Privacy Policy
About us
Data manager: SIA "JAZ", reg. Nr. 42103105683, (further mentioned as – the company or referred to as “us”, “we”).
In this privacy policy term client or user (also referred further as “you”) specifically means the user of https://app.jaznexus.com web application (further mentioned as - web application).
Personal data
Personal data is any information that can be used to identify an individual.
The Company, when processing personal data, complies with the requirements of the General Data Protection Regulation No. 2016/679 and the Personal Data Processing Act, as well as other requirements of legislation in force in Latvia and in Europe, to ensure the protection of personal data.
This privacy policy explains how the Company processes personal data, the procedure for exercising the data subject's rights, and issues related to personal data protection. The Company's privacy policy applies to the processing of personal data carried out by the Company on the specified website and in connection with ensuring the operation of this website. Additional terms specified in the distance contract also apply to users who subscribe to services in the web application.
Our responsibilities
With this personal data processing policy, the Company hereby affirms its commitment to ensure the protection and security of personal data in accordance with legal regulations and to observe the principles of good practice in personal data processing in its operations:
- to process personal data lawfully, fairly, and transparently, providing information on the platform about data processing procedures and their legal basis and purposes (objectives).
- Personal data processing is performed only by those employees whose official duties include carrying out such activities;
- to process personal data for clear, specific, and legitimate purposes, not processing it in a way incompatible with the original purpose;
- to apply the principle of data volume and processing minimization – processing only the data necessary to achieve the purpose of data processing;
- to ensure data accuracy – to correct or update inaccurate data, unless otherwise provided by law;
- to store data without exceeding the storage period necessary to achieve the purpose of data processing or specified in legislation;
- to use and continuously improve reasonable technical and organizational measures to ensure the confidentiality, integrity (immutability), and security of personal data, including protection against unauthorized or unlawful processing, accidental loss or damage of data.
What category person identifying information is collected and purpose for it
Platform operation (service provision)
When providing services offered by the platform, personal data related to user activity on the platform is processed, as well as for the execution of transactions concluded through the platform. Also in cases where you wish to exercise consumer withdrawal rights, or if you have questions or complaints about the service, processing of the relevant personal data will be necessary to ensure resolution of the situation. Without this data, the Company would not be able to properly provide services, ensure the functioning of the platform and related operations.
Registration and user profile
Personal data within the following categories are collected:
- Personal information (first name, last name)
- Contact information (email address)
- Personal identification, authentication status
- User-generated data and other technical data related to the use of the application and website
- Registered user information
- Uploaded documents (certificates, contracts, proofs)
- Audit logs from information systems about actions performed on the platform
Legal basis
Terms of use of the platform and the agreement between users and the Company on the use of the platform.
Fulfillment of obligations specified in regulatory enactments (including, bookkeeping and settlement recording, ensuring compliance with service conditions, ensuring the implementation of withdrawal rights).
Our legitimate interest to ensure and promote the availability of services, receive payment and ensure convenient customer service, provide evidence in case of claims.
Payment processing
Personal data within the following categories are collected:
- payment method
- payment information (Stripe customer id, payment status, time, amount, invoice number)
Legal basis
Terms of use of the platform and the agreement between user and the Company on the use of the platform.
Fulfillment of obligations specified in regulatory enactments (including, bookkeeping and settlement recording, ensuring compliance with service conditions).
Payments on the platform are implemented through a payment institution. Payment details (Link user id, Stripe user id, name, card number, card expiration date, card type, billing address) that are transferred to the payment institution used are usually not available to the Company.
Investigation and prevention of unlawful activities directed against us
In order to detect and prevent unlawful and dishonest activities against the Company (for example, to investigate and prevent intrusion or unauthorized editing of the platform or interference with access to the platform, as well as in cases of attempted fraud), we may collect and process data available to us, including transferring it to law enforcement authorities or information technology security incident prevention institutions.
Personal data categories
- User-generated data, visit history, data related to devices used and their settings, such as language settings, time zone, operating system and platform, IP and MAC addresses, browser settings, other information about the use of the website and the Company's digital services, other identifying information.
- Personal information (first name, last name, title, representation rights, other provided information)
- Contact information (email address, phone number, address)
- Payment details, payment information, payment method
- Goods delivery information (delivery address, associated order numbers, purchase history of goods/services)
Legal basis
Our legitimate interest to prevent malicious use of services or interference with service provision, or to investigate and prevent criminal offenses against the company.
