Privacy policy

This page explains how SIA "MM Properties" handles your personal data when you use the Tilderu kvartāls website: browsing apartments, booking a viewing, getting the price list or a finishes PDF, subscribing to news or asking a question in the chat.

Last updated: 20 October 2026

In short

Your data is handled by SIA "MM Properties", the developer and seller of the Tilderu kvartāls apartments.
We ask for your contact details only when you request something: a call back, a viewing, the price list, a finishes PDF or news. You can browse apartments, prices and the finishes configurator without them. We switch on visit statistics (Google Analytics) only with your consent.
In the chat, an AI assistant answers, not a person. A salesperson takes over only when you ask to be contacted.
We do not sell your data. It goes to our sales team and to the service providers who run the website (section 4).
You can ask at any time what data we hold about you and have it corrected or deleted: write to info@tilderukvartals.lv (section 8). Every news email has an unsubscribe link.

1. Who handles your data

The controller of your personal data is SIA "MM Properties", which develops and sells the apartments in Tilderu kvartāls.

Name: SIA "MM Properties"
Registration number: 44103122677
VAT number: LV44103122677
Registered address: Ezermalas iela 30, Alūksne, Alūksnes nov., LV-4301, Latvia
Email for data protection questions: info@tilderukvartals.lv

You can also send a question about your data by post to the registered address, or ask a salesperson through the contact page.

2. What data we use and why

For each activity we list what data we receive, why, on what legal basis, who receives it and how long we keep it. The legal basis comes from Article 6 of the General Data Protection Regulation (EU) 2016/679 (GDPR). Where we rely on our legitimate interest, we will tell you on request how we concluded that your interests do not override it.

2.1. Contact and viewing requests

The contact form, viewing requests (including the calendar with a chosen time), contact requests from the chat and the viewing form on our advertising pages.

What data: full name, phone number and email address;
how you prefer to be contacted: WhatsApp, a phone call or email;
your message, if you write one; for a request from the chat, the summary you see and can edit before sending;
the apartment or building you are asking about, and your finishes choices if you came from the finishes configurator;
for a viewing, the time you chose and the status of the viewing;
the website language and the place on the website where you sent the request.
Why: To answer your question, agree on a viewing, confirm or reschedule it, and send you a confirmation with a link where you can reschedule or cancel the viewing without an account.
Legal basis: GDPR Article 6(1)(b): steps we take at your request before a possible purchase agreement is concluded.
Who receives it: Our sales team (by email and in our customer records system) and the service providers in section 4. The viewing time goes into the sales team’s Google calendar. Your name, phone number and email appear in the calendar event only until a salesperson has confirmed the request; once confirmed, we remove them from the event, and a declined or canceled viewing is deleted from the calendar entirely.
How long: While we are in contact with you about buying an apartment. If no purchase agreement is concluded, we delete the request and viewing records 6 months after our last contact.

2.2. Finishes PDF and price list

The finishes configurator selection as a PDF, and the price list of all apartments, sent to your email.

What data: the contact details the form asks for: for the finishes PDF, full name, phone number and email address; for the price list, email address and phone number;
for the finishes PDF, the apartment and the finishes you chose;
the website language and the place on the website where you asked for the document.
Why: To prepare the document you asked for and send it to you. Afterwards a salesperson contacts you about the offer; the form says so before you send it.
Legal basis: GDPR Article 6(1)(b): steps we take at your request before a possible purchase agreement is concluded.
Who receives it: The same recipients as for requests (2.1). We keep the generated PDF in private file storage; it contains the apartment and finishes, but not your contact details. The download link is valid for 5 minutes.
How long: The same as for requests (2.1).

2.3. News, price alert and building launch

Signing up for news (on the news page, the 3D tour page and in pop-up windows), the alert before apartment prices at Alūksnes iela 8 go up, and the notice when sales start in a new building.

