Privacy Policy
Last updated: 27 September 2026. This is an English translation; in the event of any discrepancy, the Latvian version prevails.
This privacy policy explains what personal data SIA "StellarShip" collects, the purposes for which it is used, how long it is kept and what rights the person to whom the data relates has. The policy applies to the website stellarship.lv, the client portal tools.stellarship.lv, the cybersecurity training course, communication with us and the offers we send to businesses by email.
1. Controller
Registration number: 40003800118
VAT number: LV40003800118
Registered address: Blaumaņa iela 38/40-1, Rīga, LV-1011
Email: kontakti@stellarship.lv
Phone: +371 29716635
Website: stellarship.lv
If you have any questions about the processing of personal data, please write to the email address above.
2. What data we process and why
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Visiting the website | IP address, approximate location, device and browser type, pages visited, time of visit | Operating the website, security and visitor statistics | Legitimate interests — to run the website and improve its content |
| Communication — contact form, email, phone | First name, surname, email address, phone number, company, content of the message | To answer your question or prepare a quote | Steps taken at the request of the data subject prior to entering into a contract |
| Cybersecurity training course | First name, surname, company name (if provided), test result, date of issue, certificate number | To issue the certificate and ensure that its authenticity can be verified | Consent |
| Concluding contracts and providing services | Client representative’s first name, surname, position, contact details, contract and application data | Preparing and performing the contract and communicating during its term | Performance of a contract |
| Accounting | Invoice and payment data, contact person details in supporting documents | Bookkeeping and compliance with tax obligations | Legal obligation |
| Client portal tools.stellarship.lv | User contact details, login data, records of requests made and downloads | Technical provision of the service and support | Performance of a contract |
| Offers to businesses that are not yet our clients | Company name and sector; the email address the company has published itself; a contact person’s name, where the company has published it as a contact; where and when the address was found; emails sent and replies received | To offer our services to the business and answer its questions | Legitimate interests — offering services to businesses that have published their address for business communication |
| Offers to existing clients | Client contact details obtained when concluding and performing the contract | To inform clients about services similar to those they already use | Legitimate interests; where the client is a natural person — Section 9(2) of the Latvian Law on Information Society Services |
| Honouring opt-outs | Email address, company name, date of opt-out | To make sure we do not write again after an opt-out | Legal obligation to honour the opt-out |
Cybersecurity training course. The course runs in the visitor’s browser. Course progress and the first name, surname and company name entered are saved on the visitor’s own device so that the course can be completed over several sessions. Visitors can delete this data themselves by choosing the option to start over.
When the test is started, the first name, surname and company name (if provided) are sent to our server so that the test can be marked and a certificate issued. If the test is not passed, the data is not kept. If the test is passed, a certificate record is saved automatically: first name, surname, company, result, date of issue and certificate number. Anyone with the certificate number or QR code can verify the certificate at kurss.stellarship.lv/s and see this data. We do not keep the email address, IP address or answers to individual questions in the certificate record, and we do not send certificates by email.
Visitors cannot delete an issued certificate themselves. To have it deleted, write to kontakti@stellarship.lv and state the certificate number. Once deleted, the certificate can no longer be verified.
3. Our offers by email
Who we write to. We offer our services to businesses and organisations that may benefit from them. We only write to addresses that the business itself has published online as a contact address — on its website or in business and industry directories. We do not send offers by email to natural persons, including sole traders and the self-employed, without their consent. The exception is our clients, as described below.
What we do not do. We do not buy or rent email lists, we do not guess addresses from patterns (such as name@company.com) and we do not look for employees’ private addresses. We do not pass addresses on to anyone.
The first email. Our very first email states where your address comes from and includes a link to this policy. On request, we will tell you exactly where we found it.
Businesses in other countries. We only write to businesses outside Latvia where the law of that country allows it. Where prior consent is required, we do not write without it.
Existing clients. If you are our client, we may write to you about services similar to those you already use. You can opt out of these emails when concluding the contract and at any time afterwards.
How long we keep data. If you do not reply to our emails, we delete the address and correspondence records 12 months after the last email. If you reply, we keep the correspondence as set out in Section 7. If you opt out, we keep only the address, the company name and the date of the opt-out — solely so that we do not write to you again by mistake.
Your right to opt out of our offers. You can opt out of our offers at any time — free of charge and without giving a reason. Simply reply to any of our emails or write to kontakti@stellarship.lv. If you write from a different address, please tell us the address at which you received our email. After you opt out, we will no longer use your address for offers.
4. When training is ordered by an employer
A company may order cybersecurity training for its employees. In that case the employer is the controller of the employees’ data and of the data of the persons it designates to manage the training (for example, an HR manager). SIA "StellarShip" acts as a processor: we process this data only on the employer’s instructions, in accordance with the data processing agreement concluded, and do not use it for any purposes of our own.
What data is processed.
- The employee’s first name, surname, work email address and job title (if the employer provides them) and training language.
- The training deadline and the times invitations and reminders were sent.
- The times and results of knowledge test attempts, and whether each answer was correct, linked to the topic of the question.
- The certificate record.
- For the employer’s designated persons: email address, name, sign-in times and a log of actions in the company panel, including IP address.
How the training works. The employee opens the course through a personal link received from kontakti@stellarship.lv or from the employer. The name and company are already filled in.
