Privacy policy

In force from 11 October 2026

1. Who we are

SIA CEI CEI, reg. No. 40203699272
Email: [email protected]
Phone: +371 20 390 436

This policy describes how we process personal data:

• on the ceicei.lv website;
• in communication with clients and business partners;
• in the "BIS pārvaldnieks" service, where construction site foremen send reports via WhatsApp.

Send questions about data processing to [email protected].

2. Website

The website uses no analytics or advertising cookies and collects no data through forms. The site only contains email and phone links. If you use them, the communication happens outside the website and is described in section 3.

The website is hosted on the Cloudflare Pages platform of Cloudflare, Inc. For the site to work and stay protected, Cloudflare, as our processor, processes technical data such as the IP address and browser type. It is stored briefly in line with Cloudflare's data processing terms. The legal basis is our legitimate interest in keeping the website running and secure (Article 6(1)(f) of the General Data Protection Regulation, the GDPR). Cloudflare may process this data also outside the European Economic Area, including in the USA. The transfer is based on the EU-US Data Privacy Framework or standard contractual clauses.

3. Communication with clients and partners

When you contact us by email or phone, we process your name, contact details and the content of the correspondence in order to reply and to prepare an offer or a contract.

Legal basis:

• steps before entering into a contract and performance of the contract, where you conclude the contract yourself (Article 6(1)(b) of the GDPR);
• our legitimate interest in communicating with the representatives and contact persons of the companies we work with (Article 6(1)(f));
• our legal obligation to keep accounting records (Article 6(1)(c)).

We keep emails and documents in Microsoft 365 (Microsoft Ireland Operations Limited).

We keep correspondence for as long as it is needed for the cooperation. We keep accounting records for as long as the accounting legislation requires.

4. BIS pārvaldnieks and WhatsApp

What it is. BIS pārvaldnieks (Latvian for "BIS manager") is a SIA CEI CEI service for construction companies. A foreman fills in a WhatsApp form about work done or a delivery received. From it we prepare a draft entry for the construction works journal in the Latvian state Construction Information System (Būvniecības informācijas sistēma, BIS). The entry is approved in BIS by the construction works manager.

BIS pārvaldnieks is not a state service. It is provided by SIA CEI CEI, not by the State Construction Control Bureau or any other state authority.

Who is responsible for the data.

• The data controller is the construction company that has concluded a contract with us for preparing BIS construction works journal entries on your site and has named you as a contact person. We tell you its name and contact details before the first message: in the consent text and in the first WhatsApp message. If you do not know which company it is, write to [email protected].
• SIA CEI CEI is the data processor. We process the data only on the construction company's instructions and under a data processing agreement. The construction company has allowed us to engage the sub-processors listed under "Who receives the data".
• For the consent and opt-out list, the controller is us, SIA CEI CEI.
• We have prepared this section also on behalf of the construction company. The construction company is responsible for informing all foremen about the data processing, including subcontractors' employees.

What data we process:

• name, surname, the company you work for and the site where you are a contact person;
• phone number, WhatsApp profile name and WhatsApp user identifier;
• the content of work reports: when and where on the site work was done, what was done, how many people worked and when the work started, which materials were used, as well as problems and defects;
• the content of delivery reports: when and from whom a delivery was received, what was delivered and which documents accompany it;
• photos and documents you attach, including images of delivery notes and declarations;
• messages you write in the WhatsApp conversation;
• the time messages were sent and received.

Where the data comes from. Your name, surname, phone number, company and site are given to us by the construction company that has named you as a contact person. We do not ask for them in the form. Reports, photos and messages we receive from you.

Why and on what basis.

• Journal entries. To prepare construction works journal entries. The Latvian building regulations for buildings (Ēku būvnoteikumi, Cabinet Regulation No. 529 of 2 September 2014) and other building regulations require journal entries to be made by the construction works manager. Basis: the construction company's legal obligation (Article 6(1)(c) of the GDPR).
• Photos. To document completed and covered works with photos so they can be proven to the client, the construction supervisor or in a dispute. Basis: the construction company's legitimate interest (Article 6(1)(f)).
• Communication. To contact you about the reports and clarify them. Basis: the construction company's legitimate interest (Article 6(1)(f)).
• Consent list. To maintain the consent and opt-out list and to be able to prove that messages are sent only with consent. Basis: our legitimate interest in complying with the WhatsApp terms (Article 6(1)(f)).

Consent to WhatsApp messages. Before the first message we ask for your consent to receive WhatsApp messages, because the WhatsApp terms require it. This consent covers only the receiving of messages. It is not the legal basis of the data processing.

Do you have to provide the data. Sending reports via WhatsApp is not mandatory. Whether and how you must report on your work is decided by your employer or the construction company. If you do not use WhatsApp or opt out of the messages, you can submit the report in another way set by the construction company, for example by email.

