Who controls your data
SIA Omnic, trading through the SLS Alliance brand, is the controller of the personal data processing described in this notice.
- Company: Sabiedrība ar ierobežotu atbildību “Omnic” (SIA Omnic)
- Registration number: 40203390618; VAT number: LV40203390618
- Legal address: Mazā Nometņu iela 31, Rīga, LV-1002, Latvia
- Website and brand: slsalliance.org and SLS Alliance
Contact legal@slsalliance.org for privacy questions or to exercise your rights. We have not appointed a data-protection officer and do not represent that this address is a statutory DPO contact.
What we collect and why
We collect data you provide, limited technical data generated when you use the site, and optional analytics data only after your choice.
- Contact requests: name, email, inquiry type, message, attachment, language, page and delivery metadata so we can answer and route your request.
- Vacancy applications: name, email, phone, location, salary information, language and experience choices, cover letter, CV, role, application time and workflow metadata so we can assess and manage the application.
- Website operation and security: IP address, user agent, origin/request information and technical logs used for delivery, rate limiting, fraud prevention and diagnostics.
- Consent preference: a first-party value recording the current policy version and whether optional analytics was accepted or rejected.
- Optional analytics after acceptance: query-free page path, general browser/device and language information, approximate location derived by Google, session/campaign information, and approved page, download, link, language, vacancy and successful-submission events.
We do not send form contents, names, email addresses, phone numbers, CVs, salary information or free text to Google Analytics. We do not sell personal data or use the website data for solely automated decisions producing legal or similarly significant effects.
Legal bases
We use the legal basis that matches the purpose and context of each activity. Submitting a vacancy form confirms the stated application notice; it is not consent to analytics.
- Steps requested before a contract: responding to a relevant commercial request or processing a job application.
- Legitimate interests: operating and securing the website, responding to genuine communications, preventing abuse, maintaining reliable delivery, administering recruitment, and establishing or defending claims, balanced against your rights.
- Consent: optional Google Analytics. You can refuse or withdraw without losing access to the website or forms.
- Legal obligations: records or actions that applicable law requires us to retain or perform.
Recipients and service providers
We disclose personal data only to authorized staff and providers needed for the purposes above, or where law requires it.
- Railway provides website hosting, PostgreSQL, private object storage and operational infrastructure.
- Google provides Gmail delivery and, only after analytics consent, Google Analytics 4.
- PeopleForce receives and manages vacancy candidate/application data for recruitment.
- Authorized SLS Alliance technical, commercial and recruitment staff and intended internal email recipients access data only as required for their duties.
Providers must process data under applicable contracts and security obligations. We do not authorize them to use contact or recruitment data for their own advertising.
International transfers
Railway, Google and PeopleForce may use infrastructure or subprocessors outside Latvia or the European Economic Area. This can involve countries with different data-protection laws.
Where required, transfers rely on an adequacy decision, Standard Contractual Clauses or another lawful safeguard together with provider contractual and security measures. Contact legal@slsalliance.org for information relevant to a specific transfer or available safeguard.
How long we keep data
We use the following standard periods, measured from the event stated for each category.
- Ordinary contact requests and aligned Gmail messages: 24 months after the last substantive communication.
- Unsuccessful or closed recruitment applications in SLS systems, Gmail and PeopleForce: 12 months after the latest application or meaningful update; no longer talent-pool use without a separate opt-in.
- Spam submissions and raw IP/user-agent fields: 30 days unless needed for an active security incident.
- Temporary uploads: about 10 minutes; durable contact/application attachment bytes in the private Bucket: 90 days. Minimal deletion/status metadata may remain with the parent record.
- Google Analytics event and user data: 14 months with reset on new activity disabled; analytics cookies may remain up to two years after their latest update.
- Consent preference: six months; a material policy-version change asks for a new choice.
- Vacancy synchronization run records: 180 days. Operational delivery metadata is kept only as needed with the related record.
We may restrict and retain specific data longer where an active relationship, recruitment process, legal obligation, dispute, security incident or documented legal hold requires it. Protected backups may expire on a separate cycle and are not returned to ordinary use after an approved deletion.
Security
We use access controls, encrypted transport, private object storage, validation, origin and size checks, rate limits, restricted credentials, security headers and monitored delivery workflows to reduce unauthorized access, loss or misuse.
No online service can guarantee absolute security. If you believe personal data has been exposed or misused, contact legal@slsalliance.org and do not send passwords, recovery codes or unnecessary identity documents.
Your rights
Depending on the processing and applicable law, you may have the following rights.
- Ask for access to your personal data and information about its use.
- Ask us to correct inaccurate or incomplete data.
- Ask for erasure or restriction where the legal conditions apply.
- Object to processing based on legitimate interests; we will assess your circumstances and any overriding grounds.
- Withdraw analytics consent at any time through Cookie settings, without affecting processing that was lawful before withdrawal.
- Receive data you provided in a portable format where the portability right applies.
Send a request to legal@slsalliance.org. Describe the request and the email or context used with us. We may request proportionate information to verify identity or authority. We normally respond within one month, subject to lawful extensions, and do not charge unless a request is manifestly unfounded or excessive.
Complaints
We encourage you to contact legal@slsalliance.org first so that we can investigate and respond. This does not limit your right to contact a supervisory authority or seek a judicial remedy.
The Latvian supervisory authority is the Data State Inspectorate, Elijas iela 17, Rīga, LV-1050, Latvia; pasts@dvi.gov.lv; dvi.gov.lv. You may also complain to the authority in the EEA country where you live, work, or consider an infringement to have occurred.
We may update this notice when our services, providers, retention decisions, or legal obligations change. Material changes will be identified by a new date and, where required, a renewed choice.
Last updated: 14 September 2026. Questions and privacy requests should be sent to legal@slsalliance.org.
