Updated on 25 October 2026. This policy applies to visits to cers.lv, workshop applications and related communications.

Who is responsible for your data

The data controller is Eduards Cers. For questions about processing or your rights, write to eduards@cers.lv.

What data I receive

The application asks for the contact person's full name, email address and telephone number so I can contact you about attendance and the course. The description of the skills you would like to learn is optional. I also receive the chosen programme, schedule, number of participants, their names and self-reported experience with AI on a scale of 1 to 5, and the calculated participation fee.

If the payer is a company or organisation, I receive its name, legal address and registration number. A company application must also include the bank and bank account number for invoicing. Provide a VAT number if the organisation is VAT registered. The optional “Additional invoice information” field can contain a project number, clarifications about the payer or recipient, or other details needed to prepare the invoice. I do not ask for personal identification numbers, payment card details or access passwords. I record the application time and the version of this privacy policy used.

If you register other participants, inform them about this policy before submitting and make sure you are authorised to share their data. I receive their data from the person submitting the application and do not use it for other purposes.

Why I use data and on what basis

  • I use contact details and application content to respond, clarify attendance and communicate about the course. If you apply for yourself, the basis is taking steps at your request before entering into a contract and performing that contract: Article 6(1)(b) of the GDPR.
  • Processing the data of an organisation's contact person and its registered participants is based on the legitimate interest in arranging the requested training and communications: Article 6(1)(f) of the GDPR. AI experience and the optional skills description help me prepare suitable tasks for the group; the rating is not a selection criterion.
  • If we agree on participation after contacting you, I use billing details to prepare an invoice manually. Accounting documents are subject to legal obligations, including Latvia's Accounting Law: Article 6(1)(c) of the GDPR.
  • To protect forms and administration from misuse, I process necessary technical security data, such as session identifiers and temporary request-limit records. The basis is the legitimate interest in maintaining a secure website: Article 6(1)(f) of the GDPR.
  • I use Google Analytics 4 to understand visits to public pages and improve content. Analytics starts only after valid consent using “Allow analytics”. Closing the banner or continuing to use the website does not constitute consent.

I do not use application data to create advertising lists or send unrelated commercial messages. The privacy checkbox acknowledges that you have read the information; it is not consent to advertising. There is no automated selection of participants or profiling. The fee per participant is fixed and does not change with the number of participants.

Where data goes and who can access it

The application is stored in the website's protected database and sent to meistarklase@cers.lv. An automatic receipt with the chosen programme and schedule is sent to the contact email provided in the application. This is not confirmation of attendance or payment. Access is limited to the controller and authorised people who need it to organise training. Technical processing is provided by the website hosting and database provider and Google's email service. In some cases, invoice details are available to an accounting provider or authorities where required by law.

Google's infrastructure may involve processing outside the European Economic Area. Such processing must use a mechanism applicable to that service under Chapter V of the GDPR, such as a European Commission adequacy decision or standard contractual clauses. You may ask the controller for information about specific providers and safeguards.

I do not automatically share free-text application answers with AI services. Before the training, I will send separate information about joining and the tools used during the sessions.

How long I keep data

For a scheduled programme, I keep application data for up to 12 months after its last session to provide communications and follow-up support. For an enquiry without a scheduled date, the period is up to 12 months after submission. I then delete the application from the website and unnecessary email copies. If a specific dispute or legal claim needs to be resolved, I may retain only the necessary data until it is resolved or the applicable claim period ends.

Manually issued invoices and other accounting documents have separate statutory retention periods. The application description and AI experience rating do not need to be retained with the invoice. Retention of hosting logs and backups depends on the chosen service and is limited to what is necessary for security and recovery.

Minimal internal statistics

To evaluate the website and campaigns, I aggregate page views and received workshop applications. The browser sends a request to this website containing an allowed public page path and validated source, medium and campaign labels. The application counter increases only after successful saving. Statistics tables contain daily totals by page and labels, rather than an individual event history. This counting does not use cookies, visitor profiles, session recognition, IP hashes or browser identifiers. I do not remember a campaign label for a later visit without that label.

If an application includes valid campaign labels, I also save its source, medium and campaign with that application to identify the labelled application source. These labels may remain when a link is forwarded and do not independently prove a person's original source.

