Privacy notice: draft.

Website operator: PARXED SIA. Registration number: 40203645744.

Registered address: Auru iela 13A - 39, Rīga, LV-1069, Latvia.

VAT number (as displayed by Lursoft): LV40203645744.

For general and personal-data enquiries: hello@parxed.co.

This draft describes the inspected website functions: inquiries, audits, estimates, meeting requests, the AI assistant and optional analytics. PARXED SIA is the proposed controller for its own processing of these functions; the purposes, legal bases and operational procedures still require owner and legal review.

This draft was updated on 6 October 2026 with implemented data paths and recorded owner decisions. It is not proof that all providers are enabled or that the public deployment has been verified. This text does not approve publication or guarantee legal compliance.

To submit an inquiry, provide your name and one contact channel: email, an international phone number or a public Telegram username. The form submits only the selected channel; it does not require all three. Company, message and contact notes are optional. Without the required name and selected contact detail, the form cannot save the inquiry for a reply.

The inquiry record can include its source, language, creation time, contact details, optional website and links to an audit, estimate or meeting request. We use the information to understand and respond to your request. Avoid passwords, payment-card details, sensitive personal information and other people’s data that are unnecessary for this purpose.

The form displays a service notice and records its version and language with the inquiry. The service notice is not a mandatory consent checkbox and does not establish consent as the legal basis for every operation. At launch, no marketing subscription is offered and this notice does not solicit marketing consent. Submitting contact details permits handling the inquiry, not promotional messages. Browser analytics choices are separate.

An audit can contain your business description, goals, bottlenecks, channels, tools, repetitive processes and optional website or budget range. Its answers, preview and generated plan are stored with technical version and session references. Free text may contain personal data even though the questionnaire does not require a contact field.

Calculator selections stay in browser memory until submitted with an inquiry. A saved estimate records selected service options, the pricing version and the server-calculated EUR breakdown. A meeting request can record meeting type, timezone, preferred time and status; configured calendar processing can add provider references and confirmed times. Saving a request does not confirm an appointment, and cancellation changes its status rather than deleting the record.

Form drafts and assistant conversation state have no application browser-storage draft key in the inspected source. They remain in page memory; closing the assistant does not reset its mounted conversation. Browser autofill, page restoration and external widgets may behave differently.

Demo mode uses rules in the site’s server without calling an AI provider; that server can be local or cloud-hosted. If a live AI service is configured and authorized, audit answers or the assistant’s current message and limited recent conversation are sent to the configured AI provider. The owner selected OpenAI for launch; production activation remains pending. User-entered text can itself contain personal data. Saved contact records, session cookies and client IP addresses are not added to this AI request by the application adapter.

The browser holds limited assistant history in memory. Server AI request records, including demo requests, retain request identifiers, input hashes, versions and completed responses or errors; responses may contain personal data. Live AI also creates linked budget and usage records. Sending an assistant message does not itself create an inquiry.

AI outputs are preliminary suggestions for human review. This draft does not establish a process for decisions made solely by automation with legal or similarly significant effects. Provider retention, training terms and contractual safeguards still need confirmation; the request code does not establish zero data retention.

These are proposals for review, not final legal-basis determinations. Responding to a requested quote or taking steps towards a contract may rely on GDPR Article 6(1)(b) where the data subject is the prospective contracting party. A representative contacting us for a company is not automatically covered by that basis; handling such business contacts needs a separate assessment.

Protecting the site, preventing abuse, preserving reliable request processing and handling appropriate business contacts may rely on legitimate interests under Article 6(1)(f), subject to necessity and a documented balancing of those interests against your rights. Technical data can include session and request identifiers, hashes, rate-limit information, delivery status and provider receipts. Hashed identifiers can remain linkable and are not necessarily anonymous.

Optional analytics is proposed to rely on consent under Article 6(1)(a). Refusing analytics does not prevent an ordinary inquiry. Inquiry replies and related follow-up must stay within the requested discussion; they are not permission for promotion. Selecting a contact channel or allowing analytics is not marketing consent or a general authorization for provider transfers. No marketing subscription is offered at launch.

Where actual accounting documents or other legally required records arise, Article 6(1)(c) may apply to compliance with the relevant obligation. The document category and applicable retention rule require review; accounting law does not set a blanket retention period for every website inquiry or AI record.

Cloudflare Workers and D1 can process requests and store the described records when a cloud runtime or remote database profile is used. The standard local profile uses local storage, but a local browser address can also be connected to a remote database. Infrastructure logging, backups, access arrangements and locations remain to be confirmed.

If operational Telegram notifications are authorized and enabled, the operator’s configured destination may receive inquiry and selected contact details, message, contact notes, audit reference and meeting preferences. Choosing Telegram as your contact channel is distinct from this operator notification. Notification authorization does not depend on your analytics preference; it needs its own reviewed purpose and basis.

