Privacy Policy

Last updated: 2 October 2025
Version: 2.1

---

1. Introduction

This Privacy Policy (hereinafter the "Policy") describes how SIA "Login Grupa" (hereinafter "modelbook.lv", "we", "us" or "our") collects, uses, stores, transfers and protects your personal data when you use our website www.modelbook.lv (hereinafter the "Portal") and the services related to it.

Modelbook.lv is an information portal for the beauty industry that brings together beauty professionals, aspiring masters and clients, offering the opportunity to book procedures, look for models and build professional contacts. The Portal also includes a school system that makes it easier to keep student records and manage class schedules.

We are committed to protecting your privacy and to ensuring that your personal data is processed lawfully, fairly and in a transparent manner in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, or GDPR) and the Personal Data Processing Law of the Republic of Latvia.

Please read this Policy carefully before using the Portal. If you use the Portal or have carried out any activity on it, you are deemed to have read this Policy and to agree to the terms set out in it.

---

2. Data controller and contact details

The controller of personal data processing is:

Name: SIA "Login Grupa"
Registration number: 40103638267
Registered address: Ogre, Vidus prospekts 20/31, Latvija
E-mail address: [email protected]

Data protection questions:
If you have questions about data protection or wish to exercise your rights, please contact us:
E-mail: [email protected]
Subject: "Data protection" or "GDPR request"

If you have any questions about this Policy or the processing of your personal data, or wish to exercise your rights, please contact us by writing to the e-mail address: [email protected].

---

3. Categories of personal data processed

Based on the technical structure and functionality of the Portal, we collect and process the following categories of personal data:

3.1. Identification data

First name, last name, unique user identifier (UUID), profile link (slug).

3.2. Contact details

E-mail address, phone number (if provided in the profile).

3.3. Authentication data

Password (in encrypted form), session remember token, social network (Facebook, Draugiem.lv) authentication data and access tokens.

3.4. Profile information

Profile picture, user type (client, master, student), contract date (for students), description, speciality, workplace, portfolio images, education, experience, service descriptions and prices, user settings (in JSON format).

3.5. Service and booking data

Booking start and end time, master and client identifiers, service identifier, price, description, booking status, missed appointments, unique booking identifier (UUID).

3.6. School and salon data

Company name, website address, slogan, owner identifier, working hours (in JSON format), class and table information.

3.7. Financial data

Service prices, payment information (if payments are made through the Portal), bank account information (if needed for payment processing).

3.8. Technical data

IP address, device type, operating system, browser and its version, cookie identifiers, time and duration of connection, location data (determined from the IP address).

3.9. Communication data

Correspondence with other users on the Portal, communication with the Portal administration, notifications sent and received.

---

4. Purposes and legal basis for processing personal data

We process your personal data to operate the Portal and to provide our services to you. For each processing purpose we apply an appropriate legal basis in accordance with Article 6 of the GDPR. We follow the data minimisation principle: we collect only the personal data that is needed for a specific purpose.

---

5. Recipients of personal data and transfers to third parties

Your personal data is not sold or otherwise improperly transferred to third parties. We may transfer your data to the following categories of recipients only when this is necessary to provide services or to comply with legal requirements.

5.1. Data recipients on the Portal

Other Portal users: To provide the Portal's functionality, certain information from your profile (for example, first name, last name, profile picture, service description, prices) is visible to other users. Once a booking is confirmed, the master sees the client's name and contact details, and vice versa, so that they can communicate and confirm the procedure.

Beauty schools: If you are a student and register with a beauty school through the Portal, your data (first name, last name, contact details, study programme, class schedule) is transferred to that school.

Portal administration: Portal employees and administrators may access your data to provide technical support, resolve disputes or carry out maintenance work.

5.2. Third-party data processors and service providers

We work with trusted partners who help us provide our services. These partners process your data only on our behalf, in accordance with our instructions and strict confidentiality requirements.

5.3. Data transfers outside the European Union/European Economic Area

When we use service providers such as Google (Google Analytics, Google Fonts) and Meta (Facebook Pixel, Facebook OAuth), your data (mainly technical and analytical) is transferred to the United States of America.

Such transfers are made with an adequate level of protection in accordance with GDPR requirements, using:

• Standard Contractual Clauses (SCC) approved by the European Commission;
• European Commission adequacy decisions (where applicable);
• Other GDPR-compliant safeguards.

You can request further information about the safeguards for data transfers by contacting us.