Statistics tables do not store IP addresses, User-Agent, precise individual event times, full URLs or referrer addresses, contact details or form content. Aggregates are retained for 3 months. Days use the Europe/Riga time zone. Reloading a page or returning with the browser's Back button may count as a new view. I exclude recognised bots, but not all bots can be identified; the metric is not a count of unique people. Blockers, disabled JavaScript, technical failures and load limits can reduce counting.

The server necessarily receives network requests, and the hosting or security systems may keep separate access logs containing IP addresses and request information. These are not the aggregate records described here. I do not arbitrarily disable security logs or promise absolute anonymity across all infrastructure. Internal statistics are used to evaluate the website and training offering; the controller must separately assess the applicable legal basis, proportionality and actual hosting log retention. Not using cookies does not itself establish legal compliance.

Cookies and Google Analytics

I load Google Analytics 4 only after valid consent using “Allow analytics”. Before a choice and after “Reject”, no Google analytics tag is loaded, its cookies are not created, and no cookieless analytics requests are sent either. Closing, scrolling or continuing to browse is not consent. Google Signals and advertising personalisation are not enabled.

After consent, Google Analytics helps analyse public page visits using pseudonymous browser and session identifiers and general information about the device and visit. In Europe, the service is provided by Google Ireland Limited; infrastructure outside the European Economic Area may be used with the safeguards described above. More information: Google's privacy policy, how Google uses website data and Google Analytics data protection.

Administration, application forms, private confirmations and error pages are not measured by Google Analytics. I do not send names, email addresses, telephone numbers, billing details, application IDs, experience ratings or answers. Query parameters and fragments are removed from page addresses; only the referrer's origin is retained. Automatic enhanced measurement of forms and other elements is disabled.

  • Necessary session cookie (cers_admin): protects applications and maintains administrator authentication. It ends with the browser session.
  • cers_admin_remember: only when “Remember me for 60 days” is selected at administrator login, a protected cookie remembers that browser for up to 60 days and restores an expired administrator session. The database stores only a hash of the secret token. Signing out or changing account credentials revokes access. The cookie is not used for analytics or advertising.
  • cers_analytics_choice: a first-party choice cookie stores only consent or rejection, choice and expiry times, purpose and version for up to 180 days. It contains no visitor ID. Current version: 2, purpose analytics-2026-10-optin. After expiry, I block analytics until a new choice. Valid earlier rejections are preserved until expiry; an old “Understood” notice entry is not consent.
  • cers_language_v1: local browser storage remembers the chosen website language, contains no visitor ID and is not used for statistics.
  • _ga and _ga_*: only after consent, these help Google Analytics distinguish browsers and sessions. The code limits their lifetime to 180 days; the browser may shorten it. GA4 user-level and event-level retention is two months; standard aggregate reports may remain longer.

You can choose “Reject” and withdraw consent at any time through “Cookie settings” in the footer. This stops further analytics, removes accessible GA cookies for this domain and prevents the tag loading on subsequent pages. A public page can be safely reloaded to unload the library; an application form is not automatically reloaded. Withdrawal does not erase data already sent to Google. If the browser blocks choice storage, the choice works only on the current page and must be made again next time.

GA operates only on HTTPS cers.lv and www.cers.lv. Local development sends no data to Google. Internal aggregates and Google Analytics are separate measurements and are not added together.

Data security

Public website transmission must use HTTPS; email transmission uses encrypted SMTP. Application data is not publicly accessible, and administration requires authentication. Email cannot guarantee absolute confidentiality, so I collect only information necessary to organise training.

Your rights

You may request access to your data, correction, deletion or restriction of processing, and portability where applicable. You may object to processing based on legitimate interests. These rights are not absolute: for example, a required accounting document cannot be deleted before its mandatory retention period ends.

Send requests to eduards@cers.lv. I verify identity proportionately and do not request unnecessary documents. I respond without undue delay, normally within one month; where the law permits an extension, I will inform you. You have the right to complain to Latvia's Data State Inspectorate.

Without mandatory contact details, I cannot process the application. Leaving optional fields blank does not prevent you from applying. If the policy changes, I publish a new version here; for material changes, I also inform the affected application contact persons.