Eco Baltia JSC (AS)

PERSONAL DATA PROCESSING NOTICE TO VISITORS, EMPLOYEES AND OTHER DATA SUBJECTS WHO ENTER THE CCTV CAMERAS’ CAPTURE AREA

1. Information about the controller

Our name is JSC (AS) “Eco Baltia”, registration number: 40103435432, legal address: Maskavas iela 240-3, Riga, LV-1063. We can be contacted by phone: +371 67799999 or by writing to e-mail: info@ecobaltia.lv

2. Contact details for questions related to personal data protection

If you have any questions about this notice or the processing of your personal data, you can contact us through the channels indicated in the previous clause (Clause 1) or by e-mail: dati@ecobaltia.lv

3. General description of our processing of personal data

This notice describes how we process personal data collected as a result of our video surveillance and other security measures.

The purpose of this notice is to provide visitors to our premises and facilities and other persons who enter the CCTV cameras’ capture area with an opportunity to familiarise themselves with our rules on the processing of personal data.

This is the current version of the Notice. We reserve the right to amend and update this Notice as necessary.

The purpose of this Notice is to provide you with a general overview of our processing activities and purposes, but please note that other documents (such as the Terms of Use of the Website (available at www.ecobaltia.lv website), other notices) may contain additional information about the processing of your personal data.

We recognise that personal data is your valuable asset and will process it in a way that respects the confidentiality and security of the personal data we hold about you.

4. For what purposes do we process your personal data and what is the legal basis for processing your personal data?

We will only process your personal data in accordance with the legitimate purposes as defined above, including:

a)           Preventing threats to property, life and health, investigating and detecting criminal offences, ensuring public security and other essential legitimate interests by means of video surveillance

For this purpose, we need to carry out video surveillance of our territory, buildings, premises and other property, to use personal data processors for various functions, to provide information to investigative authorities, courts and other public authorities where necessary, to provide information to third parties (such as tenants of premises/territory) for their legitimate purposes (for example, detection of criminal offences), as well as to exercise the rights granted by laws and regulations for their legitimate interests.

Please be further informed that video surveillance devices may also be installed on our premises and in our territory to protect the interests of other tenants as controllers, in which case such video surveillance is the responsibility of each tenant independently.

For this purpose, we may need to process at least the following personal data: the person’s appearance (image), the location and time of the person, the activities carried out by the person in the area covered by the video cameras and other data as necessary;

The main legal bases used to achieve these purposes are:

–           Performing legal obligations (Article 6(1)(c) of GDPR)

– because the territory is at risk and the laws and regulations impose heightened security requirements for guarding such sites;

–           The legitimate interests of the controller or of a third party (Article 6(1)(f) of the GDPR);

b)           Visitor records, for the investigation and detection of threats to property, criminal offences, public safety and other essential legitimate interests

For this purpose, we collect information about your identity that is required to be included in the visitor log.

For this purpose, we may need at least the following personal data: Your name, personal identification number or date of birth, car number (if entering by car), visual verification of identity document, identity document number and date of issue and other information, time of arrival and time of departure from the territory or premises.

The main legal bases used to achieve these purposes are:

–           Performance of legal obligations (Article 6(1)(c) GDPR) – because the territory is a high-risk site and the laws and regulations impose heightened security requirements for guarding such sites;

–           The legitimate interests of the controller or of a third party (Article 6(1)(f) of the GDPR);

c)           Maintenance of the pass-through regime

For this purpose, we collect information about your identity and the need to obtain a pass, which needs to be included in the pass logbook and displayed on the pass.

For this purpose, we may need at least the following personal data: Your name, personal identification number (or date of birth), visual verification of the identity document, number and date of issue of the identity document and other information, time of arrival and time of departure from the territory or premises.

The main legal bases used to achieve these purposes are:

–           Performance of legal obligations (Article 6(1)(c) GDPR) – because the territory is a high-risk site and the laws and regulations impose heightened security requirements for guarding such sites;

–           The legitimate interests of the controller or of a third party (Article 6(1)(f) of the GDPR).

5. Who could access your personal data?

We take appropriate measures to process your personal data in accordance with applicable law and to ensure that your personal data is not accessed by third parties who do not have an adequate legal basis for processing your personal data.

Your personal data can be accessed as necessary by:

1)           employees or directly authorised persons of ours and other companies within our group of companieswho need to do so for the performance of their duties, such as security guards, security officers, line managers;

2)           processors of personal data in accordance with the services they provide and only to the extent necessary, e.g. security service providers, technical database maintainer;

3)           investigating authorities, security authorities and other state and local authorities in cases provided for by law;

4)           in some cases, tenants of the territory and premises for their legitimate aims (e.g. detecting crime).

6. Which personal data processing partners or personal data processors do we choose?

We take appropriate measures to ensure the processing, protection and transfer of your personal data to data processors in accordance with applicable law. We carefully select our personal data processors and, when making a transfer, assess the need for the transfer and the amount of data to be transferred. The transfer of data to processors is carried out in compliance with the requirements of confidentiality and secure processing of personal data.

