Privacy Policy
Version 1.1 · effective from 30 October 2026
This is a translation. In case of discrepancies, the Latvian version prevails.
This policy explains how Regmio processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Personal Data Processing Law (Fizisko personu datu apstrādes likums).
It applies to two distinct groups of persons:
- Part A — users of the Service (visitors and account holders);
- Part B — natural persons whose data has been published in state registers (for example, board members, shareholders/members, beneficial owners) and is displayed in the Service.
1. Controller
SIA "Mobinet" (Mobinet SIA), reg. No. 40103814735, Artilērijas iela 6, Rīga, LV-1001, Latvia. Contact on data protection matters: [email protected] (please state "Data protection" in the subject line).
Mobinet has not appointed a data protection officer, as this is not mandatory under Article 37 of the GDPR.
Part A. Users of the Service
A.1. What data we process
| Data | When | Purpose | Legal basis |
|---|---|---|---|
| E-mail address | sign-in, account | creating the account, sending the sign-in code, account-related notifications | performance of a contract (Art. 6(1)(b) GDPR) |
| Plan, language, sign-in times, version and time of acceptance of the Terms | account | provision of the Service, proof of acceptance of the Terms | performance of a contract; legitimate interests (Art. 6(1)(f)) |
| Registration numbers of companies viewed and time | opening a full profile | tracking plan limits | performance of a contract |
| Watched companies (reg. no.), e-mail notification setting, time of the last notification | if you use monitoring (Pro) | notifications about changes in watched companies | performance of a contract |
| Sign-in codes (hash value only), IP address at the time the code is requested | sign-in | security, prevention of abuse | legitimate interests |
| Session data: IP address, browser identifier (User-Agent), time of last activity | on every visit | maintaining the session, list of active devices in the account | performance of a contract; legitimate interests |
| Security events: IP address, event type and time (e.g. limit exceeded) | if they occur | protection against data harvesting and attacks | legitimate interests |
| Server logs: IP address, requested address, time, browser identifier | on every request | ensuring operation, investigating errors and attacks | legitimate interests |
| Payment data (plan, amount, date, payment status, invoice details) | when purchasing a paid plan | payment, invoicing, accounting | performance of a contract; legal obligation (Art. 6(1)(c)) |
| Content of communications | if you write to us | responding to a question or request | legitimate interests; legal obligation |
We do not use analytics, advertising or social media tracking tools and do not build user profiles for marketing. We do not link company search queries to a specific user, except for counting full profiles for limit purposes.
A.2. Retention periods
| Data | Period |
|---|---|
| Account data | until the account is deleted; an inactive free account is deleted after 24 months without sign-in |
| Record of profiles viewed | 13 months |
| Watched companies | until you stop watching or delete your account; history of detected changes — 13 months |
| Sign-in codes | 30 days |
| Sessions | until sign-out or 30 days ("Remember device") |
| Security events | 90 days |
| Server logs | 14 days |
| Payment and invoice data | 5 years after the end of the tax year (Law on Accounting (likums „Par grāmatvedību”)) |
| Correspondence | until the matter is resolved and a further 3 years for the defence of possible claims |
A.3. Data recipients (processors)
| Recipient | Role | Location |
|---|---|---|
| Hetzner Online GmbH | server hosting | Germany (EU) |
| Cloudflare, Inc. | DNS, network protection, content delivery; sees the IP address and request | EU and USA — EU–US Data Privacy Framework and standard contractual clauses |
| Montonio Finance UAB — once paid plans become available | payment processing | Lithuania (EU) |
| Accounting service provider | invoice records | Latvia (EU) |
We send and receive e-mail using Mobinet's own mail server (mail.millenium.lv) in Latvia, so no external processor is involved in e-mail handling.
Data may also be disclosed to public authorities where required by law. We do not sell data or transfer it to third parties for marketing.
A.4. Security
The connection is encrypted (HTTPS/TLS), sign-in codes are stored only as a hash value and are valid for 10 minutes, and access to the server is restricted. The User can see active sessions in their account and terminate them.
Part B. Persons named in state registers
B.1. What data we display
The Service displays data that public authorities have published as open data or publicly accessible registers. This may include data of natural persons associated with companies:
- first name, surname;
- role in the company (board member, holder of commercial power of attorney (prokurist), member, shareholder, beneficial owner, etc.), rights of representation, number or size of shares;
- dates of appointment and removal, history of changes;
- part of the personal identity code or year of birth — to the extent published by the source (in the Latvian source the personal identity code is partially masked);
- nationality or country of residence, if published by the source;
- in the case of a sole trader or farm — tax and register data relating to the business.
Sources: the Register of Enterprises of Latvia and the State Revenue Service (data.gov.lv), the Estonian e-Business Register (e-Äriregister, RIK) and the Tax and Customs Board (EMTA), the Lithuanian Registrų centras and the State Tax Inspectorate (VMI, get.data.gov.lt), and the European Commission's VIES. Details are on the Data Sources and Disclaimer page.
We do not obtain additional data about persons from other sources (social networks, news portals, private databases) and do not display persons' full personal identity codes, addresses or contact details.
B.2. Purpose and legal basis
The purpose is to ensure transparency of business activity and to enable business partners to verify who is authorised to represent a company and who owns it — the same purpose for which this data is made public in state registers.
The legal basis is legitimate interests (Article 6(1)(f) GDPR) — the interests of users of the Service and of the public in safe business activity and the prevention of fraud and money laundering, as well as Mobinet's interest in providing such a service. We have balanced these interests against the rights of the persons concerned and concluded that the processing is proportionate, because:
- the data is already lawfully publicly available for the purpose of being used to verify business partners;
- only data relating to business activity is processed, not data relating to private life;
- the full profile can be viewed only by a signed-in user, and we restrict automated data extraction;
- persons have the right to object (see Section 2).
Information on links between companies (for example, "person associated with N companies") is derived solely from the same register data. This is not automated decision-making within the meaning of Article 22 of the GDPR, and Mobinet does not take any decisions concerning persons.
B.3. Retention period
Data is updated regularly (usually daily) from the source. If a person is no longer named in the current source data, their historical role is shown for as long as the source publishes it or as long as it is relevant to understanding the company's history, but no longer than 10 years after the end of the role or the removal of the company from the register.
B.4. Information to data subjects
As the data has not been obtained from the persons themselves, this policy constitutes information pursuant to Article 14 of the GDPR. Informing each person individually is impossible or would involve a disproportionate effort (Article 14(5)(b) GDPR), and therefore this information is published here.
B.5. Rectification of data
We do not correct the data ourselves, as it must correspond to the official source. If the data is incorrect, please have it corrected in the relevant register (for example, the Register of Enterprises). The correction will then appear in the Service at the next data update. If the data in the Service differs from the source, please let us know — we will correct it.
2. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy of it (Article 15);
- request rectification of inaccurate data (Article 16);
- request erasure (Article 17) — you can delete your account yourself in the "Account" section;
- request restriction of processing (Article 18);
- receive your account data in a portable format (Article 20);
- object to processing based on legitimate interests (Article 21). If you object to the display of your data in the Service, we will assess your particular situation and stop the processing unless there are compelling legitimate grounds that override your interests;
- lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija, Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv) or with the supervisory authority of your place of residence.
Send requests to [email protected]. We will respond within one month. To protect data from unauthorised persons, we may ask you to verify your identity.
3. Amendments
We may update this policy. The current version is always published on this page; we will notify account holders of material changes by e-mail.