What data: email address (the news sign-up does not ask for your name or phone number);
for the building launch notice, full name, phone number, email and channel: email or WhatsApp;
when you gave consent, where on the website you signed up and, for the price alert, the exact consent text you saw;
when you unsubscribed, if you do.
Why: to send news about the quarter by email (currently in Latvian only);
to warn you 7 days before apartment prices at Alūksnes iela 8 go up;
to let you know when apartments in a new building go on sale.
Legal basis: GDPR Article 6(1)(a): your consent, given with a separate checkbox that is not ticked in advance. You can withdraw it at any time with the unsubscribe link in every email or by writing to us. Withdrawal does not affect what was sent before it.
Who receives it: Our sales team and the email delivery service (Google). If you chose WhatsApp for the building launch notice, a salesperson will message you on WhatsApp.
How long: Until you withdraw your consent. After you unsubscribe, we stop sending to you. We keep the subscription record (the contact details you gave and the times of consent and unsubscribing) for one year more, so that we can show that consent was given and that we respected your withdrawal, and then delete it.

2.4. Chat with the AI assistant

In the chat window "A question for the sales team", your questions are answered by the Tilderu AI assistant, a computer program, not a person; its answers are signed "AI assistant". A salesperson takes over only when you ask to be contacted from the chat. The salesperson then receives the summary you see and can edit before sending, not the whole conversation.

What data: your messages and the assistant’s replies (at most the last 20);
the apartment whose page you are on and your finishes choices, if you made them in the configurator, so that the answer is about them;
the website language and a randomly generated conversation number.
Why: To answer questions about apartments, prices, finishes and the buying process at any time of day.
Legal basis: GDPR Article 6(1)(f): our legitimate interest in answering visitors’ questions about our offer quickly.
Who receives it: To prepare an answer, your messages and the context above are sent to the AI service provider Anthropic (section 4). Anthropic does not use this data to train its models.
How long: Our server does not store the conversation text: it exists only in the page you have open and disappears when you close or reload it. The server keeps only a counter without text (the random conversation number, the number of messages and whether there was an error) so we can see that the chat works. Anthropic deletes messages within 30 days; if its automated safety checks flag a message as a breach of its usage policy, Anthropic keeps it for up to 2 years.

Please do not write health information or other sensitive data, or other people’s data, in the chat. The assistant’s answers are for information only; our terms of use explain how to rely on them.

2.5. Which advertisement brought you here

If you arrive on one of our advertising pages from an ad, the address contains ad parameters. We keep them in your browser’s session storage until you close the tab and add them to your request only if you send one.

What data: the ad parameters utm_source, utm_medium, utm_campaign, utm_content and utm_term;
the Google Ads click identifier (gclid, gbraid or wbraid);
the page where you arrived (without parameters) and the website you came from (only its base address, for example https://www.google.com).
Why: To see which ads bring in requests, so that we stop paying for those that do not.
Legal basis: GDPR Article 6(1)(f): our legitimate interest in knowing whether our advertising spend pays off.
Who receives it: Our sales team and customer records system, together with the request.
How long: In your browser, until you close the tab. In the request, the same as the request (2.1).

2.6. Security and technical logs

When you send a form or write in the chat, the server runs technical checks and writes to its operational log.

What data: a cryptographic fingerprint of your IP address (we do not store the IP address itself) and your browser’s identification string (user agent);
the technical number, type, language and time of the request;
for price list requests, a cryptographic fingerprint of the email address, to count requests for the rate limit.
Why: To detect errors and automated or abusive requests, and to stop our forms being used to send spam. For example, the price list can be requested at most 5 times in 10 minutes from one IP address and at most 3 times a day to one email address.
Legal basis: GDPR Article 6(1)(f): our legitimate interest in keeping the website secure and working.
Who receives it: The hosting provider Render, where the website’s operational logs are stored. We never write names, phone numbers or email addresses to the logs.
How long: Rate-limit counters live only in server memory, not in the database: they count only requests from the last 24 hours and are erased when the server restarts. Operational logs are kept for no longer than 30 days.

2.7. Neighborhood map

The "Quarter" page has a Google map of nearby places. The map loads from Google’s servers when it comes into view.

