Privacy Policy

SIA Cactus (hereinafter – We or Cactus) takes data protection seriously and has therefore drawn up this privacy policy to provide clear and understandable information on how we process personal data. This policy is an informative document and its purpose is to ensure transparent processing of personal data. Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), the Personal Data Processing Act and other applicable legislation.

DATA CONTROLLER:

Cactus Limited Liability Company
Registration number: 40203007573
Registered address: Daugavgrīvas iela 21, Riga, LV-1048

WHAT DATA DO WE PROCESS?

We process only the data that is strictly necessary and only when you provide it to us voluntarily, for example, for communication, consultation or to submit a request (including via the contact form), as well as technical data generated when you visit our website.

Data provided directly:

First name and surname
Email address
Telephone number
Content of message or request

Technical data:

Device and browser used
IP address and other network identifiers
Website visit data (pages, time of access)
Data from cookies (see the Cookie Policy for details)

We do not process special categories of personal data. We use the personal data you provide solely for the purposes clearly set out in this Privacy Policy, and do not use it for any other purposes, except where there is a legal basis for doing so under applicable legislation or where this is done with your prior consent, if required. If personal data is obtained not directly but from publicly available sources or from business partners, we process it only to the extent necessary to achieve the specific purpose.

PURPOSE OF DATA PROCESSING AND LEGAL BASIS

Cactus processes personal data only where there is a legal basis for doing so. Below is a summary of each processing purpose, its legal basis and what this means in practice.

Purpose	Legal basis	What this means in practice
Responding to questions and requests	Legitimate interests	When you write to us or fill in the contact form, we process your data in order to reply. You expect a reply - we provide it
Pre-contractual measures	Pre-contractual measures	If you request a quote or consultation, we process your data to prepare a response to your enquiry
Provision and maintenance of services	Performance of the contract	When we enter into a contract, we process the necessary data to fulfil it - we provide the service, update it and resolve any issues related to it
Invoicing and payment processing	Performance of the contract; Legal obligation	We process payment data both for the performance of the contract and because the law requires accounting documents to be retained for 10 years
Compliance with accounting requirements	Legal obligation	We process the data that we are obliged to process in accordance with applicable legislation
Ensuring the operation and security of the website	Legitimate interests	Technical data helps ensure that the website operates securely and reliably. This does not require your consent
Analytics and marketing cookies	Consent	We only use Google Analytics and marketing cookies if you have consented to this. You can withdraw your consent at any time via the website’s cookie settings
Service improvement and development	Legitimate interests	We analyse customer needs to improve existing services and develop new ones. The data used for this purpose is aggregated and anonymised
Customer support	Performance of a contract; legitimate interests	We process the necessary data in order to provide high-quality assistance and resolve any issues that may arise

DURATION OF PROCESSING AND DATA RETENTION

Cactus will process the aforementioned data for as long as any of the aforementioned legal grounds for the processing of personal data remain valid, but for no longer than:

Categories of personal data	Retention period
Correspondence	Until the end of the communication, then up to 3 years
Contact details (first name, surname, email, telephone number)	Until the end of the communication, then up to 3 years
Service contract data	10 years after the end of the contract
Invoices and payment details	10 years after the end of the contract
Marketing data	Until consent is withdrawn
Essential cookies	In accordance with the Cookie Policy
Analytics and marketing cookies	In accordance with the Cookie Policy
Google Analytics data	13 months

Once the purpose of processing has been achieved, the data is deleted or anonymised within a reasonable timeframe; however, in certain cases, the data may be retained for longer if required by law or if it is reasonably necessary to protect our legitimate interests.

DATA TRANSFER TO THIRD PARTIES

We do not sell or disclose your data to others. However, to provide high-quality services, we require various partners:

AJ Power Corporate Group - Cactus operates within the AJ Power Corporate Group, so data is shared between group companies where it is logically necessary, for example, for IT support, centralised customer service or invoice processing. Each group company has access only to the data it specifically needs, and no more.
IT and technology service providers - system developers, maintainers, hosting and data centre services, content delivery networks.
Marketing and analytics tools - advertising campaign platforms and analytics services, which are used only with your prior consent.
Accounting and financial services - invoice processing and auditing.
Government authorities - where required by law or at the request of an authority.

All partners are contractually bound to protect your data and receive only the minimum necessary information.

Transfer of data outside the EU: Certain tools, including Google Analytics, may process data outside the European Union. Google Analytics is only activated with your consent. Google LLC is a certified participant in the EU- US Data Privacy Framework, which ensures an adequate level of protection for data transfers. In all other cases where data is transferred outside the EU, we ensure appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission.

YOUR RIGHTS

You have the right to request access to and rectification of your personal data, to request erasure, restriction of processing, to object to processing, as well as the right to data portability in the cases specified by law. You may exercise your rights by contacting us using the contact details provided below. We will assess each request and its validity in accordance with applicable legislation and provide a response within 30 days. Before providing information, we may need to verify the identity of the applicant, so we may request additional information. The provision of personal data is a prerequisite for receiving services and entering into a contract with us.

DATA SECURITY AND INTEGRITY

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction. Access to data is restricted to those employees and partners who require it, and they are bound by confidentiality requirements. Cactus’s information security management system is certified to the ISO/IEC 27001 standard, which means that our security processes are regularly independently audited and maintained to an internationally recognised standard. Absolute security cannot be guaranteed by anyone, but we do everything possible to ensure your data is secure. In the event of a serious data security incident, we will act in accordance with GDPR requirements and, if necessary, notify both the supervisory authority and the individuals concerned.

CHANGES TO THE PRIVACY POLICY

In line with current legislation, Cactus may from time to time update this Privacy Policy or adopt a new version of it. This is necessary to ensure that the policy reflects our latest privacy terms. The current Privacy Policy is always available on the Cactus website at www.cactus.lv.

CONTACT INFORMATION

If, after reading our Privacy Policy, you have any questions or concerns, please contact the AJ Power Group’s data protection specialist at via email: compliance@ajpower.lv telephone: +371 22495957 or by post to the address: Daugavgrīvas iela 21, Riga, LV-1048, Latvia. If, whilst working with AJ Power, we are unable to assist you with a data processing issue, you may lodge a complaint with the Data State Inspectorate using one of the following contact details: pasts@dvi.gov.lv ,+371 67223131, Elijas iela 17, Riga, LV-1050.

Document effective from: 25 March 2026