Privacy Policy

2. What we collect

We collect a small amount of personal data — only what is necessary to operate the site and respond to enquiries.

Server access logs. Our web server records each request made to this site: your IP address, the browser and operating system your request identifies itself as, the page you requested, whether it was served successfully, and the time. These logs are used to operate the site, mitigate abuse, and meet our security obligations.

Visitor measurement derived from those logs. From the access logs we produce two things for our own operations team. The first is a set of per-day totals — how many requests each page received, and how much of our traffic came from real people rather than from automated crawlers. The second is a per-day list of the individual visits identified as human, showing which pages were read in what order, the country the visit came from, and the site or search that referred it.

That list does not contain your IP address. Each visit is recorded under a pseudonym that is derived from your IP address using a secret we hold and that we cannot reverse to recover the address. The pseudonym is regenerated every day, so the same person visiting on two different days appears as two unrelated entries with no way to connect them. The list is kept for a limited period and then automatically deleted (see Retention below), and it is visible only to our own operations team.

Email correspondence. When you email us at arnis@bargo.lv or gunars@bargo.lv, we receive your email address and the content of your message. We process this to respond to your enquiry and, where you become a customer, to manage the engagement. Mail to and from our @bargo.lv addresses is delivered through Google Workspace (described in Section 4).

Cookies. We set a small number of first-party cookies. All of them are set and read only by us, never shared with anyone else, and none of them can follow you to another website. They fall into two groups:

• Strictly necessary — cookies without which the site cannot do what you asked of it. One of these records the choice you made on the cookie banner, including a refusal, so that we do not ask again on every page and so that we can honour a decision to decline. It stores your choice and nothing else: no identifier and no personal data.
• Analytics — a single cookie set only if you accept analytics on the banner. It holds one randomly generated identifier and nothing else: no name, no email, no IP address, no profile. Its only purpose is so that a return visit is recognised as the same browser rather than counted as a new visitor, which is what makes our visitor numbers meaningful rather than inflated. Its lifetime is capped at 13 months. It is deleted immediately if you withdraw consent via "Cookie preferences" in the footer, and you can clear it at any time from your browser's cookie controls.

We do not send visitor data to any third-party analytics company, advertising network, or tracking-pixel provider, and we do not use device-fingerprinting techniques. The optional analytics described below runs entirely on our own infrastructure — it is not a third party, and it only activates with your consent.

Aggregate site statistics. We process the access logs described above into per-day totals — requests per page, visitor counts by country derived from IP geolocation, counts by the language your browser asks for, and a median time spent on the site. This happens on our own server and stores only totals, never per-visitor rows. It is visible only to our own operations team.

Time-on-page measurement. A small piece of first-party code measures how long each page is actually open and visible, and reports that duration back to us. What it sends is the page address, a number of milliseconds, and a two-letter country code derived from your IP address at that moment — the address itself is never stored. It sets no cookie and creates no identifier that persists beyond the single page view, so it cannot recognise you on any other page or on any later visit. These measurements are kept only briefly (see Retention below), and we read only per-page and per-country averages from them. It is our own measurement, not a tracking pixel and not a third party. It honours your browser's Do-Not-Track setting — when that is on, nothing is sent.

Optional analytics (consent-based, self-hosted). With your consent — given via the cookie banner, off by default — we run an open-source analytics tool entirely on our own EU infrastructure (the same provider named in Section 4; it adds no new processor or sub-processor). It records which pages you open and when, how long the visit lasts, the site or search that referred you, any campaign tag in the link you followed, and coarse technical context: browser, operating system, device type, screen size, language, and country resolved from your IP address, which is not stored. Unlike the measurements above, these events are tied together by the analytics cookie described earlier in this section, so a repeat visit is recognised as the same browser. We do not record your screen, your mouse movements, your keystrokes, or anything you type. It is off for every visitor by default; it starts only if you click "Accept" on the cookie banner, and you can withdraw consent at any time via "Cookie preferences" in the footer — withdrawing stops collection immediately, deletes the analytics cookie, and reloads the page to confirm it has stopped. None of this data is shared with any third party; it is visible only to our own operations team, on our own server.

3. Why we process it (lawful basis)

We rely on GDPR Article 6(1) bases:

• (a) Consent — for the optional analytics described in Section 2. You give this consent by clicking "Accept" on the cookie banner; you may withdraw it at any time via "Cookie preferences" in the footer, with no effect on the lawfulness of processing carried out before withdrawal.
• (b) Steps prior to entering into a contract — when you contact us about a potential engagement.
• (f) Legitimate interests — for server logs (security, abuse mitigation, operational integrity), the aggregate site statistics, and the time-on-page measurement described in Section 2 — none of which identify you individually or require consent under ePrivacy Article 5(3), because they set no cookie and store no lasting identifier — and for responding to general enquiries.

4. Who receives your data (third parties)

Hetzner Cloud GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — our hosting provider. Acts as our data processor under GDPR Article 28. Hetzner stores the site files, runs the server, and holds the access logs in the EU. The optional analytics described in Section 2 also runs on this same infrastructure — it is not a separate processor.

Google LLC (Google Workspace) (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — our business email provider. Acts as our data processor under GDPR Article 28 governed by Google's Workspace Data Processing Amendment. Google receives, stores, and processes the content of emails sent to and from our @bargo.lv addresses, including sender address, headers, attachments, and the message body. EU-region data residency is configured where the Workspace plan permits.

No other third parties receive your data from us.

5. International transfers

Email content processed via Google Workspace (Section 4) may transit and be stored on Google infrastructure in the United States and other jurisdictions where Google operates. The legal basis is the EU-US Data Privacy Framework combined with the Standard Contractual Clauses incorporated by reference in the Workspace Data Processing Amendment.

All other data stays within the EU.

6. Retention

• Server access logs: retained for up to 30 days, then deleted.
• Time-on-page measurements: retained for up to 40 days, then automatically deleted.
• Per-day totals and the pseudonymous visit list: retained for up to 40 days, then automatically deleted. Because the pseudonym is regenerated daily, visits cannot be linked from one day to the next even within that window.
• Optional analytics (if you consent): page-view and visit records are retained for up to 13 months on our own server, then automatically deleted — the same 13-month cap as the analytics cookie, so no record outlives the identifier that ties it together. Withdrawing consent stops collection immediately and deletes the cookie; it does not retroactively delete visits already recorded.
• Cookie-banner consent records: we keep an anonymous log of consent decisions — the category, whether it was granted or withdrawn, the time, and which version of the banner was shown — with no IP address and no visitor identifier. This is how we can demonstrate that consent was actually asked for and honoured. Retained for 24 months, then deleted.
• Email correspondence: retained for as long as the engagement conversation is active, plus up to 5 years after the last contact for engagement-related records (legitimate interest in defending claims and meeting Latvian commercial-record retention requirements). General enquiries that do not become engagements are deleted within 12 months.

7. Your rights

Under GDPR Articles 15–22 you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing in certain circumstances
• Portability — receive your data in a machine-readable format
• Object to processing based on legitimate interests

To exercise any of these rights, email gunars@bargo.lv. We will respond within one month (extendable by two further months for complex requests, per Article 12(3)).

8. Right to complain

You have the right to lodge a complaint with the Latvian data protection authority:

Datu valsts inspekcija
Elijas iela 17, Rīga, LV-1050, Latvia
Web: www.dvi.gov.lv

9. Changes to this policy

If we change this policy materially, we will update the "Last updated" date at the top and, where appropriate, contact people we have an active conversation with about the change.

10. Contact

Privacy-related enquiries: gunars@bargo.lv