Privacy Policy
Version: 1.0. Updated and effective from 26 October 2026.
1. Companies and contact
This policy concerns gwhome.lv, enquiries relating to GW120 SG RoofLight, professional communications and customer relationship records (CRM). It is not an employee privacy notice.
The following details have been checked against the Latvian Enterprise Register open dataset:
- SIA “Glass & Wood”, registration number 40003657223, registered office: “Virši”, Skudras, Vērēmu pagasts, Rēzeknes novads, LV-4604, Latvia. Design and manufacturing business. Ikšķiles iela 4, Ogre is the operating/contact address shown on the website, rather than the registered office stated here.
- SIA “GW home”, registration number 40103802897, registered office: “Visvalži”, Skārduciems, Babītes pagasts, Mārupes novads, LV-2107, Latvia. The website uses the brand GW Home for construction and installation.
For privacy requests and opting out of proposals: team@gwhome.lv. You can also write to the relevant company at its registered office.
Joint controllers: SIA “GW home” and SIA “Glass & Wood” jointly determine the purposes and means of the shared website, customer enquiries, professional communications and CRM processing described here. You may exercise your data protection rights against either company, including through the common contact address team@gwhome.lv. Each company’s separate accounting and other statutory obligations are assessed separately.
In the practical allocation of responsibilities, GW Home coordinates website information and enquiry handling; Glass & Wood coordinates design and manufacturing information and processing by its team. Each company manages access rights and data accuracy within its team. Jānis Garančs coordinates data protection requests and monitoring of the common contact address. The companies handle requests together; this internal allocation does not restrict your rights against either controller. This paragraph provides the essence of their Article 26 responsibility allocation.
2. Data and sources
Depending on your enquiry and project, we process your name, job title, employer/business name, work email and telephone number, country/city, preferred language, project location, dimensions and quantities, correspondence, and drawings, photographs or other attachments you supply. Please do not send unnecessary national identity numbers, sensitive data or information about other people that the project does not need.
Sources include information you provide through a form, email, telephone or social network; professional conversations and meetings; the business you represent; public company websites and professional social profiles. B2B research records can include a source reference, business sector and professional relevance notes. Being publicly available does not itself amount to marketing consent.
The CRM structure provides for company, contact and enquiry records, communication date/channel/recipient/subject/content or summary, enquiry status, product, next action, source and objections. ChatPlace intake may also contain a social username, profile and conversation link, the original incoming payload and an AI summary. Audit records can contain copies of personal data. A field existing in the system does not mean every field is collected about every visitor.
Website delivery involves IP addresses, request times and addresses, browser/device information and security events. Sections 6 and 7 explain external videos and ROOFLIGHT visitor statistics.
3. Purposes and legal bases
| Processing | Purpose and legal basis |
|---|---|
| An individual's own enquiry, quotation and contract | GDPR Article 6(1)(b): steps requested by that individual before entering a contract and performance of their contract. |
| A business representative's work details and project correspondence | Article 6(1)(f): the relevant company's legitimate interests in responding to professional enquiries and organising a business relationship. The representative's employment contract is not a contract with us. |
| CRM and incoming communication management, including ChatPlace | Article 6(1)(f): handling enquiries consistently and avoiding lost, duplicate or unwanted contact. Article 6(1)(b) applies to particular processing necessary for the individual's own contract. |
| Individual B2B research and direct marketing | Article 6(1)(f) only following a necessity and balancing assessment; where prior consent is required for the channel/recipient, Article 6(1)(a) and the applicable electronic marketing rules. Legitimate interests do not replace legally required consent. |
| Recording and respecting marketing objections | Article 6(1)(c): compliance with objection duties, including Article 21 and applicable commercial communication rules. Only the necessary identifier and objection record are retained for suppression. |
| Website delivery, security and fault investigation | Article 6(1)(f): maintaining a secure, available website and preventing abuse, limited to necessary data. |
| Accounting records and mandatory disclosures | Article 6(1)(c): the accounting or other legal obligation applicable to that particular record. This does not justify indefinite retention of all CRM messages. |
| Handling and defending claims | Article 6(1)(f): establishing or defending a specific claim, limited to necessary evidence. |
| Loading YouTube/Vimeo players on gwhome.lv | Article 6(1)(a): separate, voluntary and withdrawable consent for the chosen external service. |
Marketing consent is not a condition for receiving a response. Your name, reply address and enquiry help us prepare a response; we cannot send you a reply without a reply address. Telephone and supplementary project materials are optional unless further information is needed for the particular project.
