PrivacyPolicy.

Enocto (enocto.com) is operated by EDEX SIA, registered in the Commercial Register of the Republic of Latvia under No. 40103909947 (VAT No. LV40103909947), Kārļa Ulmaņa gatve 119, Mārupe, Mārupes Municipality, LV-2167, Latvia. We are the controller of the personal data this website collects. In client work we act as a processor, as explained below. For anything about your data, write to hello@enocto.com.

• Contact form. Your name, email address and message. With each submission we also record your IP address, the country it is associated with (as reported by our network provider, Cloudflare), your browser's user agent, the time you sent it and the result of an automated spam check.
• Emails. If you write to us directly, we receive your address, your message and anything you attach.
• Server logs. Each page request is logged with the IP address, date and time, the page requested, the referring page and the user agent.
• Anti-abuse records. Short-lived counters and checksums, for example how many messages came from one IP address, which email addresses were used under one name, or a hash of the message text, used to stop repeated and automated submissions.

This website has no analytics, advertising tags or tracking pixels, and it does not set cookies of its own. Cloudflare may set a strictly necessary security cookie to tell people from bots.

• To answer your enquiry and prepare a proposal you asked for (Article 6(1)(b) GDPR). If you write on behalf of a company, we rely on our legitimate interest in replying to it (Article 6(1)(f) GDPR).
• To keep the website secure, free of spam and working as designed, including loading its scripts from the providers listed below, which is our legitimate interest (Article 6(1)(f) GDPR).
• To keep the records the law requires once we work together, such as accounting documents (Article 6(1)(c) GDPR).

You do not have to give us your details, but without an email address we cannot reply to you. The spam check scores each submission automatically. Messages it flags are set aside for a person to review rather than discarded, and the check has no legal or similarly significant effect on you.

When a business hires us, it can give us access to its Meta ad accounts, Facebook Pages and Instagram accounts, and to its Google Ads accounts, through the platforms' own sharing tools and official APIs. Within that access, and only on the client's instructions, we may:

• set up, run and report on advertising campaigns;
• read performance statistics;
• publish and schedule posts;
• send conversion events from the client's website to the platform, for example through the Meta Conversions API. Customer identifiers such as email addresses and phone numbers are hashed before sending, as the platform requires.

For this work the client is the controller and we act as its processor under Article 28 GDPR. We do not sell this data, use it for our own advertising or profiling, or combine one client's data with another's. We access it only through official APIs and in line with each platform's terms and policies. If you are a customer of one of our clients, please contact that business first; we will help it respond to you.

• Hosting. Our server is rented from Contabo GmbH and located in Germany. Our fonts and email run on the same server, not through third-party services.
• Cloudflare, which delivers and protects the website.
• Script providers. When you open the home page, your browser loads animation scripts from cdnjs and unpkg. These providers receive your IP address as part of that request.
• Advertising and social platforms (Meta, Google), only when we work for a client as described above.
• Authorities, where the law requires it.

Cloudflare, Google and Meta are based in the United States or process data there. For these providers, transfers rely on the EU-US Data Privacy Framework or on the European Commission's Standard Contractual Clauses. You can ask us for details of these safeguards.

• Enquiries and emails: while we are in touch about your request. If it leads to work together, for the length of the contract and then as long as Latvian accounting and tax law requires. Enquiries that do not lead to work, including submissions flagged as spam, are deleted within 24 months of the last contact.
• Server logs: 14 days, then deleted automatically.
• Anti-abuse records: between one hour and seven days, then deleted automatically.
• Data from client platforms: for the length of the engagement. When it ends, we delete or return it as the client instructs.

You can ask us for a copy of your personal data, to correct it, to delete it, to restrict how we use it, or, where the law gives you that right, to receive it in a portable format. You can also object to processing based on our legitimate interests. Write to hello@enocto.com. We reply within one month; if a complex request needs up to two more months, we tell you within that first month. We may ask you to confirm your identity first. Our Data Deletion page explains the steps for deletion.

If you think we handle your data unlawfully, you can complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, dvi.gov.lv) or to the data protection authority in your own EU country.

The website is served only over encrypted connections (HTTPS). Access to enquiries and client data is limited to the people who need it for the purposes above, and our systems are kept up to date and backed up.

We may update this policy when our services or the law change. The date at the top shows when the current version took effect.