Privacy

Who is responsible for the data

SIA "KMR Business" (registration No. 53603071411, Sudrabu Edžus iela 15-64, Jelgava, LV-3001, info@vedlis.lv) is responsible for the websites and user accounts. We process a business's accounting data on its behalf: the business is responsible for that data, and we are the data processor.

Website

The website has no cookies, analytics tools or advertisements. The calculators, invoice generator and e-invoice validation tool run in your browser, and we do not receive the data you enter. The website is powered by Cloudflare, which processes technical request data, such as IP addresses, to keep the website running and protect it against attacks.

App

In the app, we process:

• the user's name, email address and sign-in data (including two-step verification data);
• business details, accounting data and documents that the user enters, uploads or adds through a connection;
• an activity log (who changed what and when), which is necessary for keeping accounting records.

We use the data only to provide the service and do not sell it. We may obtain business details from public data held by the Register of Enterprises and the State Revenue Service (VID).

Bank data

If a business connects a bank account, we receive a list of accounts, balances and transaction data (date, amount, counterparty and purpose). We use this data to import transactions into the accounting records, match them with invoices and prepare accounting entries. Enable Banking Oy, a licensed account information service provider supervised by the Finnish Financial Supervisory Authority (FIN-FSA), receives the data from the bank and passes it to us. Users grant access through their bank for up to 180 days and can revoke it at any time in Vedlis (the "Disconnect" button) or through the bank. Once access is revoked, we no longer receive new data, but transactions already imported remain in the accounting records until the retention period ends. Vedlis cannot see bank passwords.

Processors

The following service providers process data on our behalf:

• Supabase: database, sign-in and files; data is stored in Frankfurt, EU;
• Cloudflare: operation of the app and website, PDF generation; the app runs on Cloudflare servers in the EU;
• Enable Banking Oy (Finland): bank data, if the business connects its bank;
• Google: sign-in with a Google account, if the user chooses this option;
• email service provider: sign-in links and invitations;
• Anthropic or OpenAI (US): reading scanned documents, only if the business connects its own artificial intelligence account or API key.

Data transfers outside the EU

If a processor processes data outside the European Union (for example, in the US), the transfer is based on the EU–US Data Privacy Framework (DPF) or the European Commission's Standard Contractual Clauses (SCC).

How long we retain data

We retain accounting documents and transactions for as long as required by the Accounting Law (5 or 10 years), including after the bank connection is revoked or the account is closed. We delete user accounts on request. We retain the activity log for as long as the accounting data.

Your rights

Users can request access to their data, its correction, deletion or transfer, to the extent permitted by the obligation to retain accounting data. Requests can be sent to info@vedlis.lv. Users can also lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija) (www.dvi.gov.lv).

Changes

We will notify users of significant changes to this page in the app or by email.