Legal

Privacy Policy

This Privacy Policy explains how SIA "Macovel" (the operator of Ofemy Signage) collects, uses, shares and protects your personal data, and what rights you have under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Latvian Personal Data Processing Law.

Last updated: May 28, 2026

1. Data Controller

The controller of your personal data is:

  • SIA "Macovel" (a private limited liability company registered in the Republic of Latvia)
  • Registration number: 40203046496
  • VAT number: LV40203046496
  • Registered office: Buru iela 1, Rīga, LV-1004, Latvia
  • Email: info@ofemy.com

References to "we", "us", "our", or "Ofemy Signage" in this policy mean SIA "Macovel". References to "you" mean the natural person whose personal data we process — including account holders, workspace members, invited collaborators, billing contacts, and visitors to our website.

2. Scope of this Policy

This Policy applies to personal data we process when you (a) visit our marketing website, (b) register and use an Ofemy Signage account, (c) communicate with us by email or other channels, or (d) view content rendered on a public display URL.

Where you use Ofemy Signage as part of an organisation (workspace), that organisation acts as the controller of any personal data it uploads into the platform (e.g. content shown on screens, member directories), and we act as a processor on its behalf. Our processing in that role is governed by a separate Data Processing Agreement (available on request).

3. Categories of Personal Data We Process

3.1 Account & identity data

  • Name, email address, password (hashed), profile picture (optional)
  • Workspace name and membership role
  • Account creation date, last login, language and timezone

3.2 Billing data

  • Plan tier, subscription status, invoices, billing address, VAT number
  • Payment data is processed by our payment provider; we do not receive or store full card numbers

3.3 Usage and technical data

  • IP address, browser, operating system, device type, language, referrer
  • Pages viewed, actions taken, timestamps, session identifiers
  • Display device metadata (browser user-agent, viewport, locale, timezone, coarse IP-derived geolocation)
  • Server logs, error reports and diagnostic information

3.4 Content you upload

Files (images, videos), text, URLs, and other media you submit to your workspace. Such content may incidentally contain personal data about other people — you are responsible for ensuring you have a lawful basis to upload it.

3.5 Communications

  • Emails you send to us, support tickets, and the contents of those communications
  • Survey or feedback responses you choose to provide

4. Purposes and Legal Bases

We process personal data on the following legal bases under Article 6(1) GDPR:

  • Performance of a contract (Art. 6(1)(b)) — to create and operate your account, deliver the Service, send transactional emails, take payment, and provide support.
  • Legitimate interests (Art. 6(1)(f)) — to keep the Service secure, prevent abuse and fraud, monitor performance, improve features, defend legal claims, and conduct limited direct marketing to existing customers. You can object at any time (see Section 9).
  • Legal obligation (Art. 6(1)(c)) — to comply with accounting, tax, anti-money-laundering, and other applicable Latvian and EU law.
  • Consent (Art. 6(1)(a)) — where we ask you for an opt-in, e.g. for marketing emails to non-customers or non-essential cookies. You can withdraw consent at any time.

5. Who We Share Data With

We do not sell personal data. We share it only with the following categories of recipients, and only to the extent necessary:

  • Cloud infrastructure providers — hosting, storage, CDN, email delivery, and database services located within the EU/EEA.
  • Payment processors — to take subscription payments and issue invoices.
  • Analytics and error-tracking providers — to help us understand usage and diagnose faults.
  • Professional advisers — accountants, auditors, and lawyers under duties of confidentiality.
  • Competent authorities — where we are legally required to disclose data, e.g. in response to a lawful court order or regulator request.
  • A successor entity — in the event of a merger, acquisition, or reorganisation of our business, subject to equivalent confidentiality and data-protection commitments.

All third-party processors are bound by written agreements containing GDPR Article 28 safeguards. A current list of our subprocessors is available on request from info@ofemy.com.

6. International Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA). Where a limited subset of data is transferred outside the EEA (for example, to a non-EU support tool), we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) or an applicable adequacy decision under Article 45 GDPR, and apply supplementary measures where required.

7. Retention

We keep personal data only as long as necessary for the purposes for which it was collected:

  • Account data — for the lifetime of your account, then deleted or anonymised within 90 days of account closure, save where retention is legally required.
  • Content you upload — until you delete it or close your account. Deleted items may persist in encrypted backups for up to 35 days before being purged.
  • Billing records and invoices — retained for at least 5 years to comply with Latvian accounting law (Likums "Par grāmatvedību").
  • Server and security logs — typically 30–180 days, longer where required for incident investigation.
  • Support correspondence — up to 3 years from the last interaction.

8. Security

We implement appropriate technical and organisational measures under Article 32 GDPR, including transport encryption (TLS), encryption of data at rest, access controls, principle of least privilege, audit logging, regular backups, isolation of customer workspaces, vetted subprocessors, and incident-response procedures. No system is perfectly secure; if a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Data State Inspectorate of Latvia within 72 hours and, where required, inform you without undue delay.

9. Your Rights Under GDPR

You have the following rights, subject to the conditions in the GDPR:

  • Right of access (Art. 15) — obtain a copy of the personal data we hold about you.
  • Right to rectification (Art. 16) — correct inaccurate or incomplete data.
  • Right to erasure (Art. 17) — "right to be forgotten", where applicable.
  • Right to restriction (Art. 18) — limit the processing of your data in certain cases.
  • Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
  • Right to object (Art. 21) — to processing based on legitimate interests, including profiling, and direct marketing at any time.
  • Right not to be subject to automated decision-making (Art. 22) — we do not make decisions producing legal effects on you solely by automated means.
  • Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email info@ofemy.com. We will respond within one month, extendable by two months for complex requests under Art. 12(3) GDPR. We may need to verify your identity before fulfilling a request.

If you believe we have processed your data unlawfully, you have the right to lodge a complaint with the supervisory authority — in Latvia, the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv, or with the supervisory authority of your habitual residence or place of work in the EU/EEA.

10. Cookies and Similar Technologies

Our application uses strictly necessary cookies for authentication, security (CSRF protection), and preserving session state. These are required for the Service to function and do not require consent under the ePrivacy Directive.

Where we use additional cookies for analytics or performance, we ask for your consent through a cookie banner the first time you visit. You can withdraw or change your choice at any time using the same banner or by clearing cookies in your browser.

11. Children

Ofemy Signage is a business-to-business product and is not directed to children under 16. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

12. Marketing Communications

We may send service-related emails (invoices, security alerts, important product changes) on the basis of our contract with you — these cannot be unsubscribed from while your account is active. Promotional emails are sent only with a lawful basis and always include an unsubscribe link.

13. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will notify you by email or via an in-app notice at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

14. Contact

For any privacy questions or to exercise your rights, contact us at info@ofemy.com, or write to:

SIA "Macovel"
Buru iela 1
Rīga, LV-1004
Latvia

Read our Terms of Service · Contact us