At the moment, we can cooperate with the following categories of personal data processors:

1)           outsourced security service provider;

2)           IT infrastructure, database maintenance.

Personal data processors may change from time to time, and we will make appropriate changes to this document.

7. Is your personal data transferred to countries outside the European Union (EU) or the European Economic Area (EEA)?

We do not transfer data to countries outside the European Union or the European Economic Area.

8. How long will we store your personal data?

Your personal data will be stored for as long as it is necessary for the purposes for which the personal data are processed and in accordance with the requirements of applicable law.

When assessing the duration of the retention of personal data, we take into account the applicable legal requirements, the performance of contractual obligations, your instructions (e.g. in the case of consent), as well as our legitimate interests. If your personal data is no longer necessary for the purposes specified, we will delete or destroy it.

For example, we will keep CCTV footage for up to 3 (three) months to ensure that appropriate evidence is available in the event of a claim or incident.

Visitor logs can be kept for up to 12 months.

For the pass regime – for as long as the pass is valid and/or for up to 3 months after the pass expires, to allow investigation of events recorded later.

9. What are your rights as a data subject in relation to the processing of your personal data?

Updating personal data

If there are any changes to the personal data you have provided to us, such as a change of contact address, a change of telephone number or e-mail, a change of ownership of the property, please contact us and provide us with the updated data so that we can meet the relevant purposes of processing your personal data.

Your right to access and rectify your personal data

In accordance with the provisions of the General Data Protection Regulation, you have the right to access your personal data held by us, to request its rectification, erasure, restriction of processing, to object to the processing of your data, as well as the right to data portability in the cases and in the manner provided for in the General Data Protection Regulation. However, you do not have the right to request that the video recordings be corrected or supplemented, as this would constitute falsification or distortion of information. We reserve the right not to provide you with a copy of personal data, including personal data obtained through video surveillance, in cases where such provision would be prejudicial to other data subjects and there are no technical possibilities to provide a copy of the personal data without prejudice to the rights of other data subjects, or where such provision would require an excessive commitment of time, staff or financial resources due to its size or complexity.

We respect this right to access and control your personal data, so if we receive your request, we will respond to it within the time limits set out in the laws and regulations (usually no later than one month, unless there is a specific request that requires more time to prepare a response) and, if possible, we will correct or delete your personal data accordingly.

You can obtain information about your personal data held by us or exercise your other rights as a data subject in any of the following ways:

1)           by applying in person and identifying yourself by showing proof of identity at our office at: Maskavas iela 240 – 3, Riga, LV-1063, every working day from 10 am to 4 pm;

2)           by submitting an application to that effect by post to us at the following address: Maskavas iela 240-3, Riga, LV-1063.

3)           by submitting an application to our e-mail address: dati@ecobaltia.lv, signed with a secure electronic signature.

Upon receipt of your submission, we will assess its content and the possibility of identifying you and, depending on the situation, reserve the right to ask you to identify yourself further in order to ensure the security and disclosure of your data to the appropriate person.

Withdrawal of consent

If the processing of your personal data is based on your consent, you have the right to withdraw it at any time and we will no longer process your personal data that we processed on the basis of your consent for the relevant purpose. However, we inform you that withdrawal of consent may not affect the processing of personal data that is necessary to comply with the requirements of laws and regulations or that is based on a contract, our legitimate interests or other grounds for lawful data processing set out in laws and regulations.

You may also object to the processing of your personal data where the processing is based on legitimate interests.

10. Where can you lodge a complaint about issues related to the processing of personal data?

If you have any questions or objections regarding our processing of your personal data, we encourage you to contact us first of all.

If you believe that we have not been able to resolve the issue mutually and you believe that we have violated your right to the protection of personal data, you have the right to lodge a complaint with the State Data Inspectorate. You can find sample applications to the State Data Inspectorate and other related information on the website of the State Data Inspectorate: (http://www.dvi.gov.lv/lv/datu-aizsardziba/privatpersonam/iesniegumu-paraugi/).

11. Why do you need to provide us with your personal data?

We primarily collect your information to ensure the security of our territory and premises, to protect your vital interests, to comply with our legal obligations and to pursue our legitimate interests. In these cases, we need to obtain certain information for the purposes in question, so failure to provide such information may jeopardise the issue of the pass or your access to our territory or premises. If the data is not strictly necessary, but its provision could help improve the working environment or your employment conditions, we will indicate that the provision of the data is voluntary.

12. How do we obtain your personal data?

We may obtain your personal data in one of the following ways:

1)            from you by providing us with details about yourself;

2)           from third parties who submit data about you (for example, your employer);

3)           from other companies in our group, where applicable;

4)           from CCTV footage and access control systems.

13. Is your personal data used for automated decision-making?

We do not use your data for automated decision-making.