Eco Baltia JSC (AS)

PERSONAL DATA PROCESSING NOTICE TO CUSTOMERS AND OTHER RELATED PERSONS

1 Information about the controller

JSC (AS) “Eco Baltia”, registration number 40103435432, registered office: 240 Maskavas Street, Office 3, Riga, LV-1063.

Contact tel.: 67409828; e-mail: info@ecobaltia.lv

https://ecobaltia.lv/

2 Contact details for personal data protection issues

If you have any questions about this notice or the processing of your personal data, you can contact us using the contact methods set out in Clause 1 or by email at: dati@ecobaltia.lv

3 General description of our processing of personal data

This notice describes how we process the personal data of our customers, customer representatives/contact persons, beneficial owners, participants of raffles, lotteries and contests, business partners, visitors to our offices and territory, website visitors and other persons whose data may come into our possession in the course of our commercial activities.

We assume that, before using our website or otherwise contacting us or upon becoming our customer, you have read this notice and accepted its terms. This is the current version of the notice; we reserve the right to amend and/or update this notice from time to time.

The purpose of this notice is to provide you with a general overview of our personal data processing activities and purposes, however, please note that other documents (e.g. service agreements, cooperation agreements, rules of raffles/lotteries/contests, website or portal terms of use, etc.) may contain additional information about the processing of your personal data. Please be advised that the personal data processing rules contained in this notice apply only to the processing of personal data of natural persons.

We are aware that personal data is your asset, and we will process it in a confidential manner, taking care of the security of your personal data in our possession.

4 For what purposes do we process your personal data and what is the legal basis for processing personal data?

We will only process your personal data in accordance with the legitimate purposes as defined above, including:

a)           For the provision of services and the fulfilment and maintenance of contractual obligations For this purpose, we would also need to identify you, contact you about the offer, provision of the service and/or matters related to the performance of the contract (including surveys and/or studies related to services/satisfaction with services, service planning and statistics, preparation of reports, sending invoices, etc.), and in some cases to ensure the recovery of outstanding payments.

For this purpose, we may need the following personal data: name, surname, telephone number, email address. The main legal basis to be used to achieve these purposes are:

The main legal basis to be used to achieve these purposes are:

–           performance of the contract (Article 6(1)(b) of the General Data Protection Regulation[1]

–           Compliance with legal obligations (Article 6(1)(c) of the General Data Protection Regulation);

–         Compliance with legal obligations (Article 6(1)(c) of the General Data Protection Regulation); –         Legitimate interests of the controller (Article 6(1)(f) of the General Data Protection Regulation), such as identifying you as a contact person of a customer, client and/or business partner, ensuring communication with you.

b)           Compliance with the requirements laid down in laws and regulations on the provision of waste management services, or with the requirements laid down in other laws and regulations

For this purpose, we would need to comply with the requirements of the Accounting Law, the Archives Law, the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing, the Law on International Sanctions and National Sanctions of the Republic of Latvia and other laws and regulations.

For this purpose, we may need to process the following personal data: name, surname, email address, telephone number. The main legal basis to be used to achieve these purposes are:

The main legal basis to be used to achieve these purposes are:

–           compliance with legal obligations (Article 6(1)(c) of the General Data Protection Regulation).

c)            Provision of marketing activities

For this purpose, we may send you commercial communications, enable your participation in lotteries and/or raffles and/or competitions organised by us, as well as publish materials, including photos and videos, from public events organised by us.

For this purpose, we may need at least the following personal data: name, surname, telephone number, email address, photograph, video. The main legal basis to be used to achieve these purposes are:

The main legal basis to be used to achieve these purposes are:

–           data subject’s consent (Article 6(1)(a) of the General Data Protection Regulation);

–           conclusion and performance of a contract with the data subject (Article 6(1)(b) of the General Data Protection Regulation);

–           Legitimate interests of the Controller (Article 6(1)(f) of the General Data Protection Regulation), e.g. for the purposes of communication, promotion of the Controller’s image.

d)            Prevention of threat to security, property interests and other important legitimate interests of ours or third parties

For this purpose, we would need to carry out video surveillance of our territory, buildings and other properties, record telephone conversations, use personal data processors for various functions, disclose information to public authorities where necessary, exchange information within our group of companies, exercise the rights granted by laws and regulations for our legitimate interests.

