Privacy notice
This Privacy Notice (hereinafter referred to as the “Notice”) provides information on how Ignitis Latvija SIA, registration number: 40103642991, registered office address: Gustava Zemgala street 74A, LV-1039, Riga, Latvia (hereinafter referred to as ‘the Company’) processes personal data.
The provisions of the Notice are applicable to natural persons whose personal data is processed by the company:
- the clients representatives (hereinafter referred to as the “Client representative”) whose personal data is processed because the client (hereinafter referred to as the “Client”) uses, used, expressed willingness to use or are otherwise related to the services provided by the Company
- the persons who address the Company by submitting their applications, requests directly or by means of distance communication including telephone, e-mail, etc.;
- the persons who visit the Company’s website ,etc.
This Notice contains general provisions. Additional information on personal data processing by the Company may be provided in the Company’s contracts, other documents, on the website www.ignitis.lv or by remote client service channels (telephone, e-mail, etc.).
The Company will notify of any amendments to this Notice by publishing them on the Company’s website. In certain cases, the Company may inform persons of the amendments by mail, e-mail or otherwise (e.g. publishing them in the press).
Definitions
For the purposes of this Privacy Notice, the terms and abbreviations have the following meanings:
– “Personal Data” means any information in relation to an identified or unidentified natural person (e.g. name, surname, contact details etc.).
– “Natural person“ (data subject) – person, whose data is processed (for example, representative of Client representatives or suppliers of the Company, persons who apply to the Company by submitting applications or requirements, users of the Company’s website etc.).
– “Data Processing” means any action carried out with personal data (e.g. recording, storage, granting access, transfer etc.).
– “Services” shall mean any goods and services provided by the Company.
Other terms used in this Notice are construed as defined in the legal acts regulating protection of personal data - General Data Protection Regulation (EU) 2016/679 (hereinafter referred to as Regulation), Personal Data Protection Law of Republic of Latvia and other legal acts.
Purpose of and legal grounds for processing of Personal data
The Company processes Personal data only in certain specific cases on the legal grounds set forth in the legal acts, i.e. where data processing is necessary for conclusion and/or performance of a contract concluded with a person, the person has given his or her consent to processing his or her data for one or several specific purposes, the Company must process Personal data with a view to compliance of the requirements of the legal acts or Personal data must be processed for the Company’s legitimate interest.
The main purposes sought by the Company by processing Personal data:
- The performance of the functions of the electricity and gas supplier provided for in legal acts. The Company shall process Personal Data in performing its functions and obligations for the Clients and exercising its rights provided for in legal acts as those of an electricity and gas supplier.
- The provision of Services and conclusion and execution of contracts. The Company shall process Personal Data in order to ensure the proper conclusion and execution of contracts with the Clients, provision of Services or supply of goods to the Clients on the basis of contracts, including the proper provision of the Client with information about issues related to the goods, Services, and contract, on the grounds of the requirements of the contract or legal acts.
- The drawing-up of commercial offers. The Company shall process Personal Data in order to provide the Client with a commercial offer on the Services that the Client wishes to acquire.
- Payment administration. The Company shall process Personal Data related to settlement for the Services provided on the grounds of the requirements of the contract and legal acts.
- Dealing with the enquiries. The Company shall process Personal Data in considering and resolving provided questions and complaints on the grounds of the requirements of the contract, consent, or legal acts.
- Direct marketing. The Company may process Personal Data in providing offers and news on the Services being provided for the Clients and information on ongoing events on the grounds of Client consent or other legal grounds. The company can process data of e-mail interactions in order to manage Clients‘ flows in Clients‘ Service channels and to evaluate effectiveness of the communication carried out by e-mail.
- Security of persons and objects. In order to ensure the security of its employees, Clients, and other persons who enter the field of view of video surveillance equipment as well as its assets and facilities, the Company may implement video surveillance on the grounds of the requirements of legal acts or legitimate interest.
- Recruitment of personnel. When a person applies for a position within Company, the Company shall receive, process and store a range of Personal data to fulfill selection and judiciary requirements.
- Technical suitability of objects for providing Services. The Company can process Personal data in order to evaluate conditions for providing Services for the Client - suitability of buildings for the installation of a solar power plant and the possible/future economic efficiency of the installed power plant due to the proper provision of the Service.
- Other purposes. The Company may also process Personal Data for other purposes if it has received the consent of the person, must process Personal Data in executing the requirements of legal acts or has the right to process data for legitimate interest.
In all afore-mentioned cases, the Company processes Personal data only to the extent necessary for achievement of the respective clearly defined lawful purposes in accordance with the Personal data protection requirements.
Scope (categories) of processed Personal data
The main categories of Personal data and data processed by the Company for the afore-mentioned purposes and on the afore-mentioned legal grounds are as follows:
- Identity data: name, surname, job position
- Contact details: address, telephone number, e-mail address etc.
- Data of video and sound records: video data recorded in the Company’s divisions, data of records of telephone conversations, records of commercial transactions concluded by telephone or other electronic ways, etc.
