Privacy Policy

This Privacy Policy explains how SIA Workline Labs (registration No. 40203793393) ("we") processes personal data when providing the Cookiestack cookie consent management service (the "Service"). It is prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Latvian Personal Data Processing Law.

1. Controller and processor

For our customers' account data we act as the controller. For the consent records of visitors to our customers' websites we act as a processor on behalf of the customer (the website owner) under Art. 28 GDPR and our Terms of Service. The website owner is the controller for their own visitors.

2. What data we process

2.1. Customer account data:

• email address, name (optional) and organization name;
• a password hash (the password itself is never stored and is not available to us);
• added domains and banner settings;
• technical data when using the dashboard (IP address, browser data) to the extent needed to run and secure the Service;
• contact form messages (name, email, message text).

2.2. Data of visitors to customer websites (consent log):

• a pseudonymized visitor identifier — a SHA-256 hash of the IP address, User-Agent and domain identifier;
• a separately hashed IP address (to protect against duplicate submissions);
• the browser User-Agent string, country and browser language (where available);
• the consent categories chosen and the time of the decision.

We do not collect visitors' names, emails or other direct identifiers.

3. Purposes and legal bases

• creating an account and providing the Service — performance of a contract (Art. 6(1)(b) GDPR);
• storing the consent log on the customer's behalf — the customer's instructions under Art. 28 GDPR;
• security, abuse prevention and technical support — legitimate interests (Art. 6(1)(f));
• accounting and tax obligations for paid plans — legal obligation (Art. 6(1)(c));
• answering contact form enquiries — legitimate interests.

4. Recipients

We do not sell personal data. Data may only be shared with these processors:

• the hosting provider whose servers run the Service;
• Mailgun — to send transactional emails (password reset, usage-limit notices);
• Google (Consent Mode v2, Tag Manager, GA4) if the customer enables them — only the consent status per category is passed on, without visitor personal data.

Where data is transferred outside the European Economic Area, we ensure appropriate safeguards (such as the European Commission's Standard Contractual Clauses).

5. Retention

Account data is kept while the account is active and deleted after the account is deleted, unless the law requires longer retention (for example, accounting records). Consent records are kept for as long as the customer uses the respective domain in the Service and are deleted together with the domain or account. A visitor's decision is stored in their browser for the period set by the website owner (365 days by default).

6. Your rights

You have the right to access, rectify or erase your data, restrict processing, object to processing based on legitimate interests, and receive your data in a portable format. Send requests to info@worklinelabs.eu. If you are a visitor to a customer's website, please contact that website's owner first — we will help them fulfil your request.

You also have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija, www.dvi.gov.lv) or another EU supervisory authority.

7. Cookies

Information about cookies and similar technologies is available in our Cookie Policy.

8. Contact

SIA Workline Labs
Reg. No. 40203793393
Email: info@worklinelabs.eu