV-1045, Latvia, is responsible for the website and information submitted directly through its forms. For privacy questions or to exercise your rights, contact our privacy contact Roman Rozkov at roman.rozkov@pandibalt.eu or use the General Enquiry form marked for privacy requests. Roman is our privacy contact; he is not described as a formally appointed Data Protection Officer.

Information, purposes and legal grounds

• Enquiries and business correspondence: names, contact details, company, message and correspondence are used to answer questions and manage the resulting contact. The ground is our legitimate interest in responding and conducting business, or steps you ask us to take before a contract where applicable.
• Instructions and claim submissions: contact details, company or principal, matter details, references, locations, documents and photographs are used to assess an instruction, contact you and, if accepted, handle the matter. The ground depends on the relationship and may be contractual steps, legitimate interests or a legal obligation. See the Claims Handling Privacy Notice for claim files and health information.
• Website operation and security: technical requests, IP addresses, timestamps and security events are used to deliver the website, prevent abuse and investigate faults. The ground is our legitimate interest in a secure, working service. Our forms use a session and Cloudflare Turnstile to protect submissions.
• Optional analytics: if you choose to allow it, Google Analytics uses online identifiers and usage information to help us understand website use. The ground is your consent. It does not load before you accept optional cookies. See our Cookie Policy.

The forms identify the fields needed to respond to or assess a submission. You are not required to use a website form, but without the necessary contact and matter information we may be unable to respond. Please do not send sensitive information unless it is relevant and necessary.

Sources and recipients

For website forms and direct contact, we normally obtain information from you. Claim files can also contain information received from other parties; their sources are explained in the claims notice.

Access is limited to people who need the information for their work. Depending on the purpose, information may be handled by our email and protected cloud provider Microsoft, website host Nano IT, and Cloudflare for form security and private document intake. For a matter, information may also be disclosed to the instructing principal and other parties where necessary and lawful, as described in the claims notice.

How long we keep information

We keep information for the longest period that is necessary and justified for its purpose, then delete or anonymise it unless another obligation applies. A General Enquiry or proposed instruction that does not become a matter is ordinarily kept for up to three years after the final substantive contact or decision. An accepted matter remains active while it is handled; ordinary closed claim records are normally kept for up to three years after final closure. A particular file may be kept for up to ten years when this is necessary and documented for a legal claim or another applicable obligation. Accounting records follow their separate statutory periods. Temporary website upload copies are handled separately from the working case file and should be removed after transfer; incomplete R2 uploads expire after one day.

Different legal or contractual periods may apply to a particular matter. The period is reviewed against the actual purpose and applicable mandate; ten years is not the default for every enquiry or claim.

Transfers and protection

We may coordinate matters with partners in Latvia, Lithuania and Estonia. Some technology providers or recipients in a particular matter may involve access from outside the European Economic Area. EU storage alone does not establish where every support or service activity takes place. Please contact our privacy contact for information on a specific transfer and its applicable safeguards.

We use appropriate organisational and technical measures, including restricted access and protected systems, to reduce the risk of unauthorised access, loss or disclosure.

Your rights

Depending on the circumstances and legal ground, you may request access, correction, deletion, restriction, portability or object to processing. Where processing relies on consent, you may withdraw it at any time; this does not affect earlier lawful processing. You can change analytics consent using “Cookie settings” in the footer. We may need to verify identity before acting on a request and may have to retain information where law or a legal claim requires it.

You may complain to Latvia’s Data State Inspectorate or another competent supervisory authority. Website forms do not automatically decide whether an instruction or claim is accepted.