4. Individual B2B contact and opting out
Before approaching a contact, the sender must establish the actual sending company, professional relevance, source, legal basis and the rules for the recipient's country and communication channel. Sections 8 and 9 of Latvia's Information Society Services Law require identifiable commercial communications and senders, clear offers and a working opt-out. Electronic marketing addressed to natural persons generally requires prior consent, subject to the limited statutory existing-customer exception. A named employee's address must not automatically be treated as a legal entity's generic mailbox. Other countries may impose stricter requirements.
Our internal company communication policy, rather than a statutory number of permitted messages, is:
- One initial personalised message.
- If there is no reply, one reminder no earlier than 10 days after the initial message.
- Only in an individually approved exceptional case, one final reminder no earlier than 25 days after the preceding reminder.
- No more than three messages in total. A negative reply or opt-out ends marketing earlier.
- We do not circumvent an objection by changing the sending email address or approaching another contact at the same business.
The people conducting the communication are responsible for this policy. We do not claim CRM automatically enforces these intervals or the maximum number.
You can object at any time, without giving reasons, to direct marketing and associated profiling. Reply STOP to the message or email team@gwhome.lv. No registration, explanation or payment is required. Following an objection, we stop using your data for that marketing purpose. This does not prevent replies you request, necessary contract communications or mandatory notices; these must not be used to continue advertising.
For indirectly obtained data, we provide information about the particular controller, source (including whether it is public), categories, purposes, basis, recipients, retention and rights within the Article 14 deadline: no later than one month after obtaining the data, and already at the first communication or first disclosure to another recipient if earlier. A generic STOP footer alone does not provide that notice.
5. Services and recipients
Authorised staff of both companies access information according to their tasks. A shared brand does not permit unrelated use of contacts.
- Microsoft 365 / Exchange Online and OneDrive/SharePoint: email, document storage and collaboration; Microsoft provides processor services for information handled on our instructions.
- Supabase: CRM database and enquiry intake functions, acting as processor for customer data stored on our instructions. Copies can also exist in audit records and backups.
- ChatPlace: Instagram conversations, AI-assisted responses, extracting project details and forwarding them to CRM; a processor for our organised customer communications. Its subprocessors include Google/Gemini for AI functionality and cloud infrastructure. The provider may have separate controller responsibilities for its own account administration.
- Instagram/Meta and Telegram: communication platforms with their own policies for service data. Internal Telegram project notifications may contain a name, username, conversation link, project dimensions, quantity and location. These are used to handle the enquiry; access must be limited to the project team.
- Vercel: website delivery and technical requests as hosting processor, with separate controller responsibilities for certain security and service administration data. ROOFLIGHT also uses Vercel Web Analytics; the corporate gwhome.lv code has no such client analytics integration.
- YouTube (Google) and Vimeo: optional external players loaded on the corporate site only after your choice. They receive technical information and may also process it for their own purposes under their policies.
- Project designers, installation partners, accountants, legal advisers and competent authorities, where necessary for a particular contract or legal duty and limited to necessary data.
Processing outside the EEA. These international services may involve recipients or access outside the European Economic Area, including the United States; Supabase’s contractual service provider is in Singapore. This does not mean the entire CRM database is stored in those countries. Microsoft, Supabase, Vercel and ChatPlace processing terms provide contractual data protection requirements and, for applicable international transfers, European Commission standard contractual clauses or another Chapter V mechanism valid for the particular transfer. These safeguards do not promise EU-only storage or the absence of all risk. Contact team@gwhome.lv for details of the recipients and applicable safeguards for particular processing, including a copy.
Published provider terms: Microsoft DPA, Supabase DPA, Vercel DPA, ChatPlace DPA.
6. Contact forms and ROOFLIGHT
The corporate gwhome.lv form prepares a message in your device’s email application addressed to janis@gwhome.lv. Filling it in does not itself submit fields to CRM; you must send the email yourself. Once sent, the companies’ mail infrastructure and project team process it. An enquiry is not consent to unrelated marketing.
The current ROOFLIGHT form also prepares an email draft. The address and copy recipient are visible in your email application before sending. Fields include name, role, email, optional telephone, country, opening dimensions, roof slope and message. Selecting a drawing adds its filename to the draft; the file itself is not uploaded and you must attach it yourself. Both companies identified in section 1 are controllers.
If direct submission to a server or CRM is introduced, we will update information about fields, attachments and recipients before that processing begins.
7. Cookies, local storage and video choices
This section is the corporate gwhome.lv cookie and external media policy. The checked corporate code contains no Google Analytics, Meta Pixel, advertising pixels or analytics cookies. This does not mean hosting services process no technical request data.
YouTube and Vimeo players remain blocked until you choose that particular service. Until then, a locally hosted poster is shown without an external video connection. If you consent, the player receives IP address, browser/device and video/page information and may use its own cookies or local storage. YouTube uses the privacy-enhanced youtube-nocookie.com domain; Vimeo uses dnt=1. These settings are not an absolute guarantee against tracking.