What data: Google receives your IP address, browser data and which part of the map you are viewing. We do not receive any data about you from Google.
Why: To show where the quarter is, what is nearby and how far away it is.
Legal basis: GDPR Article 6(1)(f): our legitimate interest in showing the location and surroundings of the quarter.
Who receives it: Google Ireland Limited, which handles this data as an independent controller under the Google Privacy Policy.
How long: We do not keep this data; Google keeps it under its own privacy policy.

2.8. Notes kept in your browser

To remember your choices, such as apartments marked for comparison, finishes choices, the last apartment you viewed and that you have already sent a request, the website keeps a few notes in your browser. They contain no name, phone number or email. The full list, how long each is kept and how to delete them are on the cookies page.

2.9. Website visit statistics (Google Analytics)

If you accept analytics in the cookie window, the site loads Google Analytics. Without consent the Google script is not loaded, and Google receives nothing from this site.

What data: pages viewed, time on page, clicks, device and browser type, language and approximate location (country, city);
form events without contact details: form type, apartment catalog number, language and technical request number;
a random browser identifier in the _ga cookie.
Why: To see which pages and apartments draw interest, where visitors stop and which channels bring requests, and to improve the site accordingly.
Legal basis: Article 6(1)(a) GDPR and Section 7.1 of the Latvian Law on Information Society Services: your consent, which you can withdraw at any time with the "Cookie settings" button in the page footer.
Who receives it: Google Ireland Limited as our processor. Google signals and ad personalization are switched off. More in the cookie policy.
How long: Event data in Google Analytics: 14 months. Cookies in your browser: up to 2 years or until you withdraw consent.

2.10. Website visit statistics (Cloudflare Web Analytics)

We use Cloudflare Web Analytics (Cloudflare, Inc.) for visit statistics. It stores nothing on your device (no cookies and no browser storage) and does not build a profile of you. We only see overall figures: page views, which site you came from, country, device and browser type, and how fast the page loaded. It does not load on pages with a personal link (viewing management, unsubscribing).

What data: the address of the page you opened and the site you came from;
country, device and browser type, screen size;
page load speed measurements;
your IP address, which Cloudflare receives to accept the measurement but does not use to recognise you.
Why: To see which pages are visited, where visitors come from and how fast the site loads on phones, and to improve the site accordingly.
Legal basis: GDPR Article 6(1)(f): our legitimate interest in understanding how the site is used and improving it. You can object (section 8) or block the script in your browser.
Who receives it: Cloudflare, Inc. (USA) as our processor.
How long: Overall figures in the Cloudflare dashboard: 6 months. Nothing is stored on your device.

3. Do you have to give us your data

Giving us your data is voluntary; no law or contract requires it. Without contact details we cannot answer a request, arrange a viewing or send a document, so the contact fields in the forms, including the phone number, are required. The only exception is signing up for news, which needs just your email address. A message and consent to news or the price alert are optional.

4. Who receives your data

In the website’s management panel, requests, viewings and subscriptions are visible only to our staff with the "owner" or "sales" role. We do not sell your data. It is received by these service providers working on our behalf (processors) and by other recipients:

SIA Aera (Latvia): Developer and maintainer of the website. On our behalf it receives request notifications by email and accesses the system to maintain it.
Render Services, Inc. (USA): The website’s server and database in Frankfurt, Germany: all data submitted on the website and the operational logs.
Supabase, Inc. (USA): File storage: website images, 3D tour videos and generated PDF documents (without your contact details). When you open a video or image, the storage receives your IP address to deliver it.
Google Ireland Limited (Ireland): Sending email from the website’s address (Google Workspace) and the sales team’s viewing calendar (Google Calendar). If you accept analytics, also website visit statistics (Google Analytics, 2.9).
Cloudflare, Inc. (USA): Website visit statistics (Cloudflare Web Analytics, 2.10).
Anthropic Ireland, Limited (Ireland): Preparing the AI assistant’s answers (2.4).
Customer records (CRM) system: Our sales team’s system where requests are followed up: type, contact details, message, apartment, finishes summary, language, preferred contact method and ad source.
Independent controllers: Google, when the map loads (2.7), and WhatsApp Ireland Limited if you choose to be contacted on WhatsApp. They handle the data under their own privacy policies.
Public authorities: Only where the law requires it, for example at the request of a law enforcement authority.

