Privacy policy
This policy explains how SIA "DDA Projects" processes personal data when you visit the Readymark website, use the workspace, contact the company or subscribe.
Controller
SIA "DDA Projects", registration no. 40203546787, Elizabetes iela 19-7, Rīga, LV-1010, Latvia. Email: hello@getreadymark.app.
What is processed, why, and on which legal basis
| Data | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Name, company, work email and message from the contact form | Answering your enquiry | Art. 6(1)(b) steps before a contract, or 6(1)(f) legitimate interest in answering business enquiries | 24 months after the last contact |
| Name, email, company, billing address, VAT number, subscription and invoice records | Selling and invoicing the subscription | Art. 6(1)(b) contract; 6(1)(c) accounting and tax law | Accounting records for the period Latvian law requires; other data until the subscription ends plus 12 months |
| Card or bank details | Taking payment | Art. 6(1)(b) contract | Processed by Stripe; SIA "DDA Projects" does not receive full card numbers |
| Component names and versions sent in a scan, the licence token sent with it, IP address and request logs | Running the scan and keeping the service secure | Art. 6(1)(b) contract; 6(1)(f) security | Not stored after the scan; hosting logs as kept by Netlify |
| Information shared for Desk reviews and report drafts | Providing the Desk plan | Art. 6(1)(b) contract | Until the subscription ends plus 12 months, unless the law requires longer |
Data kept in your browser
The workspace saves your products, components, requirement notes and reports in your browser's local storage. That data does not reach SIA "DDA Projects" unless you send it.
After a purchase, your browser also stores a licence token that confirms your plan. The token contains your billing email, your plan, the Stripe customer and subscription references, and its issue and expiry dates. It is signed but not encrypted, so anyone with access to your browser profile can read it. The workspace sends the token with plan checks, scans and billing requests so the server can confirm your plan. Clearing this site's data in your browser deletes it.
The workspace data and the licence token are needed for the service to work, so the site does not use a consent banner for them. The site sets no advertising or analytics cookies.
Service providers
- Netlify, Inc. (hosting, contact form and serverless functions), United States. Transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.
- Stripe Payments Europe, Ltd. (payments, invoices and the billing page), Ireland. Stripe acts as an independent controller for some payment and fraud-prevention data under its own privacy policy.
- Google LLC (web fonts loaded from fonts.googleapis.com), which receives your IP address when the page loads.
- OSV.dev (Google) receives the component names and versions from the scan function, without your identity.
- The scan function downloads the public CISA Known Exploited Vulnerabilities catalogue from cisa.gov. CISA receives no component names, versions or other data about you.
Your rights
You may ask for access to, correction or deletion of your personal data, restriction of processing, data portability, and you may object to processing based on legitimate interest. Write to hello@getreadymark.app. You may also complain to the Latvian Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv) or the authority in your country.
Changes
SIA "DDA Projects" may update this policy. The version date at the top shows the current version.