For this purpose, we may need to process at least the following personal data: name, surname, personal identity number, address of the object, number of declared residents at the address, appearance of the person (picture), place and time of location, and other data as necessary; The main legal basis to be used to achieve these purposes are:

The main legal basis to be used to achieve these purposes are:

–           The legitimate interests of the Controller (Article 6(1)(f) of the General Data Protection Regulation), e.g. for solution of criminal offences, debt recovery.

e)            For proper provision of services

Within the framework of this purpose, we maintain and improve technical systems and IT infrastructure.

The main legal basis to be used to achieve these purposes are:

–           The legitimate interests of the Controller (Article 6(1)(f) of the General Data Protection Regulation).

f)            For record-keeping purposes

Incoming and outgoing correspondence/communication with data subjects (by phone, email, in person, by post, by fax).

Within the framework of this purpose, we may need the following personal data: name, surname, telephone number, e-mail address, address, other information provided by the data subject or indicated in the document.

The main legal basis to be used to achieve these purposes are:

–           Compliance with legal obligations (Article 6(1)(c) of the General Data Protection Regulation);

Legitimate interests (Article 6(1)(f) of the General Data Protection Regulation), e.g. provision of communication with you, provision of answer/information.

5 Who could access your personal data?

We take appropriate measures to process your personal data in accordance with the applicable laws and regulations and to ensure that your personal data is not accessed by third parties who do not have an adequate legal basis for processing your personal data.

Your personal data can be accessed as necessary by:

1)           employees or directly authorised persons of our and other companies within our group of companies who need to do so in order to carry out their professional duties;

2)           processors of personal data in accordance with the services they provide and only to the extent necessary, such as auditors, financial management and legal advisers, database developer/technical maintainer, other persons involved in the provision of the controller’s services;

3)           state and local authorities in cases provided for by the laws and regulations, such as law enforcement authorities, local governments, tax authorities, sworn bailiffs;

4)           third parties, carefully assessing whether there is an appropriate legal basis for such data transfers, such as debt collectors, courts, out-of-court dispute resolution bodies, insolvency administrators, third parties maintaining registers (e.g. population register, debtors’ register, etc.).

6 Which personal data processing partners or processors do we choose?

We take appropriate measures to ensure the processing, protection and transfer of your personal data to data processors in accordance with the applicable laws. We carefully select our personal data processors and, when making a transfer, assess the need for the transfer and the amount of data to be transferred. Transfer of data to processors is carried out in compliance with the requirements of confidentiality and secure processing of personal data.

Currently, we can cooperate with the following categories of personal data processors:

1)           auditors, financial management and legal advisers, debt collectors;

2)           owner/developer/technical maintainer of IT infrastructure, database;

3)           other persons involved in the provision of our services.

Personal data processors may change over time, including through introduction of changes to this document.

7 Is your personal data transferred to countries outside the European Union (EU) or the European Economic Area (EEA)?

We do not transfer data to countries outside the European Union or the European Economic Area.

8 How long will we keep your personal data?

Your personal data are stored for as long as it is necessary for the relevant purposes of the personal data processing, as well as in accordance with the requirements of the applicable laws. When assessing the duration of the storage of personal data, we take into account the requirements of applicable laws and regulations, the aspects related to performance of contractual obligations, your instructions, as well as our legitimate interests. If your personal data is no longer necessary for the purposes specified, we will delete or destroy it.

Below we list the most common storage periods of personal data:

–           personal data necessary for the performance of contractual obligations will be stored by us until the contract is performed and other storage periods expire (see below);

–           personal data that needs to be stored to comply with the requirements of the laws will be stored by us for the periods specified in the relevant laws and regulations, g. the Law on Accounting stipulates that supporting documents must be stored until the date they are necessary to establish the beginning of each economic transaction and to trace its progress, but not for less than 5 years;

–           data required to prove the fulfilment of our obligations will be stored by us for the general limitation period of the claim in accordance with the statutory limitation periods set for claims – 10 years in the Civil Law, 3 years in the Commercial Law and other periods, taking into account also the time limits for taking legal actions set out in the Civil Procedure Law.

