Legal information
PRIVACY POLICY
Effective from: 28 September 2026
Last updated: 28 September 2026
1. General Information
1.1. The purpose of this Privacy Policy is to provide information on how SIA “Vintech” (hereinafter – Vintech, we, us, or the Controller) collects, uses, stores, protects, and otherwise processes personal data in connection with the use of the Digipēda website and Digipēda services.
1.2. Digipēda is an open-source intelligence or OSINT (Open Source Intelligence) service provided by Vintech, within the scope of which, depending on the purpose of the specific service, the following may be carried out:
investigation of an individual’s digital footprint;
collection and analysis of publicly available information;
audit of the client’s own digital footprint;
investigation of potential business partners and persons or organisations related to business activities;
verification, structuring, and analysis of information available in public sources;
preparation of a report or investigation report.
1.3. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation or GDPR), the Personal Data Processing Law of the Republic of Latvia, and other applicable laws and regulations.
1.4. This Privacy Policy applies both to visitors and clients of the Digipēda website and, to the relevant extent, to natural persons whose personal data may be processed within the scope of OSINT services provided by Digipēda.
2. Personal Data Controller
The personal data controller is:
SIA “Vintech”
Registration No.: 40203760284
Registered office: Zvanītāju iela 43A, Jēkabpils, Jēkabpils novads, LV-5201
Email for personal data protection matters: [email protected]
Where, within the scope of a specific service, Vintech processes personal data on behalf of another controller, for example, a client, Vintech’s role and the obligations of the parties are determined in the relevant service agreement or another applicable document.
3. Personal Data Processing Principles
When processing personal data, Vintech complies with the fundamental principles of personal data protection.
Personal data is:
processed lawfully, fairly, and transparently;
collected for specific and lawful purposes;
processed only to the extent necessary to achieve the relevant purpose;
kept accurate and up to date as far as possible;
retained no longer than necessary for the relevant processing purpose;
protected against unauthorised access, disclosure, loss, alteration, or destruction.
The fact that information about an individual is publicly available on the internet does not in itself mean that such information may be used without restriction or for any purpose.
4. Categories of Personal Data We May Process
Depending on the individual’s relationship with Vintech and the service used, we may process different categories of personal data.
4.1. Technical Data of Website Visitors
When visiting the Digipēda website, the following may be processed for the technical operation and security of the website:
IP address;
device and browser information;
operating system;
date and time of the request;
sections of the website visited;
server log information;
technical information regarding errors and connections.
4.2. Communication and Client Data
If an individual contacts Vintech, we may process:
first name and surname;
email address;
telephone number, if provided;
company name and representative’s position;
content of the message sent;
correspondence information;
information about the service of interest.
4.3. Contractual and Payment Data
When a service is ordered, the following may be processed:
identification data of the client or its representative;
contact information;
contract information;
information about the service ordered;
invoice and payment information;
information required for accounting documents.
4.4. Data Required for OSINT Investigations
Depending on the purpose and scope of the investigation, the following may be processed, for example:
first name and surname;
previously used names or publicly used pseudonyms;
usernames;
publicly available contact information;
professional and employment information;
publicly available educational information;
positions and participation in companies or organisations;
publicly available business information;
information from social networks and other public profiles;
publicly published photographs and other content;
publicly available comments, publications, and statements;
information contained in public registers;
information from media sources;
information published on professional platforms;
publicly available links between individuals, companies, and organisations;
other data objectively necessary for the specific purpose of the investigation.
The scope of data processed is determined according to the purpose, necessity, and proportionality of the specific assignment.
5. Sources of Personal Data
Personal data may be obtained:
5.1. Directly from the Individual
For example:
by sending us an email;
by requesting information about a service;
by entering into a service agreement;
by providing Vintech with information for a digital footprint audit.
5.2. From the Client
When carrying out an investigation ordered by a client, the client may be required to provide initial information that enables the subject of the investigation to be identified.
5.3. From Publicly Available Sources
Within the scope of OSINT services, information may be obtained, for example, from:
internet search engines;
public state and municipal registers;
company registers;
websites of companies and organisations;
social networks and professional platforms;
public forums;
news portals and other media;
publicly available databases;
web archives;
public publications;
other lawfully accessible open sources.
Vintech does not use unauthorised access to information systems, circumvention of security mechanisms, or other unlawful methods to obtain personal data.
6. Purposes and Legal Bases for Personal Data Processing
6.1. Communication with Potential Clients
Personal data is processed in order to:
respond to enquiries;
provide information about services;
prepare an offer;
agree on the potential provision of services.
Depending on the specific situation, the legal basis is:
steps taken prior to entering into a contract;
Vintech’s legitimate interests in ensuring communication and conducting business activities.
6.2. Entering into and Performing a Service Agreement
Personal data is processed in order to:
identify the client;
enter into an agreement;
perform the client’s order;
prepare and deliver the result of the service;
administer payments.
The legal basis is entering into and performing a contract.
6.3. Accounting and Compliance with Legal Obligations
Personal data is processed in order to comply with Vintech’s applicable accounting, tax, and other statutory obligations.
