Privacy policy

The data controller is MezaData ("we"). For questions about data processing, write to info@mezadata.lv.

You can use the site without registering. Valuations, reports (including the PDF and print version) and EUDR passports open directly on the site — we do not send them by email and do not ask for your name, phone number or email address for them. We process the following data:

• Account: username, password hash (the password itself is never stored in plain form), a keyed hash of the email address (HMAC; the address itself is not stored), role (buyer or seller) and the account creation date.
• Data you save in your account yourself: watchlist, notes and saved valuations.
• Account history recorded automatically: recently viewed cadastres (for signed-in users).
• Password reset: the address you type is used only to send a one-time reset link to it and is not stored. The email passes through our mail relay to the recipient's email provider. Rate limiting uses your IP address and a keyed hash of the address, kept in server memory only. We store only a hash of the link; the link is valid for 1 hour, and the hash is removed once the link is used.
• EUDR passport: cadastre number or felling-permit number, selected stands, a snapshot of public Forest State Register data (e.g. species, areas, boundaries), language, creation date and a hash of the access link. The passport contains no name, email or other contact details.
• Buyer batch export (only for registered buyers who have this feature enabled): the recognised cadastre or felling-permit numbers and the per-line results, linked to your account. The pasted text is not stored.
• Cadastre view log: cadastre number, time and — if you are signed in — your username. No IP address is stored.
• Technical data: IP address for rate limiting (server memory only) and web server logs (IP address, requested URL, time and browser identifier — user agent).
• Analytics: Google Analytics data — only after your consent (see section 6).

Public Forest State Register data

The site processes publicly available Forest State Register data that the State Forest Service (VMD) publishes on the Latvian Open Data Portal (data.gov.lv), and felling-permit data from VMD's public e-service (epak.vmd.gov.lv): cadastre numbers and stand attributes (e.g. species, age, area, growing stock, boundaries). Where a land unit belongs to a natural person, this data can be personal data of the owner; we do not receive or process the owner's name. Purpose: forest valuation and the information needed for EUDR due diligence. Legal basis: our and the site users' legitimate interests (GDPR Art. 6(1)(f)). This section provides the information required by GDPR Art. 14; you have the right to object to this processing (see section 5).

We do not sell data and do not pass it to forest buyers or anyone else for marketing. Data is received only by:

• the hosting provider whose servers run the site and the database — as a processor;
• for password-reset emails — our mail relay and the recipient's email provider;
• map image providers from which your browser loads the map background and layers: EOX IT Services GmbH (tiles.maps.eox.at, Austria) and the AS “Latvijas valsts meži” GeoServer (Latvia) — they receive your IP address and the coordinates of the map area you view;
• Google Ireland Limited — Google Analytics data, only if you have given consent;
• Telegram — internal notices to the operator (e.g. a new account's username and role, the cadastre number of a created EUDR passport) without email addresses or contact details;
• public authorities — where required by law.

International transfers: Google and Telegram may process data outside the EU/EEA, including in the USA. Transfers by Google to the USA rely on the EU–US Data Privacy Framework and the standard contractual clauses. We send Telegram only internal notices without contact details.

• Access — request what data is stored about you.
• Rectification — correct inaccurate data.
• Erasure — "right to be forgotten", including deleting your account.
• Restriction — restrict processing.
• Portability — receive your data in a machine-readable format and transmit it to another controller (GDPR Art. 20).
• Objection — object to processing based on legitimate interests (GDPR Art. 21).
• Withdraw consent — for analytics cookies at any time, without affecting the lawfulness of prior processing.
• Complaint — lodge a complaint with the Data State Inspectorate (dvi.gov.lv).

This list covers the public site. Necessary cookies: cookies needed for sign-in and the session (technical security cookies set while you sign in, and the session cookie that keeps you signed in) and the language cookie “lang” (1 year). Your browser's local storage (localStorage) keeps the selected language, your cookie choice and saved search filters, and the tab storage (sessionStorage) keeps a short-lived cache of your last search results that disappears when you close the tab; this data stays on your device. Google Analytics (Google Ireland Limited) for visit statistics is loaded only after your consent — until then the site makes no request to Google at all. After consent, Google Analytics sets its cookies and receives your IP address, browser identifier (user agent) and the pages you visit; Google may transfer this data to the USA under the EU–US Data Privacy Framework and the standard contractual clauses. You can change your choice at any time via “Cookie settings” in the site footer. No advertising cookies are used. Content-editor (CMS admin) accounts and their cookies are separate, internal only, and do not concern site visitors.

We will post a notice on the site about material changes. The current version is always available on this page.