Privacy Policy & Data Processing Notice

1. General Provisions & Scope

This Privacy Policy governs the processing of personal data by Vilamalinoto SIA (hereinafter referred to as “the Company”, “we”, “our”, or “us”) when providing enterprise IT advisory, cloud infrastructure architecture, high-availability database clustering, and computer resource management services.

We are committed to protecting the privacy, confidentiality, and integrity of all natural persons whose data is processed, in full compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR) and the Personal Data Processing Law of the Republic of Latvia (Fizisko personu datu apstrādes likums).

2. Categories of Personal Data Processed

We process only data that is strictly necessary for the performance of contracts and communication:

• Identification & Business Contact Data: Name, company name, corporate email address, business telephone number, and Telegram handle.
• Technical Infrastructure Specifications: Server inventory numbers, cloud region identifiers, CPU/RAM utilization telemetry, and network topology requirements provided during service audits.
• Transactional & Invoicing Data: Corporate billing details, bank account identifiers, SEPA payment confirmations, and signed bilateral NDA records.
• Connection & Security Telemetry: Anonymized server logs, IP addresses accessing client bastion gateways, and timestamped audit logs for incident response.

3. Legal Bases for Processing (Article 6 GDPR)

The processing of personal data is carried out strictly under the following legal bases:

4. Data Retention Periods

Personal data is retained only for the duration necessary to fulfill the stated purposes:

• Contractual & Bilateral NDA Records: Retained for 10 years following contract termination in accordance with the Latvian Commercial Law statute of limitations.
• Financial & Accounting Records: Retained for 5 years pursuant to the Law on Accounting of the Republic of Latvia.
• Technical Bastion Session Keys: Ephemeral keys expire automatically within 1 to 24 hours of session completion.

5. Your Rights as a Data Subject

Under the GDPR, you have the following enforceable rights:

6. Supervisory Authority & Complaints

If you consider that our processing of your personal data infringes applicable data protection regulations, you have the right to lodge a complaint with the lead supervisory authority:

7. Contacting the Data Protection Officer

To exercise any of your data rights or request our standard Data Processing Agreement (DPA), contact: