Updated: 21 October 2026.
This policy explains personal data processing on the Greenway website, in service enquiries and in the customer portal at klienti.greenway.lv.
Who is responsible?
The controller is Greenway Group SIA, registration number 40203264563, registered address: Kronvalda iela 5-22, Jelgava, LV-3002, Latvia. Service address: Zemeņu iela 2i, Jelgava, LV-3001. Send privacy questions and requests to info@greenway.lv.
What data do we receive, and from where?
- From you or the customer you represent: your name or company name, email, optional telephone number, message and information needed for the service.
- From our service documents and information supplied by customers: invoice recipient details, vehicle registration, document and work dates, recorded mileage, work, parts and related service entries.
- In the portal: the customer account and assigned vehicles, a protected password hash, sessions and access administration records. Passwords are not stored in plain text.
- For operating the website and portal: connection data including IP address, browser information, request times and security events. The enquiry rate counter uses a pseudonymised value derived from the IP address; this does not mean infrastructure providers do not receive the IP address.
The enquiry form needs a name or company name, email and message to handle your request; a telephone number is optional. Please do not send health information, copies of identity documents or other sensitive data unnecessary for your enquiry.
Why do we process data, and on which basis?
- To reply, prepare an offer and provide an ordered service: steps towards a contract or performance of a contract where you are a party (GDPR Article 6(1)(b)). Communication with business representatives and customer relationship management rely on legitimate interests (Article 6(1)(f)).
- To provide the customer's service history, manage portal access, prevent misuse and establish or defend legal claims: our and the customer's legitimate interests in accessible service records and secure systems (Article 6(1)(f)).
- Accounting and statutory duties: compliance with legal obligations (Article 6(1)(c)).
- Optional Google Analytics statistics and loading a YouTube video: your consent (Article 6(1)(a)). Cookies and similar device technologies also follow Latvia's Information Society Services Law.
The form checkbox acknowledges reading this policy; it is not marketing consent. Sending an enquiry does not subscribe you to a newsletter. We do not make solely automated decisions producing legal or similarly significant effects on you.
How do enquiries and customer history work?
An enquiry is saved in a private database and delivered to authorised Greenway staff in the internal GG Hub/Fredis work inbox. The reference shown on screen confirms saving; it does not itself confirm email delivery. A member of staff responds separately.
Portal history is compiled from available invoices and service records, with help from automated tools. An invoice recipient does not by itself prove vehicle ownership. Available entries are assigned to the customer and vehicle subject to access permissions; original invoice PDFs are not made public. Please contact us to correct an inaccurate registration, date or service entry. The portal summary does not replace original documents.
Who may receive data?
Authorised Greenway staff and service providers have access as necessary for their duties. We use Cloudflare for website and portal infrastructure, the database and security, and OpenAI ChatGPT/Sites for website publication and tools used to prepare document history summaries. Our email provider may be involved when we communicate. Accounting and IT support providers receive data needed for their work; competent authorities receive it where required by law.
Google receives data in connection with the statistics, video or external link you choose, as explained below. We do not disclose your portal history to other customer accounts. We do not sell personal data.
Processing outside the European Economic Area
Cloud providers operate global infrastructure, so processing may take place outside the EEA. Their terms provide transfer mechanisms such as European Commission adequacy decisions or EU Standard Contractual Clauses where applicable to the particular transfer. Contact us for information about the safeguard used for the relevant processing and how to obtain a copy. We do not claim that all website and portal data is stored exclusively in the EU.
How long is data kept?
The purpose determines the period. For an enquiry without an order, this is until the reply and agreed follow-up are complete. Longer storage needs a related order, warranty, dispute or specific legal duty. We assess the need for account and history data against the customer relationship, requested service history and justified warranty or claim requirements. Closing portal access does not itself delete accounting records that must be retained.
Invoices kept as accounting source documents have a minimum retention period of five years and longer where needed to trace a transaction or meet another applicable duty. This minimum does not automatically apply to every message or portal copy. The incident being investigated and potential claims determine the need for security records; rate counters use short technical windows. A portal session is valid for one hour. This does not mean every database record is automatically deleted when a session ends.
Cookies and browser storage
- greenway.analytics-consent.v1 — our localStorage record remembers your statistics choice for up to 180 days. It does not itself activate analytics.
- greenway.media-consent.v1 — a localStorage entry remembering your separate permission for YouTube video for up to 180 days. Video permission does not enable analytics.
- gw_client_session — the customer portal's necessary login cookie, lasting one hour. In HTTPS it uses Secure and HttpOnly protections.
- _ga and _ga_<container identifier> — Google Analytics 4 first-party cookies only after statistics consent. The website configures them for up to 180 days; browsers may shorten this. Google's server-side retention is a separate setting. As checked on 21 October 2026, event data is set to 2 months and user data to 14 months, with user retention reset on new activity. These settings do not limit most aggregated standard reports.
- If Cloudflare requires a security check, cf_clearance may remember its result. Its lifetime is determined by the security settings of the relevant infrastructure service. See Cloudflare's cookie explanation.
The Google Analytics library is not loaded before your consent. Statistics help us understand page visits and contact actions; we do not send the name, email, telephone number or message entered into the enquiry form. Advertising personalisation and Google Signals are disabled. Choose “Necessary only” to refuse. Change your choice using “Cookie choices”; withdrawal stops further statistics events sent by our website and deletes Analytics cookies accessible to our domain. It does not automatically erase information Google has already received. The current statistics integration is on the public website, not in the customer portal.
YouTube and external links
The YouTube player loads from youtube-nocookie.com only after separate video permission in Cookie choices or a click on the video play button. Allowed video starts muted when in view and pauses out of view. Reduced-motion preferences require the play button. Google/YouTube then receives connection and playback data under its privacy policy. “nocookie” does not mean no data processing. Withdraw video permission beside the player or in Cookie choices to remove the player and stop our further video loading; this does not undo past processing. Google Drive material links open the external service only when followed.
Your rights and complaints
Email info@greenway.lv to request access and a copy, correction of inaccurate data, erasure or restriction, and portability where the legal conditions apply. You may object to processing based on legitimate interests and withdraw consent at any time; withdrawal does not affect earlier lawful processing. Retention duties or legal claims may limit some rights. We may proportionately verify your identity. We respond without undue delay, normally within one month, and will explain any extension permitted by law.
You may contact us or complain to Latvia's Data State Inspectorate if you believe processing is improper. Material updates to this policy appear on this page with the update date.