–           data for marketing activities will be stored by us by the end of the specific activity or, in cases where a specific time limit cannot be determined or the time limit set by laws and regulations has not expired, for no longer than 2 years.

9 What are the rights you possess as a data subject in relation to the processing of your personal data?

Update of personal data

If there are changes to the personal data you have provided to us, such as a change of personal identity number, contact address, telephone number or email address, please contact us and provide us with the updated data so that we can meet the relevant purposes of processing your personal data.

Your right to access and rectify your personal data

In accordance with the provisions of the General Data Protection Regulation, you have the right to access your personal data which is at our disposal, to request its rectification, deletion, restriction of processing, to object to the processing of your data, as well as the right to data portability in the cases and in accordance with the procedure stipulated in the General Data Protection Regulation. We respect your right to access and control your personal data, so if we receive a request from you, we will respond within the time limits set out in the laws and regulations (usually no later than one month, unless there is a specific request that requires more time to prepare a reply) and, where possible, we will correct or delete your personal data accordingly.

You can obtain information about your personal data held by us or exercise your other rights as a data subject in any of the following ways:

1)           by submitting a relevant application in person and identifying yourself at our office with proof of identity (business days from 10 am to 4 pm), or by sending it by post to: 240 Maskavas Street, Office 3, Riga, LV-1063;

2)           by submitting a relevant application by sending it to our email address: dati@ecobaltia.lv, signing it using a secure electronic signature.

Upon receipt of your application, we will assess its content and the possibility of your identification and, depending on the situation, we reserve the right to ask you to additionally identify yourself in order to ensure the security and disclosure of your data to the relevant person.

Withdrawal of consent

If the processing of your personal data is based on your consent, you have the right to withdraw it at any time and we will no longer process your personal data that we processed on the basis of your consent for the relevant purpose. However, we inform you that withdrawal of consent may not affect the processing of personal data that is necessary to comply with the requirements of laws and regulations or that is based on a contract, our legitimate interests or other grounds for lawful data processing set out in laws and regulations.

10 Where can you complain about issues related to the processing of personal data?

If you have any questions or objections related to our processing of your personal data, we encourage you to contact us in the first instance. If you still believe that we have not been able to resolve the issue mutually and you believe that we have violated your right to the protection of personal data, you have the right to lodge a complaint with the Data State Inspectorate. You can find sample applications to the Data State Inspectorate and other related information on the website of the State Data Inspectorate: (http://www.dvi.gov.lv/lv/datu-aizsardziba/privatpersonam/iesniegumu-paraugi/).

11 Why do you need to provide us with your personal data?

We primarily collect your information to fulfil our contractual obligations, comply with our binding legal obligations and pursue our legitimate interests. In these cases, it is necessary for us to obtain certain information for the purposes in question, so failure to provide such information may jeopardise the start of the business relationship or the performance of the contract. If the data is not strictly necessary, but the provision of the data could help us to improve our service or offer you favourable contractual terms and/or offers, we will indicate upon the collection of data that provision of the data is voluntary.

12 How do we obtain your personal data?

We may obtain your personal data in one of the following ways:

1)           in the process of entering into a mutual contract, obtaining data from you or a person representing you;

2)           if the contract is entered into with a third party and that third party has identified you as the contact person or service user;

3)           from you, if you will submit us any applications, send us emails, call us;

4)           from you if you sign up for our services online;

5)           from you by logging in on the website ecobaltia.lv;

6)           on the website ecobaltia.lv using cookies;

7)           in certain cases, we may obtain data from databases of third parties, for example, when conducting business partner research in the cases provided for by laws and regulations;

8)           in relevant cases, from other companies in our group;

9)           from CCTV footage.

13 Is your personal data used for automated decision-making?

We do not use your data for automated decision-making.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)