Last updated 31 July 2026
Data controller
The data controller is SIA MG Alliance, registration No. 40003897463, registered address: Hospitalu street 23–102, Riga, LV-1013, Latvia. For privacy enquiries, email info@mg-a.lv or call +371 27 028 454 or +371 27 028 456.
Scope
This policy applies to the mg-a.lv website, the MG-A client portal at portal.mg-a.lv and communications related to our services.
Data sources
We obtain personal data directly from you, from our clients and their authorised representatives, from documents uploaded to the portal, and from publicly available registers where this is necessary to provide a service or comply with legal requirements.
What data we process and why
- Contact details and correspondence, to respond to enquiries, prepare proposals and maintain the business relationship. The legal bases are steps before entering into a contract, performance of a contract and our legitimate interest in maintaining communication.
- Portal identity, account, access and activity data, to authenticate users, manage permissions and protect the system. The legal bases are performance of a contract and our legitimate interest in providing a secure service.
- Accounting documents and the personal data they contain, to provide accounting, tax and related services and comply with legal obligations. Depending on the service arrangement, MG Alliance processes this data either as a controller or as a processor acting on the client's instructions.
- Technical and security data, such as session, access and error records, to operate the portal, prevent incidents and protect information. The legal basis is our legitimate interest in system security.
Requirement to provide data
Providing contact details before a business relationship begins is voluntary, but without them we cannot respond to an enquiry or prepare a proposal. Providing data required for a portal account and delivery of the service is a contractual or statutory requirement; without those data, portal access or the relevant service may not be available.
Recipients and service providers
Data is available only to authorised MG Alliance employees and service providers who need it to perform their tasks. We use IT infrastructure, hosting, email and document storage services, including Hetzner and Microsoft 365 / SharePoint. Data may be disclosed to public authorities where required by law.
If a provider processes data outside the European Economic Area, the transfer is made using safeguards provided by the GDPR, such as an adequacy decision or the European Commission's standard contractual clauses.
Retention
We keep personal data only for as long as necessary for the relevant purpose. Accounting documents in the portal are assigned a retention review date no earlier than five years after the end of the relevant reporting period; deletion is not automatic and contractual and statutory requirements are assessed first. Data relating to a concluded contract is kept during the business relationship and afterwards for as long as required to meet legal obligations and defend legal claims. An enquiry that does not lead to a business relationship is kept until it has been handled and afterwards only for as long as necessary to demonstrate how it was handled. Portal account data is kept while the account is active; access and audit records are kept for as long as required for security control and incident investigation. Technical application error logs are normally kept for up to 14 days, except for records required to investigate a specific incident or defend legal claims.
Automated processing
The portal may use local document text recognition to suggest accounting fields. An employee reviews the results. We do not make solely automated decisions that produce legal or similarly significant effects for individuals.
Your rights
Under the GDPR, you may have the right to access, correct or erase your data, restrict processing, object to processing and receive data in a portable format. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.
To exercise your rights, email info@mg-a.lv. You may lodge a complaint with the Latvian Data State Inspectorate: Elijas iela 17, Riga, LV-1050, pasts@dvi.gov.lv, www.dvi.gov.lv.
Changes to this policy
We may update this policy when our services or legal requirements change. The current version is always available on this page.