5.4. Law enforcement authorities

We may disclose your data to public administration and law enforcement authorities in the cases and in the manner laid down by law, for example following a court decision, a request from the public prosecutor's office or another lawful request.

5.5. Is providing personal data mandatory?

Providing some personal data is mandatory for you to be able to use the Portal's services:

Mandatory data for registration:

• First name, last name
• E-mail address
• Password (or OAuth authentication with Facebook/Draugiem.lv)

If you do not provide this data, you will not be able to create a profile and use the Portal's features (book procedures, contact masters, manage your schedule).

Voluntary data:

• Phone number
• Profile picture
• Detailed description
• Portfolio images
• Speciality and experience

Not providing this data does not affect your ability to use the core features, but it may limit your profile's visibility and appeal to other users and reduce your chances of receiving bookings.

---

6. Cookie policy

6.1. What are cookies?

A cookie is a small text file that is stored on your device (computer, smartphone, tablet) when you visit a website. Cookies allow the website to recognise your device and remember information about your visit, such as your language choice or login status.

6.2. Which cookies do we use?

Our Portal uses the following categories of cookies:

6.3. How can you manage cookies?

When you visit the Portal for the first time, you are shown a notice about the use of cookies, in which you can consent to the use of certain categories of cookies. At any time you can:

• Change your cookie preferences using the cookie settings tool on the Portal (if available);
• Block or delete cookies using your browser settings.

Please note that if you block or delete necessary cookies, some Portal services and features may not work properly (for example, you will not be able to log in or book procedures).

---

7. Personal data retention period

Your personal data is stored only for as long as necessary for the relevant processing purpose or as required by applicable law. We regularly review the data we store and delete data that is no longer needed.

7.1. "Soft Delete" mechanism

An analysis of the Portal's code confirms that a "soft delete" mechanism is used. This means that when a profile or other information is deleted, it is not immediately physically destroyed in the database but is marked as deleted (the deleted_at field). This allows data to be restored if necessary and ensures data integrity in the system.

If you want your data to be permanently deleted before the 1-year period ends, please see section 8.3. Right to erasure.

---

8. Your rights as a data subject

Under the GDPR, as a data subject you have the following rights in relation to your personal data:

8.1. Right of access (GDPR Article 15)

You have the right to know whether we process your personal data and, if we do, to access it and receive a copy of it. You can request information about the purposes of processing, the categories of data, the recipients, the retention period and other aspects.

8.2. Right to rectification (GDPR Article 16)

You have the right to request that inaccurate or incomplete personal data be corrected or completed. You can correct most profile information yourself in the "Settings" or "Profile" section of the Portal. If you cannot correct the data yourself, please contact us.

8.3. Right to erasure - "right to be forgotten" (GDPR Article 17)

You have the right to request the erasure of your personal data in certain circumstances, for example:

• If the data is no longer needed for the original purposes;
• If you withdraw your consent and there is no other legal basis for the processing;
• If the data has been processed unlawfully;
• If the data must be erased to comply with a legal obligation.

Please note that we cannot erase data if storing it is necessary to comply with legal obligations (for example, the Accounting Law) or to defend legal claims.

If you want permanent deletion before the standard 1-year period ends, please send a request to [email protected] with "Permanent data deletion" in the e-mail subject.

8.4. Right to restriction of processing (GDPR Article 18)

You have the right to request the restriction of processing of your personal data in certain circumstances, for example:

• If you contest the accuracy of the data (for a period while we verify its accuracy);
• If the processing is unlawful but you do not want the data to be erased;
• If we no longer need the data but you need it to establish, exercise or defend legal claims.

8.5. Right to data portability (GDPR Article 20)

You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and the right to transmit this data to another controller without hindrance from us.

When exercising the right to data portability, you can receive your data in the following formats:

• JSON (structured data, suitable for technical processing)
• CSV (tabular data, suitable for Excel and similar programs)
• PDF (readable format for documentation)

8.6. Right to object (GDPR Article 21)

You have the right to object to the processing of your personal data based on our legitimate interests (for example, profiling, direct marketing). If you object to direct marketing, we will immediately stop processing your data for this purpose.

8.7. Right to withdraw consent (GDPR Article 7)

Where data processing is based on your consent (for example, marketing e-mails, analytics cookies), you have the right to withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

You can withdraw your consent:

• For marketing e-mails: by clicking the "Unsubscribe" link in any marketing e-mail;
• For cookies: by changing the cookie settings in your browser or by using the cookie management tool on the Portal.