How we use it. We use the reports only to prepare construction works journal entries. We do not use message times, delivery and read statuses or other WhatsApp technical data to evaluate your work, and we do not pass them to the construction company.

What we ask you not to send:

• personal identity numbers, images of identity documents and health data;
• photos showing other people, vehicle number plates or documents with personal data.

Photograph the work, not the people. If such data still arrives, we delete it.

Who receives the data:

• Meta Platforms Ireland Limited (WhatsApp Business Platform). Meta is our sub-processor: it transmits and briefly stores messages and files. For platform security and abuse prevention Meta processes part of the data as an independent controller. You use the WhatsApp app under the WhatsApp terms and privacy policy.
• Cloudflare, Inc., a server service provider whose server receives the replies from WhatsApp.
• Microsoft Ireland Operations Limited (Microsoft 365), where we keep the reports and photos.
• The construction company on whose site you work. We pass on only the content of the reports and the photos. We do not pass WhatsApp technical data (user identifier, profile name, delivery and read statuses) to the construction company.
• The Construction Information System (BIS), where the entry is made. The content of the entry is visible to the participants of the BIS file and the supervising authorities under the BIS rules.

Transfers outside the EEA. Meta, Cloudflare and Microsoft may process data also outside the European Economic Area, including in the USA.

• Transfers to the USA are based on the European Commission's adequacy decision on the EU-US Data Privacy Framework, where the recipient is certified.
• In other cases they are based on standard contractual clauses approved by the European Commission.

You can receive a description or a copy of these safeguards by writing to [email protected].

How long we keep it:

• On the intermediate server: only until the reply and photos are saved in our storage, no longer than 30 days.
• On the WhatsApp platform: Meta stores message content and files for no longer than 30 days. If we stop the service, Meta deletes the remaining data within 90 days. The WhatsApp contact list feature is switched off.
• In our storage: for as long as the construction company has set in the data processing agreement. After the service contract ends, we hand the data over to the construction company and delete it, unless the construction company has instructed us to keep it longer.
• The consent and opt-out list: 3 years after opting out, so we can prove that messages were sent with consent and stopped after the opt-out.
• BIS entries: under the BIS and construction legislation. We cannot delete approved entries.

How to opt out. Write STOP in the WhatsApp conversation or tell us another way: by email [email protected] or by phone +371 20 390 436. We will:

• stop sending messages no later than the next business day;
• remove you from the list of message recipients;
• inform the construction company so you can submit reports another way.

5. Your rights

You have the right to:

• access your data and receive a copy of it;
• ask for inaccurate data to be corrected;
• ask for data to be deleted or its processing restricted, if it is no longer needed or the processing is not lawful;
• opt out of WhatsApp messages at any time (see "How to opt out").

Right to object. Where processing is based on legitimate interests (photos, communication about reports, the consent list), you can object to it at any time on grounds relating to your particular situation. The processing is then stopped, unless there are compelling legitimate grounds to continue it or the data is needed for the defence of legal claims. For reports and photos the decision is made by the construction company, for the consent list by us.

Send requests to [email protected]. We reply without undue delay, no later than within one month. If a request is complex, the deadline can be extended by two further months, and we will tell you about that within the first month. If we process the data on the construction company's instructions, we forward the request to the construction company at once and help fulfil it.

If you believe your data is being processed unlawfully, you can lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija): www.dvi.gov.lv.

6. How to request data deletion

1. Write to [email protected] with the subject "Data deletion".
2. State your name and the phone number from which you sent the WhatsApp messages.
3. We will check that the request comes from you and, without undue delay and no later than within one month:
   • Messages and contacts. We will stop sending you messages, remove your number from the list of recipients and delete your entry in our WhatsApp contact list. We will keep only a record of when you consented and when you opted out, so that no more messages are sent to you.
   • Reports and photos. We keep them on the construction company's instructions, so we will forward the request to the construction company at once. If the construction company agrees to the deletion, we will delete this data from our server and storage. If the construction company needs the data to substantiate the construction works journal or to fulfil another legal obligation, we will explain to you in writing why it cannot be deleted.
   • Reply. We will tell you what was done.

If the request is complex, the deadline can be extended by two further months. We will tell you about that within the first month.

On the WhatsApp platform Meta deletes message content automatically within 30 days at the latest.

Data already entered in the BIS construction works journal cannot be deleted by us, because it is kept by the state system under the legislation. For that data you can turn to the construction company.

To just stop the messages, writing STOP in the WhatsApp conversation is enough.

7. Security

• Only authorised people have access to the data.
• We use two-factor authentication on our accounts.
• Data is transferred only over encrypted connections.

We do not carry out automated decision-making or profiling.

8. Changes

If this policy changes, we publish the new version on this page with a new effective date.