What the employer sees. In the company panel, the employer’s designated persons see the employee’s e-mail address and job title, the training status and deadline, the number of attempts, the best result, the status of e-mails sent, the certificate and the personal link (so that it can be handed to an employee without an e-mail address). Answers to individual questions are not shown. Only a summary of the topics with the most mistakes is shown, and only when at least three employees have taken the knowledge test.
Certificate verification. Unless the employer has switched off public verification (switching it off applies to certificates issued afterwards), a certificate can be verified by its number at kurss.stellarship.lv/s, just as in the public course.
Emails. Invitations, reminders and emails to designated persons are sent from kontakti@stellarship.lv. They are delivered by the email service provider Brevo (Sendinblue SAS, France).
How long we keep data.
- Training data is kept for the term of the contract with the employer.
- When the employer deletes an employee’s data in the company panel, it is deleted. The certificate record remains, as described below, as does the entry in the designated persons’ activity log, which we delete after the contract ends.
- Within 30 days after the contract ends, we delete the employee list, the results, the email records and the designated persons’ accounts.
- A certificate record is kept until the recommended renewal date stated on the certificate (12 months after issue), so that it can still be verified.
- IP addresses in the company panel log are deleted after 90 days.
Your rights. For data processed in training ordered by an employer, please contact your employer first, as the employer decides on this processing. If you write to us, we will forward your request to the employer without delay and help them fulfil it. The employer is responsible for informing employees about the processing of training data.
5. Backup, data cloud and digitisation services
When providing data backup, private data cloud or document digitisation services, we process client data, which may include personal data. For this data, the client is the controller and SIA "StellarShip" is the processor. The terms, scope and duration of processing are set out in a written agreement. We do not use this data for any purposes of our own, do not disclose it to third parties and do not use it for any analysis.
6. Where data is stored
Client data that comes into our care in the course of the services we provide is stored on servers in Latvia. We use two service providers to deliver emails:
- Brevo (Sendinblue SAS, France) delivers automated emails, such as training invitations and reminders. Brevo stores the data in the European Union (servers in France and Belgium), but companies of its group and its sub-processors may access it for support and technical purposes from outside the EU, for example from the USA and India.
- Google (Gmail) relays to recipients the emails sent from our mail server, such as our correspondence and offers. Google may also process these emails outside the EU, including in the USA.
For transfers outside the EU, both service providers rely on the European Commission’s standard contractual clauses and the EU–US Data Privacy Framework. Otherwise we do not transfer data outside the European Economic Area. Should this become necessary for a particular service, the client would be informed in advance and any transfer would comply with the requirements of Chapter V of the General Data Protection Regulation.
7. How long we keep data
| Data category | Retention period |
|---|---|
| Communication that does not lead to a contract | Up to two years from the last correspondence |
| Business contacts who do not reply to our offer | 12 months from the last email |
| Opt-out record (address, company, date) | For as long as necessary to honour the opt-out |
| Contracts and related correspondence | For the term of the contract and 10 years after it ends — due to the limitation period for claims |
| Accounting source documents | For the period laid down in the Accounting Law and tax legislation |
| Records of certificates issued in the public course | Without a time limit, so that the certificate can be verified at any time. Deleted at the request of the certificate holder |
| Data of training ordered by an employer | For the term of the contract with the employer; deleted within 30 days after it ends. Certificate records — until the recommended renewal date stated on the certificate |
| Website visitor statistics | Up to 14 months |
| Client data we process on the client’s behalf | In accordance with the contract; after it ends, the data is returned to the client or deleted |
8. Who we share data with
We do not sell personal data or use it for profiling or automated decision-making. Data may be received by:
- service providers acting on our behalf — the website hosting provider, the email delivery providers (see section 6) and the accounting service provider. We conclude a data processing agreement with the service providers that process data on our behalf; with Brevo, it forms part of its terms of service. We use the Google service in accordance with Google’s terms;
- national and local government authorities in the cases laid down by law;
- lawyers and other advisers, where necessary to protect our legal interests.
9. Security measures
To protect data, we use encrypted connections, need-to-know access restrictions, two-factor authentication for administrative access, regular software updates and regular backups. Access to client data is limited to employees who need it to perform their duties.
10. Cookies
The website uses strictly necessary cookies that ensure the site works and is secure. These do not require consent. If visitor statistics cookies are also used, they are enabled only after the visitor has given consent, and consent can be withdrawn at any time by changing the choice or deleting cookies in the browser settings.
The cybersecurity training course uses the browser’s local storage to save course progress. This information stays on the visitor’s device. Data sent to our server during the test is processed as described in Section 2.
11. Your rights
Under the General Data Protection Regulation, you have the right to:
- opt out of our offers at any time and without conditions (object to direct marketing) — see Section 3;
- receive information on whether and what data of yours we process, and obtain a copy of it;
- request the correction of inaccurate data;
- request the erasure of data where there is no longer a basis for processing;
- request the restriction of processing;
- object to processing based on legitimate interests;
- receive your data in a structured, commonly used format or ask for it to be transmitted to another controller, where processing is based on consent or a contract;
- withdraw your consent at any time; this does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, write to kontakti@stellarship.lv. We respond within one month. If a request is complex, this period may be extended, and we will inform you of this in advance.
If you believe that your data is being processed unlawfully, you have the right to lodge a complaint with the Data State Inspectorate (Elijas iela 17, Rīga, LV-1050; dvi.gov.lv). We would be grateful if you gave us the opportunity to resolve the matter first.
12. Changes to this policy
This policy may need to be updated from time to time. The current version is always available on this page, and its date is shown at the top of the document. If the changes are significant, we will inform clients separately.