Privacy and Cookie Policy

1. Who processes the data

The data controller is SIA NEXET, reģ. Nr. 40203795002, Gulbju iela 67, Jūrmala, LV-2008, Latvija. Contact for data matters: info@vadly.app.

When you book with a business through Vadly, that business also receives your data to provide the service and is responsible for its further use as an independent controller.

2. What data we process

• Account data: first and last name, email, password (stored encrypted), city, language, role (client or business).
• Booking data: service, time, branch, specialist, comment, status; for bookings without an account — name, email and/or phone.
• Business profile data: name, description, contacts, addresses, services, prices, schedule, photos, staff details.
• Requests, responses, reviews, messages and notifications within the platform.
• Consents: which documents were accepted and when, consent to promotional messages.
• Technical data: IP address, browser type, security and activity logs needed to prevent abuse.
• Analytics data — only if you accepted analytics cookies (section 7).

3. Purposes and legal bases

• Sign-up, sign-in and account operation; creating and managing bookings; connecting clients and businesses — performance of a contract (Art. 6(1)(b) GDPR).
• Service emails about bookings, your account and security — performance of a contract.
• Review (moderation) of business profiles, fraud and spam prevention, security logs — legitimate interests (Art. 6(1)(f)).
• Promotional offers from businesses and visit analytics — only with your consent (Art. 6(1)(a)); you can withdraw it at any time.
• Retention of data required by law — legal obligation (Art. 6(1)(c)).

4. Who receives the data

We do not sell personal data. Access is limited to:

• the business you booked with or sent a request to;
• technical infrastructure providers: hosting and database, email delivery, Google sign-in (if you use it), OpenStreetMap maps to show branch addresses, Google Analytics (only with consent);
• public authorities — where required by law.

5. Transfers outside the EU/EEA

Some providers may process data outside the European Economic Area. In such cases transfers happen only with safeguards provided by the GDPR, such as a European Commission adequacy decision or standard contractual clauses.

6. Retention periods

• Account data — while the account exists; after deletion it is deleted or anonymised, except data we must keep by law.
• Booking history — while the client or business account is active, and no longer than needed for the stated purposes.
• Security logs — for a limited period needed to investigate incidents.
• Analytics data — per Google Analytics settings, no longer than 14 months.

7. Cookies and similar technologies

Cookies are small files a website stores in your browser. We use two groups:

• Essential — keep you signed in and remember your language and cookie choice. The site cannot work without them; no consent is needed.
• Analytics (Google Analytics) — help us understand which pages are visited and how to improve Vadly. They are enabled only after you press Accept. If you press Decline, they are not loaded.

You can change your choice at any time: clear the site data for vadly.app in your browser settings, and the choice window will appear again on your next visit.

8. Your rights

You can request access to your data, its correction or deletion, restriction of processing and data portability, object to processing based on legitimate interests, and withdraw consent. Write to info@vadly.app — we reply within one month.

If you believe your rights have been infringed, you can lodge a complaint with the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv).

9. Data security

Access to data is strictly separated by role: clients see only their own bookings, businesses only their own clients, and permissions are checked on the server. The connection to the site is encrypted and passwords are stored encrypted.

10. Children

Vadly is not intended for persons under 16. If you learn that a child has given us data without parental consent, contact us and we will delete it.

11. Changes to this policy

If we make material changes, we will publish the new version on this page and, where needed, ask for your consent again.