To fulfill a legal obligation specified in applicable legislation.
Your data provided when communicating with us
When you contact us (including to review submissions and complaints) or we need to respond to you or send information, the contact information available to us may be used. Such information, as well as service usage and transaction information, may be used to review and respond to complaints, or in cases where the Company is involved in resolving mutual claims between platform users, to the extent provided for by the platform's functionality and rules.
Personal data categories
- Personal information (first name, last name, title, representation rights)
- Information related to representation (title, representation rights)
- Other identifying information
- Contact information (address, email address or phone number)
- Transaction and service usage information (for example, rental item information, transaction information and status)
- History of used services
- Payment details, payment information, payment method
- User-generated data and other technical data related to platform usage
Legal basis
To fulfill a legal obligation specified in applicable legislation.
Terms of use of the platform and the agreement between You and the Company on the use of the platform.
Our legitimate interest to provide customer service.
From what sources do we obtain personal data, how accurate are they?
We obtain personal data from the web application users. We collect information that we receive when users visit and use the platform, providing the Company with data (including data that users provide to the Company by filling in information fields in the application or website), as well as data that users provide when contacting us. We may receive data from service providers who ensure the operation of the website, including its operational statistics services, anti-attack, security and intrusion protection services.
We may receive data from other platform users, insofar as it relates to associated users.
If your data that you have provided to us has changed (for example, contact information for receiving news), you must immediately inform us about it, correcting incorrect or inaccurate data.
Who do we transfer your personal data to?
Service providers and cooperation partners
We may transfer your personal data to service providers and cooperation partners who ensure the operation of the platform and the provision of services, as well as to persons who fulfill obligations on our behalf. These service providers and cooperation partners process your personal data in accordance with our instructions and do not use them for other purposes. In some cases, they will be joint data controllers with us, having independent control over the data processing.
Other platform users
Please note that in case of communication, service use, and complaints, the data provided by a platform user may be transferred to another related platform user, insofar as it is related to the administration and execution of transactions concluded on the platform or for the purposes of investigating and preventing the consequences of illegal actions.
For example as the main purpose of this platform is to provide ESG audit services one platform user may receive information based on the transaction from another platform user however the platform ensures that both involved parties are well aware of this fact.
Law enforcement authorities, state and municipal institutions
In order to fulfill obligations specified in legislation, we may transfer your personal data to law enforcement authorities (for example, the police), state and municipal institutions upon their request (for example, the supervisory authority responsible for personal data protection). We may also transfer your personal data to law enforcement authorities (for example, courts), as well as state and municipal institutions, in order to defend our legitimate interests by preparing, submitting, and defending claims, complaints, and applications.
Cookies and Local Storage Technologies
We use cookies and local storage technologies to enhance your experience on our web application. This section outlines the specific cookies and local storage items we use, their purposes, and how they affect your privacy.
Cookies
The following table describes the cookies used by web application:
| Cookie name | Purpose | Duration | Type | Security Features |
|---|---|---|---|---|
| _Host-next-auth.csrf-token | Protects against Cross-Site Request Forgery attacks during authentication. This is a security measure to ensure requests originate from our site. | Session (temporary) | HTTP Cookie | Secure, HttpOnly, SameSite=Lax |
| Secure-next-auth.callback-url | Stores the URL to redirect users after authentication. This helps maintain a seamless user experience during the sign-in process. | Session (temporary) | HTTP Cookie | Secure, HttpOnly, SameSite=Lax |
| auth_method | Records your chosen authentication method (e.g., email). This helps our system recognize your preferred sign-in method. | Session (temporary) | Standard Cookie | - |
| Secure-next-auth.session-token | Maintains your authenticated session, allowing you to remain logged in to our application. | Persistent (expires after approximately 30 days) | HTTP Cookie | Secure, HttpOnly, SameSite=Lax |
Local Storage items
We also utilize local storage in your browser to store the following information:
| Item name | Purpose | Duration |
|---|---|---|
| bugsnag-anonymous-id | Generates an anonymous identifier used by our error monitoring service (Bugsnag) to track errors and improve application stability. This identifier does not personally identify you. | Persistent (until manually cleared) |
| nextauth.message | Stores session-related information for authentication management. This helps ensure your authentication state remains consistent. | Persistent (until manually cleared) |
What This Means for Your Privacy
- Purpose Limitation: We only use cookies and local storage for essential functionality and authentication purposes.
