Privacy policy

1. Who we are

EU Project Manager (“the Platform”, at pm.theplentygroup.eu) is operated by SIA "Plenty Group", registration number 40203061230, Draudzības iela 6A k-1–37, Ogre, Ogres nov., LV-5001, Latvia (“we”, “us”). Contact for anything about your personal data: security@theplentygroup.eu.

2. Our two roles

• As controller — for your user account, your use of the Platform, and our record of who did what. This policy covers that data.
• As processor — for the project and personnel data your organisation enters to manage its EU-funded projects. For that data your organisation is the controller, and we act on its instructions under our Data Processing Agreement. If your details are in the Platform because your employer uses it, please address requests to your employer.

3. What we collect, and where it comes from

• Account details — name, email, role and organisation, and sign-in credentials. These come from you, or from the administrator of your organisation who set up your account.
• Records of significant actions you take — your identity, the time, the IP address the request came from, and any reason you enter.
• Security logs — sign-in and other security events, with the IP address.
• Usage information — only if you allow it: which pages you use and for how long, how you arrived at the Platform, your device and browser type, and technical performance measurements, linked to your account. We use it only to improve the Platform: to see which features are used, where people get stuck and which pages are slow.
• An AI provider key — only if you choose to use the optional AI features with your own key.
• A document you import — when you set up a project from a grant agreement or proposal, its text is read by our AI provider to fill in the project. The imports we cover — your first, and on a paid plan three per credit — run on our account with that provider; other imports run on your organisation's own AI key.
• Correspondence and billing records — if you contact us or hold a paid plan: the organisation that pays, its billing email, address and VAT number, what it bought and whether it has paid. A report sent with the Feedback button also carries the page it came from and your browser type, so we can reproduce the problem.

You need to give your name and email address to have an account; without them we cannot give you access. The rest is generated as you use the Platform.

4. Why, and our legal basis

• Contract (GDPR Art 6(1)(b)) — to provide the Platform you or your organisation signed up for.
• Legitimate interest (Art 6(1)(f)) — to keep a reliable record of who did what, and to secure the Platform.
• Consent (Art 6(1)(a)) — to measure how the Platform is used so we can improve it, only if you allow it (see our Cookie Notice).
• Legal obligation (Art 6(1)(c)) — to keep billing, tax and accounting records.

Where we rely on legitimate interest, you may object (section 8).

We do not make decisions about you by automated means alone (GDPR Art 22). The optional AI features only prepare summaries and extract information for the user who asks for them.

5. How long we keep it

• Account data — while your account is active and for up to 90 days after it is closed, then deleted or anonymised.
• Records of actions — for as long as the records they relate to must be kept for EU-grant purposes: as a rule, until 5 years after the EU’s final payment for the project (3 years where the grant is at most EUR 60 000), and longer while an audit or dispute is open. We cannot delete them earlier, because keeping them is a legal and audit requirement (GDPR Art 17(3)).
• Security logs — 365 days.
• Usage information — 90 days.
• Billing records — for the period Latvian law requires.

6. Who we share it with

• Our staff, limited to what their role needs.
• Service providers acting on our instructions under contract — for hosting, for sending email, and an AI provider (to read the documents of the imports we cover, and for the optional AI features if you use them with your own key). Customers can see the specific list in our Data Processing Agreement.
• Our payment provider, Stripe Payments Europe, Ltd. (Ireland), when your organisation pays by card or SEPA Direct Debit: it receives the billing details above, takes the payment on its own secure pages and issues the invoice. Card and bank account numbers go to Stripe only; we never see or keep them. Stripe also acts on its own account where the law requires it, for example to prevent fraud.
• Auditors and authorities where an EU grant is checked (the European Commission or its agency, the European Court of Auditors, the European Anti-Fraud Office, and cost-certifying auditors).
• Otherwise, only where the law requires it.

7. Transfers outside the EU/EEA

The Platform runs in the EU. Where a service provider involves a transfer outside the EU/EEA, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework, for certified providers) or by appropriate safeguards (such as Standard Contractual Clauses). You can obtain information about these safeguards, and a copy where applicable, by contacting us.

8. Your rights

You can ask to access, correct, erase, restrict or object to the processing of your data, and to receive it in a portable form. Some records cannot be deleted before their retention period ends, because keeping them is required by law or for audit. For data we process on behalf of your organisation, please contact your organisation.

Where we rely on your consent (usage measurement), you can withdraw it at any time in Settings → Usage statistics; this does not affect what was done before, and it deletes your usage data.

To exercise a right, contact security@theplentygroup.eu. You can also complain to the Latvian supervisory authority — Datu valsts inspekcija (Data State Inspectorate), www.dvi.gov.lv — or the authority in your own country.

9. Security

We take appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and regular backups.

10. Cookies and similar technologies

We use strictly-necessary cookies to keep you signed in, remember your display preferences in your browser, and — only if you allow it — measure how the Platform is used, to improve it. See our Cookie Notice.

11. Changes and contact

We may update this policy; we will change the date above and, for a significant change, tell account holders. Contact: SIA "Plenty Group", security@theplentygroup.eu.