If configured, Cal.com loads after your deliberate calendar action. The inline integration sends an opaque booking reference and ordinary browser/network metadata; the application does not prefill contact or audit content. Information entered directly into Cal is handled there. Calendar responses can update booking status and references. External calendar navigation is also a separate choice, independent of optional analytics.

Google Analytics 4 is optional and requires valid configuration and the applicable analytics choices before the application loads its tag. The inspected site configuration has analytics disabled. Allowlisted route and service events omit contact text, full query strings and private booking or audit references, but Google can receive network and SDK identifiers. This is not an anonymity guarantee. The cookie draft describes the storage controls.

Before publication, confirm the actual providers, their roles, access, contracts or DPAs, subprocessors, retention and any transfers outside the EEA with applicable safeguards. This draft does not verify those arrangements, promise EU-only processing or establish provider-side deletion. The live AI provider described above is subject to the same review.

The application session normally expires 24 hours after creation, ending access to session-protected features. That access expiry does not delete a retained inquiry, linked audit, booking or AI record. Audit access follows the owning session’s expiry; linked expired audits can remain stored.

The owner has selected retention of inquiries that do not become paid projects for 12 calendar months after the last meaningful communication about that inquiry. This is an owner business choice, not a statutory retention period. Its necessity and legal basis still require review, and it does not prevent an earlier rights request where applicable.

Meaningful communication concerns the requested project, such as a substantive reply, clarification or discussion of a proposal. A newsletter, promotional message, internal reading of a record or automated notification does not restart the clock. Related inquiry follow-up is not permission for promotion.

The private application implements last-contact, conversion-to-project and legal-hold metadata with a calendar-month calculation. Any hold needs a documented purpose, basis, scope and review date. The owner selected a monthly reminder and manual review, not automatic deletion. The complete deletion and provider-copy procedures remain pending; the current application does not automatically delete all inquiry data at the 12-month deadline or provide full erasure. Reminder operation depends on the configured app being available and does not replace the owner’s responsibility to review records.

Temporary-record cleanup is an explicit operational action with dependency checks, not automatic deletion at expiry. It preserves linked history and AI and budget records. Deleting one inquiry can preserve shared contacts, audits and technical history; the existing operator tool is not comprehensive person-level erasure. Shared records, processing or uncertain deliveries, and AI request identities and budget safeguards must be assessed rather than indiscriminately removed.

Converted projects and accounting documents, security and AI or budget history, delivery and calendar records, exports, backups, infrastructure logs and provider-held copies are separate categories. They need their own reviewed purposes, periods or criteria and deletion or restriction procedures; the inquiry criterion does not establish those periods or erase those copies. Before publication, verify the implementation and rights-handling procedure, including justified holds and the remaining categories. Pending work is not permission for indefinite storage.

Subject to the applicable GDPR conditions, you can request access, correction, erasure or restriction, and portability where processing is based on consent or contract and carried out by automated means. You can object to processing based on legitimate interests and to direct marketing. Erasure and other rights can be limited by legal obligations, others’ rights or the establishment, exercise or defence of legal claims.

Send personal-data questions or rights requests to hello@parxed.co. Describe the request and, if available, the relevant inquiry reference. Only proportionate information needed to verify identity and locate records should be requested; do not send passwords or unnecessary identity documents. The detailed handling and verification procedure still requires approval.

The usual GDPR response period is one month from receipt. Where permitted because of complexity or the number of requests, it can be extended by up to two further months, with an explanation within the first month. Applicable conditions and exceptions must be assessed for each request; this draft does not promise automatic or complete deletion through the existing inquiry tool.

You can complain to Latvia’s Data State Inspectorate (Datu valsts inspekcija, DVI; www.dvi.gov.lv) or another competent supervisory authority, including where you habitually reside or work or where the alleged infringement occurred. Contacting PARXED first is not a prerequisite for a complaint.

You may withdraw optional analytics consent through the site’s analytics preferences. Consent withdrawal does not affect the lawfulness of processing based on consent before withdrawal. There is no marketing subscription at launch; inquiry contact and related follow-up do not subscribe you to promotional communications. Send data-handling questions to hello@parxed.co.

Analytics withdrawal stops subsequent application collection and attempts to clear the relevant optional local storage and configured analytics cookies. It cannot recall information already sent or automatically erase provider-held records. Calendar cancellation, browser clearing and session expiry likewise do not erase all retained server or provider data.

Before this draft can be published, the missing facts shown on this page, the retention and rights procedures, provider evidence and locale review must be completed. Questions about this draft can be sent to hello@parxed.co.