5. Transfers outside the European Economic Area

The website’s server and database are in the European Union (Frankfurt, Germany). The Render, Supabase, Google and Anthropic groups and Cloudflare have companies or sub-processors in the United States, so these services involve transfers of data to the USA. The transfers are protected by:

Standard contractual clauses: Clauses approved by the European Commission (GDPR Article 46(2)(c)), included in the providers’ data processing terms: Render, Supabase, Google, Anthropic.
EU-US Data Privacy Framework: Google LLC and Cloudflare, Inc. are certified under this framework (GDPR Article 45); the list of certified companies is kept by the US Department of Commerce.

You can also get copies of these documents from us (section 1).

6. How long we keep data

We keep data only as long as the purpose requires, and then delete it:

Requests, viewings and their PDFs: While we are in contact about buying an apartment; if no agreement is concluded, 6 months after our last contact.
Contact details in the viewing calendar: Until a salesperson confirms or declines the request or the viewing is canceled.
News and notices: Until you withdraw consent; the record of consent and unsubscribing for one year after that.
Chat conversations: Not stored on our server. Anthropic deletes them within 30 days (up to 2 years if a message was flagged as a usage policy breach).
Ad source in your browser: Until you close the tab.
Operational logs: No longer than 30 days.
Rate-limit counters: Only in server memory until it restarts; only the last 24 hours are counted.
Notes in your browser: As listed on the cookies page.

7. Automated decisions

We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects on you (GDPR Article 22), and we do not profile you. The AI assistant only answers questions; people confirm viewings, set prices and sign agreements.

8. Your rights

You have the right to:

access your data: find out whether and what data we hold about you, and get a copy (GDPR Article 15);
rectify inaccurate data and complete incomplete data (Article 16);
erase your data when it is no longer needed, when you withdraw consent or when you object to the processing (Article 17);
restrict processing, for example while we check whether the data is accurate (Article 18);
receive your data in a machine-readable format or have it sent to another controller, where processing is based on consent or a contract (Article 20);
withdraw consent at any time; this does not affect processing that took place before (Article 7(3)).

Right to object

You can object at any time to processing based on our legitimate interests (2.4-2.7). We then stop, unless we can show compelling legitimate grounds that override your interests (GDPR Article 21).

You can object to direct marketing, meaning news and price alerts, without giving a reason, and we then always stop.

To use these rights, write to info@tilderukvartals.lv or by post to the registered address (section 1). We will reply free of charge within one month; if a request is complex, we may extend this by two more months and will tell you if we do. So that we do not disclose your data to someone else, we may ask you to confirm the request from the same email address or phone number you gave in your request. When we delete your data, we also delete it from our customer records system and the sales team's email, and we stop sending you news.

You can also unsubscribe from news and the price alert yourself with the link in every email, without contacting us.

9. Complaints to the Data State Inspectorate

If you believe we handle your data unlawfully, you can complain to the Latvian Data State Inspectorate or to the supervisory authority of the EU member state where you live or work. We encourage you to write to us first, as that is usually the quickest way to resolve it.

Authority: Data State Inspectorate (Datu valsts inspekcija)
Address: Elijas iela 17, Riga, LV-1050, Latvia
Phone: +371 67223131
Email: pasts@dvi.gov.lv
Website: www.dvi.gov.lv

10. How we protect data

The website works only over an encrypted connection (HTTPS).
In the management panel, requests, viewings and subscriptions are visible only to staff with the relevant role; there is no public access to them.
We never write names, phone numbers or email addresses to the server logs, and we log IP addresses only as a cryptographic fingerprint.
The viewing management link is cryptographically signed, and the PDF download link is valid for 5 minutes only.
Visitors have no accounts or passwords that could be stolen.

11. Cookies

The cookies page explains which cookies and browser notes the website uses and how to manage them.

12. Changes to this policy

We update this policy when the website’s features or service providers change. The date of the last update is at the top of the page. If we want to use data for a new purpose that needs your consent, we will ask for it separately.