Privacy policy
Effective from: 27 October 2026 · Version: 2
1. Controller
The controller of personal data is SIA "ĒMK Īpašumi", registration No. 50203738181, registered address Kalnciema iela 101, Riga, LV-1046, Latvia.
Contact for personal data matters: emk@emk.pro, phone +371 26 441 195. Data protection is the responsibility of the company's management; no data protection officer has been appointed, as the company's activities do not fall under the cases set out in Article 37 GDPR.
2. What data we process, why and on what legal basis
| What | Data | Purpose | Legal basis (Article 6(1) GDPR) |
|---|---|---|---|
| Enquiries from the website (contact, viewing request, selling a property, similar properties) | name, phone, e-mail (optional), message, preferred time, property address (for selling), interest (buy/sell/rent), chosen agent, the property you are asking about | to respond to your request, arrange a viewing, provide real estate brokerage services | steps taken at your request prior to entering into a contract - point (b) |
| Notice record with the enquiry | time, privacy policy version, IP address | to demonstrate that you were informed about data processing | our legitimate interests (accountability) - (f) |
| Agent attribution (when arriving via an agent's personal link) | which agent's link was opened; with your consent to functional cookies - the emk_agent cookie (90 days) | to pass the enquiry to the agent who referred you and calculate commission correctly | legitimate interests - (f); for the cookie - your consent (see the Cookie policy) |
| Advertising source | utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid from the address you arrived through (stored with the enquiry, not passed to advertising platforms) | to understand which advertising channels work | legitimate interests - (f) |
| Viewings | time, place and property of the viewing, your name and phone in the agent's calendar; a confirmation e-mail with a calendar file (.ics) if you provided an e-mail | to organise the viewing | (b) |
| Deals and invoices | deal data, price, commission; on the invoice - name or company name, registration No., address | to provide the service, issue an invoice, accounting | (b) and legal obligation - (c) (Accounting Law) |
| Customer due diligence (AML) | first name, surname, personal code (stored encrypted), identity document number and validity, copy of the document, result of the check | requirements of the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing | legal obligation - (c) |
| E-mail correspondence | your messages to @emk.pro addresses and our replies, attachments; if the e-mail matches an enquiry - linked to that enquiry | to communicate with you | (b) / (f) |
| Website statistics | with your consent - Google Analytics 4 via Google Tag Manager | visit statistics | your consent - (a); without consent these tools are not loaded |
| Technical data | IP address and browser data in server logs; IP address briefly (10 min) in memory to limit abuse of forms | security, operation of the service | (f) |
| CRM users (ĒMK agents and staff) | name, e-mail, phone, photo, title, role, personal link identifier; data visible on the public website (if the profile is public); acceptances of legal notices (time, IP, browser); if connected - Google Calendar connection (keys stored encrypted); if the user turns on notifications - the device push subscription (push service address, encryption keys, device name, browser) and notification settings; activity history (who changed what and when) | user account, organisation of work, notifications about new enquiries, e-mails and viewings, security, accountability for changes | cooperation agreement - (b); legitimate interests - (f); publication on the team page - under the cooperation agreement, photo - with the agent's consent |
No automated decision-making with legal effects takes place. Data from customer documents is not passed to artificial intelligence tools.
Artificial intelligence. The CRM uses an AI tool (Anthropic Claude) to draft listing texts. No customer personal data is passed to it.
3. Who we share data with (processors)
Data is processed on our behalf by:
| Processor | What it does | Where |
|---|---|---|
| Supabase | database, user authentication, file storage (including documents and invoices) | EU - Frankfurt, Germany |
| Vercel Inc. | hosting of the website and CRM, server logs | servers in Frankfurt; US company, worldwide content delivery |
| Resend | sending and receiving e-mail (notifications, confirmations, invoices, correspondence) | EU - Ireland; US company |
| Google Ireland Ltd / Google LLC | Google Analytics 4 and Tag Manager (only with consent); Google Calendar (agents' viewing calendar); Google Maps (map, only after a click) | EU / US |
| Anthropic PBC | AI for listing texts (without customer personal data) | US |
A data processing agreement is in place with each processor. Agents use only company Google accounts for the viewing calendar.
Push notifications for CRM users. If a CRM user turns on notifications on a phone or computer, they are delivered by the push service of that user's browser or device: Google (Firebase Cloud Messaging - Chrome, Android), Apple (Safari, iPhone, iPad), Mozilla (Firefox) or Microsoft (Edge). The service is determined by the user's browser. The notification content is sent encrypted (Web Push standard) - the push service cannot read it and sees only the device subscription address and the delivery time (EU / US). By default a notification contains no customer personal data: the lock screen shows only the type of event (for example "New enquiry", "New e-mail" and the mailbox); the customer's name and the e-mail subject are shown only if the user turns on the preview.
We may also disclose data to public authorities where required by law, and to the other party of a deal, a notary or a bank to the extent necessary for the deal.
4. Transfers outside the EU
Some processors are US companies. Transfers take place with the safeguards provided by the GDPR - the EU-US Data Privacy Framework (where the company is certified) and/or the European Commission's standard contractual clauses (Articles 45 and 46 GDPR). The database and files are stored in the EU (Frankfurt).
5. How long we keep data
| Data | Period |
|---|---|
| Enquiries that did not result in a deal | 24 months after the last contact, then deleted automatically |
| Deals, customer due diligence (AML) data and documents | 5 years after the end of the business relationship, then destroyed (Section 37 of the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing) |
| Invoices and other accounting source documents | 5 years (Section 28 of the Accounting Law) |
| Notice records (time, version, IP) | as long as the related enquiry or deal, no longer than 5 years |
| E-mail correspondence | 24 months; if related to a deal - 5 years; deleted messages in the trash - 30 days |
| Activity history (audit log) | 5 years |
| CRM user accounts | for the duration of cooperation; after it ends the account is deactivated immediately and personal data (contacts, photo) anonymised within 12 months, except what is needed in deals and the audit log |
| Push notification subscriptions and settings | until the user turns notifications off, signs out of the CRM on that device or the push service reports the subscription as invalid; deleted immediately when the account is deactivated or suspended |
| Uploaded but unprocessed photo originals; empty property drafts | 24 hours |
| IP for limiting abuse of forms | 10 minutes, in server memory only |
| Server logs (Vercel) | a few days, according to Vercel's terms of service |
| Google Analytics data | 14 months |
6. Your rights
You have the right to: access your data; rectify inaccurate data; request erasure; restrict processing; object to processing based on legitimate interests; receive your data in a portable format; withdraw consent at any time (this does not affect the lawfulness of earlier processing; for cookies - "Cookie settings" in the website footer).
Data that must be kept by law (AML, accounting) cannot be erased before the statutory period ends.
Send your request to emk@emk.pro. We respond within one month (Article 12(3) GDPR). To protect your data, we may ask you to confirm your identity.
If you believe your data is processed unlawfully, you may lodge a complaint with the Data State Inspectorate of Latvia: Elijas iela 17, Riga, LV-1050, phone +371 67223131, pasts@dvi.gov.lv, www.dvi.gov.lv. We encourage you to contact us first.
7. Changes
We may change this policy if our processing changes. The current version is always available on the website; material changes are marked with a date.