Privacy policy

Sample text - the final version is to be approved by the Client. The text is based on the planned functionality of the platform and must be reviewed by a lawyer before publication.

1. Controller and contacts

The controller of personal data on the EXIT RĪGA website exitriga.lv, in the mobile app and its web version (hereinafter - the platform) is:

Association “Pierīgas tūrisma asociācija”
Registration No. 40008303991
Andreja iela 1a, Baldone, Ķekava Municipality, LV-2125
Phone +371 26 191 044, email info@exitriga.lv

For questions about data processing and exercising your rights, write to info@exitriga.lv with the subject “Personal data”.

2. What data we process

• Account data - name, email, password (stored only in encrypted form), language and notification settings. If you sign in with Google, Apple ID or Facebook, we receive your name and email from that account.
• Favourites and routes - the places and lists you have saved and the routes you have created.
• Quest data - purchased quests, progress (checkpoints reached, answers, time) and your nickname on the leaderboard.
• Purchase data - order number, amount, date and status. Card details are processed by the payment service provider Stripe; we do not see or store them.
• Location - only if you allow it on your device (see section 5).
• Communication - conversations with the AI assistant and service providers, suggestions and problem reports, reviews.
• Technical data - device and browser type, IP address, pages visited and actions on the platform (see section 7).

3. Purposes and legal basis

• Account, favourites, routes and quest progress - performance of a contract (GDPR Article 6(1)(b)).
• Quest sales, invoices and accounting - performance of a contract and a legal obligation (point (c)).
• Purchase notifications and reminders - performance of a contract.
• News and offers by email or push notification, including about places saved in your favourites - your consent (point (a)), which you can withdraw at any time in your account settings.
• Personalised recommendations based on the services viewed and purchases - our legitimate interests (point (f)); you can turn personalisation off in your account settings.
• Aggregated statistics on tourist flows for the development of the region - legitimate interests, using only anonymised data.
• Platform security and troubleshooting - legitimate interests.

4. Payments

Paid quests are paid for with Stripe (cards, Google Pay, Apple Pay). Payments are processed by Stripe in accordance with its own privacy policy and the payment card industry security standard; transactions are confirmed with 3D Secure. We receive only the confirmation, the amount and the order details.

5. Location

We use your location to show the nearest places and the distance to them, and to automatically check off a quest checkpoint when you are near it. Your location is determined by your device and is used only with your permission, which you can withdraw in your device settings.

During a quest we store only the fact that a checkpoint has been reached, not the route you travelled.

6. AI assistant and recommendations

On service pages you can chat with an artificial intelligence (AI) assistant. Your questions are sent to the AI service provider to prepare an answer, and the conversation history is stored so that you can return to it and to improve the quality of the answers. Do not share sensitive personal data in the conversation.

If the AI cannot answer, the conversation can be continued with the service provider; the provider then sees the content of the conversation.

7. Cookies and analytics

We always use the cookies necessary for the platform to work (sign-in, language choice, cart). We use analytics tools (for example, Google Analytics or Firebase Analytics) only with your consent, which you can change in the cookie settings.

Analytics data are anonymised and used for aggregated statistics - for example, the most popular routes, the most searched places and quest completion times.

8. Who we share data with

• Service providers - only what is needed to fulfil the order (for example, your name and order number).
• Processors - hosting, email and push notification, payment (Stripe), analytics and AI service providers with whom data processing agreements have been concluded.
• Public authorities - only in cases laid down by law.

We do not sell data or pass it on to third parties for their marketing. If a processor processes data outside the European Economic Area, we do so using standard contractual clauses approved by the European Commission.

9. Where and how long we store data

The platform database and backups are located on servers in Latvia (European Union).

• Account data - while the account is active; after the account is deleted - within 30 days.
• Purchase and invoice data - 5 years, as required by accounting law.
• AI conversations and communication - 12 months.
• Analytics data - anonymised, up to 26 months.

10. Security

All connections use HTTPS, passwords are stored only in encrypted form, only authorised staff have access to the data, and actions involving purchases are logged.

11. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• access your data and receive a copy of it;
• correct inaccurate data (you can also do this in your account settings);
• delete your data and account;
• restrict or object to processing, including personalised recommendations;
• receive your data in a portable format;
• withdraw your consent at any time, without affecting the lawfulness of earlier processing.

We respond to requests within one month. If you believe your rights have been infringed, you can lodge a complaint with the Data State Inspectorate (dvi.gov.lv).

12. Changes to this policy

We will inform you of significant changes on the platform and, if you have an account, by email. The current version is always available on this page.