- Data Minimization: Our cookies and local storage items do not collect personal information beyond what is necessary for authentication.
- Security: Many of our cookies implement security features such as:
- Secure flag ensures cookies are only sent over HTTPS
- HttpOnly flag prevents JavaScript access, protecting against cross-site scripting attacks
- SameSite=Lax attribute helps prevent cross-site request forgery
Managing Your Cookie and Local Storage Preferences
You can control or delete cookies and local storage items at any time through your browser settings. Most browsers allow you to:
- Delete specific cookies
- Block cookies from being set
- Clear all local storage data
- Browse in private/incognito mode to prevent persistent storage
Please note that restricting cookies may impact your ability to use certain features of our application, particularly those related to authentication and session management.
For more information about managing cookies and local storage in your specific browser, please refer to your browser's help documentation.
Data processing outside EU
Our service utilizes third-party processors who may transfer and process your data outside the European Economic Area (EEA):
- Stripe (Stripe Inc.): We use Stripe for payment processing. When you make a payment through our platform, your payment information is processed by Stripe in accordance with their privacy policy. Stripe may process this data in the United States and other countries. Stripe has been certified to the EU-US Data Privacy Framework and maintains appropriate safeguards for international data transfers.
- Sendgrid (Twilio Inc.): We use Sendgrid for email communications. When we send you emails (such as confirmation emails, password resets, or notifications), your email address and related message data may be processed by Sendgrid in the United States. Sendgrid has implemented appropriate safeguards for international data transfers through Standard Contractual Clauses approved by the European Commission.
For how long your data is being stored
You maintain control over the duration for which your personal data is stored in our platform.
Your profile information and associated data will be retained for as long as you maintain an active registration with our service.
You may request deletion of your account and associated personal data at any time by contacting our support. Upon such request, we will delete your personal information from our active databases within 30 days.
Please note that some information may be retained in backup systems for a limited period or as required by applicable laws. Additionally, any data you have shared through the platform may remain visible even after your account deletion.
If your account remains inactive for 24 months, we may contact you to confirm whether you wish to maintain your account before considering it for deletion.
How do we protect your personal data?
We ensure, continuously review, and improve protection measures to safeguard your personal data from unauthorized access, accidental loss, disclosure, or destruction. To implement this, we employ modern technologies, technical and organizational measures, including the use of firewalls, updated software, and data encryption.
Rights of users
The data subject has general rights provided by the General Data Protection Regulation and other applicable legislation, including the following mentioned in paragraphs below.
Access to personal data
You have the right to request confirmation from us whether we are processing personal data related to you, and in such cases to request access to these personal data, or to provide information about personal data if direct access is not provided.
Correction of personal data
If you believe that the information about you is incorrect or incomplete, you have the right to request us to correct or supplement it.
Withdrawal of consent
To the extent that we process your personal data based on your consent, you have the right to withdraw your consent to the processing of personal data at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal, as well as in cases where data processing is carried out in accordance with another legal basis.
Objection to processing based on legitimate interests
You have the right to object to the processing of personal data that we process based on our legitimate interests; however, we will continue to process your data even if you have objected to it if we have legitimate reasons to continue processing your personal data. To exercise the aforementioned rights, please submit a written request to us.
Right to be forgotten
Under certain circumstances, you have the right to request that we delete your personal data; however, this does not apply to cases where the law requires us to retain the data. To exercise the aforementioned rights, please submit a written request to us.
Restriction of processing
Under certain circumstances, you have the right to restrict the processing of your personal data. Please note that if you request that the processing of your data be restricted, it may affect your ability to receive our services and purchase goods. To exercise the aforementioned rights, please submit a written request to us.
Can there be changes in data processing?
If the Company introduces changes in personal data processing, they will be announced by making amendments to this privacy policy.
The Company may make changes to the privacy policy, publishing its current version on the website.
Who can I contact if I have any questions?
If you have any questions, comments, or requests regarding the privacy policy or the processing of your personal data, please contact the Company.
If you are not satisfied with the response received, you have the right to submit a complaint to the supervisory authority – the Data State Inspectorate (www.dvi.gov.lv)
Data controller contact information
To contact us, you can write an email to ella@jaznexus.com or to the postal address: SIA "JAZ", address Riga, Raiņa bulvāris 21 - 4A, LV-1050, Republic of Latvia, tel.: +371 27832618.
Update date: 10.04.2025.
2026 © JAZ NEXUS / All rights reserved