8.8. How to exercise your rights

To exercise any of the rights listed above, please contact us by writing to the e-mail address: [email protected]. Please include:

• Your first name and last name;
• The e-mail address associated with your profile;
• The specific right you wish to exercise;
• Any additional information that may help us process your request.

We will respond to your request within one month of receiving it. In complex cases this period may be extended by two months, in which case we will inform you and explain the reason for the extension.

---

9. Automated decision-making and profiling

We do not carry out automated decision-making (including profiling) that would produce legal effects concerning you or similarly significantly affect you within the meaning of GDPR Article 22. All decisions about your profile, the provision of services, booking confirmations or other matters are made with human involvement.

We do not use automated algorithms to:

• Make decisions about your suitability as a master or client;
• Automatically confirm or reject bookings;
• Restrict your access to Portal features without human review.

---

10. Data security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Our security measures include, but are not limited to:

• Encryption: Sensitive data (for example, passwords) is encrypted using modern encryption standards (bcrypt or similar). The connection to the Portal is protected by the HTTPS protocol (SSL/TLS encryption).
• Access control: Access to personal data is restricted to the employees and partners who need it to perform their duties. All employees have signed confidentiality agreements.
• Regular monitoring: We regularly review and update our security procedures to address new threats and vulnerabilities.
• Data backup: We regularly make backup copies of data to prevent data loss in the event of technical problems.
• Security audits: We carry out regular security audits and vulnerability tests.
• Staff training: All employees who work with personal data receive regular training on data protection requirements.

Despite our efforts, no data transmission or storage system can be 100% secure. If you suspect that the security of your profile has been compromised (for example, someone has found out your password), please contact us immediately at [email protected] and change your password.

10.1. Notification of personal data breaches

If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay in accordance with GDPR Article 34. The notification will be sent to your registered e-mail address and will include:

• The nature of the breach and its likely consequences;
• The measures we have taken or plan to take to address or mitigate the harm;
• Contact details where you can get further information;
• Recommendations on how you can protect your data (for example, by changing your password).

We will also report the breach to the Data State Inspectorate (Datu valsts inspekcija) within 72 hours of becoming aware of it, if the breach is likely to result in a risk to users' rights and freedoms, in accordance with GDPR Article 33.

---

11. Protection of children's personal data

The Portal is not intended for persons under 16 years of age. We do not knowingly collect personal data from children under the age of 16 without the consent of a parent or guardian.

If we learn that we have inadvertently collected personal data from a child under the age of 16 without appropriate consent, we will take steps to delete that data as quickly as possible.

If you believe that we may hold information about a child under the age of 16, please contact us at [email protected].

---

12. Changes to the Privacy Policy

We reserve the right to update this Policy from time to time to reflect changes in our practices, in the Portal's functionality or in applicable law.

We will inform you of material changes at least 30 days before they take effect, by publishing a notice on the Portal or by sending you an e-mail (if you are a registered user).

We recommend that you review this Policy regularly to stay informed about how we protect your data. The date of the latest changes and the version number are shown at the top of the Policy.

By continuing to use the Portal after the changes take effect, you agree to the updated Policy.

Previous versions: You can request previous versions of the Policy by contacting us at [email protected].

---

13. Lodging a complaint with the supervisory authority

If you believe that the processing of your personal data infringes the GDPR or other applicable law, please contact us first so that we can resolve the situation.

You also have the right to lodge a complaint with the supervisory authority:

Datu valsts inspekcija (Data State Inspectorate)
Address: Elijas iela 17, Rīga, LV-1050, Latvija
Phone: +371 67223131
E-mail: [email protected]
Website: www.dvi.gov.lv
Opening hours: Monday-Thursday 8:30-17:30, Friday 8:30-16:15

The Data State Inspectorate is the national supervisory authority of the Republic of Latvia for personal data protection.

---

14. Contact us

If you have any questions, comments or concerns about this Privacy Policy or our personal data processing practices, please contact us:

E-mail: [email protected]
Address: SIA "Login Grupa", Ogre, Vidus prospekts 20/31, Latvija
Subject: "Privacy policy" or "GDPR request"

We will try to answer your questions as quickly as possible (usually within 3-5 working days) and to give you all the information you need.

---

Thank you for trusting modelbook.lv!

We greatly value your trust and are committed to protecting your privacy and personal data to the highest standards.

---

This Privacy Policy was prepared on the basis of a detailed analysis of the Portal's code and database structure, to ensure maximum accuracy and compliance with GDPR requirements.