Privacy policy

Privacy contact

For questions about personal data processing, contact Kristine Dubane at kristine@dubane.estate. Information submitted through the website is used to review your enquiry, provide a response and, at your request, prepare the next steps for working together.

Data we process

• contact-form data: name, phone number or email, reason for contacting, message, language and privacy acknowledgement;
• information about your circumstances, property and intended transaction that you provide during correspondence or cooperation;
• technical security data, including IP address, request time, basic browser and device information, and pseudonymised rate-limit records used to prevent misuse;
• listing-editor account and session data, only for Kristine as the authorised editor.

Purposes and legal bases

• to answer an enquiry and take steps at your request before entering into a contract — Article 6(1)(b) GDPR;
• to arrange a consultation or viewing, prepare a proposal, provide agreed services and perform a contract — Article 6(1)(b) GDPR;
• to protect the website, prevent spam and misuse, and establish or defend legal claims — legitimate interests under Article 6(1)(f) GDPR;
• to meet accounting, transaction-checking and other statutory duties if cooperation begins — Article 6(1)(c) GDPR;
• where consent is specifically requested for a processing activity — Article 6(1)(a) GDPR; consent may be withdrawn for future processing.

Recipients and technical service providers

Data is not sold. It is accessible only to Kristine, the relevant service provider and technical processors to the extent required to provide the service:

• Cloudflare provides network, security and hosting infrastructure;
• OpenAI Sites provides the website publishing and application infrastructure;
• FormSubmit receives contact-form content to deliver it technically to kristine@dubane.estate; FormSubmit's documentation states that submissions may be retained for up to 30 days;
• other providers, such as a bank, lawyer or transaction partner, receive data only where this is necessary for the particular request, contract or legal duty.

Processing outside the European Economic Area

The use of Cloudflare, OpenAI Sites or FormSubmit infrastructure may involve processing outside the European Economic Area. Where applicable, transfers rely on a mechanism permitted by the GDPR and appropriate safeguards. Cloudflare's data-processing terms state that EU Standard Contractual Clauses are used for restricted international transfers.

Retention

• FormSubmit may retain a contact-form submission for up to 30 days;
• correspondence is kept while the enquiry is handled and afterwards only for as long as reasonably required to document the cooperation, establish or defend legal claims, or meet statutory duties;
• pseudonymised anti-spam rate-limit records are used for a 15-minute protection window; records older than 24 hours are deleted during subsequent form processing;
• an editor session lasts for up to 12 hours, or up to 30 days when “Remember me” is selected. Account data is kept while the editor authorisation remains active.

Your rights

You may request access to, correction or deletion of your data, restriction of processing, and data portability where applicable, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. Send requests to kristine@dubane.estate.

If you believe your data is not being processed properly, please contact us first. You also have the right to lodge a complaint with the Latvian Data State Inspectorate.

Security

Reasonable technical and organisational measures are used, including encrypted HTTPS connections, server-side validation, access controls, protected editor sessions and rate limiting. No transmission or storage method can guarantee absolute security.

Cookies

The website does not use analytics, advertising or marketing cookies. Only cookies required for operation and security are used, so a consent banner is not necessary.