Privatumo politika

1. Duomenų valdytojas

The data controller responsible for your personal data is:

Company: Turgo SIA
Address: Riga, Latvia, LV-1050
Registration: 40203XXXXXX
Email: privacy@turgo.io
Data Protection Officer: dpo@turgo.io

2. Renkami duomenys

We collect the following categories of personal data:

Account Information

Name, email address, and password (hashed)
Profile photo (optional)
Phone number (optional)
Preferred language and country

Listing Data

Listing titles, descriptions, prices, and photos you upload
Category and location selections
Listing view counts and interaction metrics

Communication Data

Messages exchanged between users through the platform
AI agent interactions and conversation history
Support requests and feedback

Technical & Usage Data

IP address, browser type, device information
Pages visited, features used, and session duration
Search queries and filter preferences
Cookie identifiers (see Section 7)

Financial Data

Subscription and payment history (processed by Stripe; we do not store card numbers)
Billing address and VAT information where applicable

3. Apdorojimo tikslai

We process your personal data for the following purposes:

Providing and operating the classifieds platform
Creating and managing your user account
Processing your listings, searches, and transactions
Operating AI-powered agents (pricing, matching, auto-responses)
Sending transactional notifications (new messages, agent alerts, saved search matches)
Processing subscription payments and managing billing
Providing analytics and market insights to Pro/Business users
Detecting and preventing fraud, abuse, and security threats
Improving platform features and user experience
Complying with legal obligations (tax, accounting, law enforcement)
Sending marketing communications (only with your consent)

4. Teisiniai pagrindai

We process your personal data based on the following legal grounds under GDPR Article 6:

Legal Basis	Purpose
Contract performance (Art. 6(1)(b))	Account management, listing services, payments, messaging
Legitimate interest (Art. 6(1)(f))	Fraud prevention, analytics, platform improvements, security
Consent (Art. 6(1)(a))	Marketing emails, analytics cookies, push notifications
Legal obligation (Art. 6(1)(c))	Tax records, compliance with court orders

5. Duomenų saugojimo laikotarpiai

We retain personal data only as long as necessary:

Data Type	Retention Period
Account data	Duration of account + 30 days after deletion
Listing data	Duration of listing + 90 days
Messages	Duration of account + 30 days
Payment records	7 years (legal/tax obligation)
Server logs	90 days
Analytics data	26 months (anonymized thereafter)
Marketing consent records	Duration of consent + 3 years

6. Duomenų dalijimasis su trečiosiomis šalimis

We may share your personal data with the following categories of third parties, all of whom are bound by data processing agreements:

Stripe, Inc. — Payment processing. Stripe acts as an independent data controller for payment data. See Stripe's Privacy Policy.
AI Service Providers (GitHub Models / Azure OpenAI) — For AI agent features including pricing suggestions, auto-responses, and image analysis. Data sent to AI providers is minimized and does not include personally identifying information where possible.
Cloud Infrastructure (Azure / Vercel) — Hosting and content delivery. Data is processed within EU/EEA regions.
Email Service Provider — For transactional and marketing emails.
Search Engine (Meilisearch) — For listing search functionality. Self-hosted within our infrastructure.

We do not sell your personal data to third parties. We do not share your data with third parties for their own marketing purposes.

7. Slapukai ir stebėjimas

We use cookies and similar technologies for the following purposes:

Strictly Necessary: Authentication, session management, CSRF protection, language preference. These cannot be disabled.
Analytics: Understanding how users interact with the platform. Only activated with your consent.
Preferences: Remembering your theme (dark/light mode), region, and display settings.

You can manage your cookie preferences at any time through our cookie banner or in your browser settings. For more details, see our Cookie Policy.

8. Jūsų duomenų apsaugos teisės

Under the GDPR, you have the following rights regarding your personal data:

Right of Access (Art. 15): Request a copy of all personal data we hold about you. You can also export your data from Settings > Data & Privacy.
Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data. You can update most information directly in your account settings.
Right to Erasure (Art. 17): Request deletion of your personal data (“right to be forgotten”). You can delete your account from Settings > Data & Privacy. Some data may be retained where legally required.
Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (JSON). Available via the data export feature.
Right to Object (Art. 21): Object to processing based on legitimate interests, including direct marketing. You can opt out of marketing in your notification settings.
Right to Restrict Processing (Art. 18): Request that we limit the processing of your data in certain circumstances.
Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@turgo.io. We will respond within 30 days.

9. Vaiku privatumas

Turgo is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly.

10. Tarptautinis duomenų perdavimas

Your data is primarily stored and processed within the European Economic Area (EEA). Where data is transferred outside the EEA (e.g., to AI service providers in the United States), we ensure appropriate safeguards are in place, including:

EU-U.S. Data Privacy Framework certification
Standard Contractual Clauses (SCCs) approved by the European Commission
Data minimization — only necessary data is transferred

11. Duomenų apsaugos pareigūnas

Our Data Protection Officer can be reached at:

Email: dpo@turgo.io
Address: Data Protection Officer, Turgo SIA, Riga, Latvia, LV-1050

12. Teisė pateikti skundą

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. The lead supervisory authority for Turgo is:

Data State Inspectorate of Latvia (Datu valsts inspekcija)
Address: Elijas iela 17, Riga, LV-1050, Latvia
Website: www.dvi.gov.lv

You may also file a complaint with the supervisory authority in your country of residence:

Lithuania: State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) — www.ada.lt
Estonia: Data Protection Inspectorate (Andmekaitse Inspektsioon) — www.aki.ee

13. Politikos pakeitimai

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a prominent notice on the Platform. The “Last updated” date at the top of this policy indicates when it was last revised. We encourage you to review this policy periodically.