The footer's “Cookie and video choices” control lets you allow YouTube and Vimeo separately, save selected options or reject both. Options start unchecked. Video consent does not constitute email marketing consent. Withdrawal removes loaded players; the control cannot delete data already transferred or cookies set by another website. You can also follow a link directly to the video provider's website, where its terms apply.
The corporate site stores only your requested preference in browser sessionStorage, key gw-media-consent-v1, containing the technical policy version, the two service choices and the choice timestamp. It is not an advertising or cross-site identifier and is not transmitted to CRM. Storage lasts for the tab's session; browser session restoration may preserve it. If storage is blocked, the choice works only on the current page. Material processing changes require a new choice.
ROOFLIGHT uses locally hosted videos and Vercel Web Analytics for visitor statistics. These statistics help us assess site use, based on our legitimate interest in improving the site while limiting data collection. Vercel describes this service as cookie-free analytics. You can object to this processing by emailing team@gwhome.lv. The current ROOFLIGHT version still retrieves fonts from Google, disclosing IP address and browser information; its prepared next version hosts the fonts locally and removes those requests. The gwhome.lv video controls do not manage ROOFLIGHT or other websites.
8. Retention, erasure and anonymisation
Retention depends on the particular purpose, not simply on a record existing in CRM. Enquiry information is needed while the proposal is being considered and reasonably expected follow-up is ongoing; once that purpose ends, necessity is reviewed and unnecessary data is erased or irreversibly anonymised. Keeping an inactive prospect solely because they might someday be contacted again is insufficient. Contract records are retained while relevant obligations and specific claim needs remain; mandatory accounting documents for the statutory period applying to their category. Consent evidence is retained only while necessary to demonstrate the particular processing and its lawfulness.
For objections, a minimal suppression record (email/relevant business identifier, date and scope) is retained while the company conducts outreach that could otherwise lead to contacting that person again. It is a protective record and is not used to send new offers. Independent contract or legal-duty processing is assessed separately.
We manually review necessity when an enquiry or project closes or an objection is received, and at least quarterly. Jānis Garančs coordinates this process. Quarterly is the review frequency, not permission to keep unnecessary data until the next review. Automated CRM erasure or anonymisation is not implemented. Log and backup deletion cycles may differ from active records; they are assessed separately when handling a request, with applicable limitations explained. A copy existing is not itself a reason to resume marketing use.
An erasure request must account for the relevant mailbox, OneDrive/SharePoint copies, CRM contact/enquiry, original payload, correspondence/activity and audit copies, ChatPlace and project notifications. Archives, audit and backups require separate assessment; they cannot be excluded merely because they are invisible in the CRM interface. If a legal obligation prevents erasure, the specific reason is explained. Restoring a backup must also preserve previous erasure and objection decisions. Minimal suppression information is retained separately so erasure does not cause renewed marketing.
9. Your rights and requests
Subject to the applicable conditions, you can obtain confirmation and a copy of your data, sources and recipients; correct or erase information; restrict processing; obtain portable data where processing is automated and based on consent or contract; withdraw consent; and object to legitimate-interest processing on grounds relating to your particular situation. Direct marketing objections require no reason and are not subject to an overriding-interest exception. Withdrawal does not affect the lawfulness of processing before withdrawal.
Email team@gwhome.lv and identify the communication or data concerned if you can. We help identify the request if you cannot. For disclosure of data, proportionate identity checks are used only where reasonable doubts exist. A simple marketing opt-out requires no account, identity-document copy, explanation or fee.
We respond without undue delay, normally within one month. For complex rights requests, GDPR allows up to two further months, with reasons notified during the first month. This is not permission to continue marketing after an objection. If a request cannot be fully fulfilled, we explain why and the available remedies.
You can complain to Latvia's Data State Inspectorate (dvi.gov.lv), or the competent supervisory authority in the country of your habitual residence, workplace or alleged infringement, and seek a judicial remedy.
10. AI, security and changes
CRM may include project priority and professional relevance assessments; ChatPlace uses AI for replies and extracting project information. AI output can be wrong and does not itself constitute a binding offer or technical confirmation. The checked corporate code does not reveal solely automated decisions with legal or similarly significant effects on individuals; this does not certify every unverified CRM integration. Introducing such processing requires separate information and assessment.
Access is limited by task, with encrypted transport, access controls and event records appropriate to the system used. Absolute security is not promised. Changes to purposes, recipients or material conditions require an updated policy and, where appropriate, information before the new processing. A previous choice cannot replace fresh consent where required.