The legal basis is compliance with Vintech’s legal obligations.
6.4. Audit of an Individual’s Own Digital Footprint
If a natural person orders an investigation of their own digital footprint, the necessary personal data is processed primarily for the performance of the service agreement.
As a result of the investigation, Vintech compiles and structures information about the respective person available in public sources.
6.5. Investigation of a Potential Business Partner or Another Person
Where Vintech acts as a personal data controller and the investigation is carried out in order to assess the reliability of a potential business partner, identify risks related to cooperation, verify publicly available information relevant to the client, or protect other lawful commercial interests, processing may in certain cases be based on the legitimate interests of Vintech or a third party.
Before carrying out such processing, Vintech assesses:
whether a specific and lawful legitimate interest exists;
whether the processing of personal data is necessary to achieve that interest;
whether the same purpose can be achieved by means that interfere less with the individual’s privacy;
whether the interests, rights, and fundamental freedoms of the data subject override the relevant legitimate interest.
The mere fact that information is publicly available is not considered a sufficient basis for processing personal data.
6.6. IT Systems and Website Security
Technical data may be processed in order to:
ensure the operation of the website;
identify technical issues;
prevent malicious requests;
protect Vintech’s information systems.
The legal basis is Vintech’s legitimate interest in ensuring the security and continuity of its systems.
6.7. Protection of Legal Claims
Personal data may be retained or otherwise processed where necessary for the protection of Vintech’s rights and lawful interests, or for the establishment, exercise, or defence of legal claims.
7. Special Categories of Personal Data
The purpose of Vintech’s OSINT investigations is not to systematically obtain information concerning an individual’s:
racial or ethnic origin;
political opinions;
religious or philosophical beliefs;
trade union membership;
genetic data;
health data;
biometric data for the purpose of uniquely identifying a person;
sex life or sexual orientation.
If such information is identified in a public source, its further use is assessed separately.
Such data is included in an investigation result only where an applicable legal basis exists, the information is objectively necessary for the specific lawful purpose of the investigation, and its processing complies with applicable laws and regulations.
8. Information Concerning Criminal Convictions and Offences
Information concerning criminal convictions and offences is subject to a specific personal data protection regime.
Vintech does not process such information merely because it is technically available on the internet.
If such information is identified during an investigation, Vintech assesses, before including it in investigation materials, whether an appropriate legal basis exists for processing and disclosing it to the client.
9. Accuracy of Information and OSINT Limitations
Information available in public sources may be:
outdated;
incomplete;
inaccurate;
taken out of context;
published about another person with a similar identity;
created by third parties and unverified.
Vintech, insofar as reasonably possible within the scope of the specific assignment, seeks to compare information across multiple sources and distinguish established facts from assumptions or unverified information.
The fact that information has been found in a public source does not automatically mean that Vintech confirms its accuracy.
10. Automated Tools and Artificial Intelligence
In the provision of services, Vintech may use automated technical tools for searching, collecting, structuring, comparing, or analysing information and text.
Where artificial intelligence or other automated analysis tools are used, Vintech takes appropriate measures to protect the personal data being processed and to limit the transfer of such data to the minimum necessary.
Vintech does not make decisions about individuals based solely on automated processing of personal data that produce legal effects concerning them or similarly significantly affect them, unless an appropriate legal basis and safeguards required by applicable laws are in place.
An OSINT report is an informational analytical material. The final decision regarding cooperation with an individual or company is made by the client, not by the Digipēda automated system.
11. Recipients of Personal Data
Vintech may disclose personal data only to the extent necessary for the relevant purpose.
Recipients of personal data may include:
Vintech employees and authorised persons;
the client who ordered the service;
IT infrastructure and hosting service providers;
email and communication service providers;
data storage or backup service providers;
accounting service providers;
legal and other professional advisers;
state or municipal authorities where disclosure is required by law;
law enforcement authorities and courts in cases provided for by law.
OSINT investigation results are not made publicly available merely because the underlying data was obtained from public sources.
12. Transfers of Personal Data Outside the European Union and EEA
Vintech, where possible, uses service providers that process personal data within the European Union or European Economic Area.
If personal data is transferred to a service provider in a country outside the EU or EEA, Vintech ensures that an appropriate transfer mechanism provided for under the GDPR is in place, for example:
a European Commission adequacy decision;
European Commission-approved Standard Contractual Clauses;
another transfer mechanism provided for under the GDPR.
13. Personal Data Retention Periods
Personal data is not retained longer than necessary for the purpose for which it was collected.
The following principles generally apply:
Communication Before Ordering a Service
Correspondence and related data may be retained for up to 12 months after the last substantive communication unless another legal basis requires longer retention.
Contracts, Invoices, and Accounting Documents
These are retained for the periods required by applicable laws and regulations.
OSINT Investigation Working Materials
Working files, search results, interim findings, and downloaded materials are deleted or anonymised once they are no longer required for the performance of the service, but generally no later than 90 days after delivery of the final report, unless otherwise specified in the agreement or unless the data is required for the protection of legal claims.
Final Investigation Report
The retention period of the final report is determined in accordance with the service agreement, the necessity of processing, and applicable legal obligations.
