Short answer
If a website processes personal data — contact forms, enquiries, analytics, cookies — visitors must be informed with a privacy policy, only the necessary data may be collected, consent is needed for non-essential cookies, and the data must be kept secure. The GDPR (General Data Protection Regulation; VDAR in Latvian) applies to all EU companies.
The basic requirements
- Privacy policy — who processes the data, which data, why, for how long, and what rights the visitor has.
- Data minimisation — forms ask only for what is really needed.
- Cookies — non-essential cookies (analytics, advertising) need consent, which can also be refused.
- Security — HTTPS, a secure server, updates, access control.
- Service providers — hosting, e-mail and analytics providers that process data on your behalf need a data processing agreement.
- Rights — a visitor can ask to access, correct or delete their data.
The most common mistakes
- Analytics or advertising tools load before consent is given.
- Contact form data is kept indefinitely.
- The privacy policy is copied from another site and doesn’t match reality.
The simplest route
Less tracking means fewer requirements. If you really need analytics, choose privacy-friendly tools. This is not legal advice — in complex cases, consult a lawyer.