Last updated 31 July 2026
Data controller
The data controller is SIA MG Alliance, registration No. 40003897463, registered address: Hospitalu street 23–102, Riga, LV-1013, Latvia. For privacy enquiries, email info@mg-a.lv or call +371 27 028 454 or +371 27 028 456.
Scope
This policy applies to the mg-a.lv website, the MG-A client portal at portal.mg-a.lv and communications related to our services.
What data we process and why
- Contact details and correspondence, to respond to enquiries, prepare proposals and maintain the business relationship. The legal bases are steps before entering into a contract, performance of a contract and our legitimate interest in maintaining communication.
- Portal identity, account, access and activity data, to authenticate users, manage permissions and protect the system. The legal bases are performance of a contract and our legitimate interest in providing a secure service.
- Accounting documents and the personal data they contain, to provide accounting, tax and related services and comply with legal obligations. Depending on the service arrangement, MG Alliance processes this data either as a controller or as a processor acting on the client's instructions.
- Technical and security data, such as session, access and error records, to operate the portal, prevent incidents and protect information. The legal basis is our legitimate interest in system security.
Recipients and service providers
Data is available only to authorised MG Alliance employees and service providers who need it to perform their tasks. We use IT infrastructure, hosting, email and document storage services, including Hetzner and Microsoft 365 / SharePoint. Data may be disclosed to public authorities where required by law.
If a provider processes data outside the European Economic Area, the transfer is made using safeguards provided by the GDPR, such as an adequacy decision or the European Commission's standard contractual clauses.
Retention
We keep personal data only for as long as necessary for the relevant purpose. Accounting documents in the portal are assigned a retention review date no earlier than five years after the end of the relevant reporting period; deletion is not automatic and contractual and statutory requirements are assessed first. Contracts, correspondence and other data are retained according to the business relationship, limitation periods and applicable legal requirements. Technical data is retained for as long as needed for security and incident investigation.
Automated processing
The portal may use local document text recognition to suggest accounting fields. An employee reviews the results. We do not make solely automated decisions that produce legal or similarly significant effects for individuals.
Your rights
Under the GDPR, you may have the right to access, correct or erase your data, restrict processing, object to processing and receive data in a portable format. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
To exercise your rights, email info@mg-a.lv. You may lodge a complaint with the Latvian Data State Inspectorate: Elijas iela 17, Riga, LV-1050, pasts@dvi.gov.lv, www.dvi.gov.lv.
Changes to this policy
We may update this policy when our services or legal requirements change. The current version is always available on this page.