Website Technical Logs
These are retained only for as long as necessary for system security, technical issue analysis, and prevention of misuse.
Upon expiry of the retention period, data is deleted, anonymised, or otherwise made irreversibly non-identifiable unless otherwise required by law.
14. Personal Data Security
Vintech uses appropriate technical and organisational security measures to protect personal data.
Depending on the type of processing, such measures may include:
restriction of access rights;
user authentication;
encryption of data during transmission;
regular updating of systems and software;
backups;
access log monitoring;
limiting access by employees and partners according to necessity;
data minimisation;
secure data deletion;
other proportionate information security measures.
No information system can guarantee absolute security; however, Vintech takes reasonable measures to reduce the risks of unauthorised access, data loss, or other unlawful processing.
15. Information Where Personal Data Has Not Been Obtained from the Individual
Due to the nature of OSINT investigations, Vintech may process personal data obtained not directly from the individual concerned but from publicly available sources or from the client.
Where Vintech acts as the personal data controller in the relevant processing, the obligation to inform the individual is assessed in accordance with Article 14 of the GDPR.
Where the exemptions provided for by law do not apply, the data subject is provided with the information required by applicable laws and within the applicable time limits.
Where an exemption from the individual information obligation under the GDPR applies, Vintech documents the justification for relying on the relevant exemption and, where necessary, implements other safeguards to protect the rights and interests of the data subject.
This Privacy Policy itself is not considered an automatic basis for relying on exemptions provided for under Article 14 of the GDPR.
16. Rights of the Data Subject
In accordance with applicable laws and regulations, an individual may have the following rights:
16.1. Right to Information
An individual may determine whether Vintech processes their personal data and for what purposes.
16.2. Right of Access
An individual may request access to personal data processed by Vintech concerning them.
16.3. Right to Rectification
If data held by Vintech is inaccurate or incomplete, the individual may request that it be corrected or supplemented.
16.4. Right to Erasure
In cases provided for by law, an individual may request the deletion of their personal data.
The right to erasure is not absolute and may not apply where continued retention of personal data is necessary for compliance with a legal obligation or for other reasons provided for under the GDPR.
16.5. Right to Restriction of Processing
In cases provided for by law, an individual may request restriction of the processing of their personal data.
16.6. Right to Object to Processing
Where personal data is processed on the basis of legitimate interests, an individual has the right, on grounds relating to their particular situation, to object to such processing.
Upon receiving an objection, Vintech assesses whether there are compelling legitimate grounds for continuing the processing which override the interests, rights, and freedoms of the data subject, or whether the processing is necessary for the establishment, exercise, or defence of legal claims.
16.7. Right to Data Portability
Where the conditions set out in the GDPR are met, an individual may have the right to receive their personal data in a structured, commonly used, and machine-readable format.
16.8. Right to Withdraw Consent
Where processing of personal data is based on consent, the individual may withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
17. How to Exercise Data Subject Rights
To exercise their rights or obtain information regarding the processing of personal data, an individual may contact Vintech:
Email: [email protected]
The request should preferably describe as precisely as possible:
which right the individual wishes to exercise;
which processing of personal data the request concerns;
information that enables Vintech to identify the relevant data.
To protect personal data from disclosure to unauthorised persons, Vintech may reasonably request additional information to verify the identity of the individual.
Vintech responds to data subject requests within the time limits established by the GDPR.
18. Right to Lodge a Complaint
If an individual believes that the processing of their personal data does not comply with applicable legal requirements, the individual is encouraged to contact Vintech first so that the matter can be assessed and, where necessary, remedied.
The individual also has the right to lodge a complaint with the Latvian data protection supervisory authority:
Data State Inspectorate of Latvia
Current contact information is available on the official website of the Data State Inspectorate.
19. Cookies
The Digipēda website may use technically necessary cookies or similar technologies required for the operation and security of the website.
If the website uses analytics, marketing, advertising, or other cookies requiring user consent, such cookies are not activated before the relevant consent has been obtained.
Detailed information regarding:
cookies used;
their providers;
purposes of use;
retention periods;
giving and withdrawing consent
is provided in a separate Cookie Policy.
20. Third-Party Websites
The Digipēda website may contain links to third-party websites.
Vintech is not responsible for the personal data processing practices of third-party websites. Before providing personal data to another website, users are advised to review that website’s privacy policy.
21. Changes to the Privacy Policy
Vintech may periodically review and amend this Privacy Policy, for example:
where services change;
where new technologies are introduced;
where personal data processing procedures change;
where legal requirements or guidance from supervisory authorities change.
The current version of the Privacy Policy is published on the Digipēda website, indicating the date of its latest update.
In the event of material changes, Vintech may use additional means of notification where appropriate having regard to the nature of the changes.
22. Contact Information
For questions concerning this Privacy Policy, personal data processing, or the exercise of data subject rights:
SIA “Vintech”
Digipēda
Email: [email protected]
Registration No.: 40203760284
Registered office: Zvanītāju iela 43A, Jēkabpils, Jēkabpils novads, LV-5201