- Data of job candidates: the data from candidate’s CV’s, applications, introduction letters, e-mails which was provided by the candidate.
- Cookie data: information on the location of the person (city), hobbies of the person, his or her the behavior on the Company’s website, interests etc. (more details in the section “Cookies and use thereof”).
- Other data processed by the Company on the legal grounds provided for in the legal acts.
Receipt of Personal data
The Company processes Personal data provided by the persons themselves or received by the Company from other sources such as public or private registers to the extent it is necessary on the basis of the contract, consent, legal acts or legitimate interests of the Company.
Data is also collected by means of cookies and similar techniques using methods within the scope permitted by legal acts. Use of cookies is explained in the Company’s cookie policy.
Data is also updated on the basis of information exchange rules applied in the electricity and gas markets.
Provision of Personal data
The Company is entitled to transfer the processed personal data to the recipients of the following categories in accordance with the requirements of the legal acts:
- Energy system operators. The Company may transfer Personal Data (identification data, contact data related to the provision of the Services, and other necessary data) for the purposes of guaranteed electricity and gas supply, accounting of transported gas, determination and compensation of damage, assurance of the reliability and technical safety of energy systems, management of emergencies, and for other legitimate purposes in accordance with the requirements of the applicable legal acts.
- Service providers. The Company is entitled to transfer the processed Personal data to third parties acting in the name of the Company and/or on the Commission’s instruction and providing the customer Service, software support, accounting and other Services to the Company with a view to ensuring proper provision, management and development of the Company’s Services. In such cases, the Company assumes all reasonable measures to ensure that the contracted Service providers (data processors) processed the provided Personal data only for the purposes for which the data was provided ensuring the appropriate technical and organisational security measures in accordance with the Company’s instructions and the requirements of the valid legal acts.
- Authorities and care institutions. The Company may provide the processed Personal data to public authorities or law enforcement institutions, supervisory authorities where this is obligatory according to the valid legal acts or with a view to ensuring the Company’s rights or the security of the Company’s Clients, employees and property.
- Other third parties. The Company may provide Personal data to other recipients on the lawful grounds defined in the legal acts.
Generally, the Company stores Personal data in the territory of the European Union or the European Economic Area (EU/EEA). If there are cases when Personal data shall be transferred outside the EU/EEA, that can be done only if at least one of the following conditions is met:
- The European Commission has recognized that the country to which the data is transferred ensures a sufficient level of Personal data protection;
- A data processing contract has been concluded in accordance with standard conditions approved by the European Commission;
- Codes of conduct are followed and other safeguards in accordance with the Regulation are applied.
Storage of data
The Company processes Personal data not longer than necessary for the indicated Data processing purposes or provided for in the applicable legal acts if they set forth a longer data storage period.
To set the data storage period, the Company applies the criteria which correspond to the obligations provided for in the legal acts taking into account the person’s right, for example, set such data storage period during which the requirements related to performance of the contract (if any) may be provided etc.
Applicable safeguards
The Company ensures confidentiality of Personal data according to the requirements of the legal acts and implementation of the appropriate technical and organizational measures aimed at protecting Personal data against unlawful access, disclosure, accidental loss, alteration or destruction or other unlawful processing.
Rights of the persons
The person who contacts the Company in righting and whose identity is established by the Company is entitled:
- to access his or her Personal data processed by the Company;
- to rectify his or her incorrect, incomplete, inaccurate personal data;
- to request to destroy Personal data or suspend Personal data processing actions except for storage if this is done in violation of the requirements of the applicable legal acts;
- to receive the Personal data concerning him or her, which he or she has provided in a structured, commonly used and machine-readable format;
- to request to delete the Personal data processed by the Company where the Personal data is processed in violation of the applicable legal acts or the Personal data is not necessary any longer to implement the purposes for which the data is collected or otherwise processed;
- to restrict processing of own Personal data according to the applicable legal acts, for example, for the period during which the Company will assess is the person is entitled to request that his or her data was deleted;
- to disagree with the processing of your Personal Data and / or in the case of the Processing of Personal Data by Consent – to revoke the consent given to the processing of your Personal Data, without prejudice to the consent of the processing of data until the withdrawal of consent is lawful.
Implementation of the rights of individuals.
Persons may apply for this Notice or Personal Data processing by the Company in writing by e-mail [email protected], +371 2 000 50 95 or in writing to the address: Gustava Zemgala street 74A, LV-1039, Riga, Latvia
For the purposes of the exercise of his rights in accordance with the person shall submit to the Company a written request in person, by post, via a representative, or by means of electronic communications. The request shall be readable, signed by the person, contain the first name and surname, residential place address, and contact details of the person for communication and information on for which reasons, which rights and to which extent the person wishes to implement as well as information on which way the person wishes to receive the reply.
When submitting the request, the person must confirm his identity:
- if the request is submitted directly, the person must present a personal identity document;
- if the request is submitted by post, the request shall be attached with a notarised copy of the personal identity document;
- if the request is submitted via a representative, the representative shall indicate his first name and surname as well as contact details for communication, by which the individual’s representative wishes to receive the reply and the first name, surname, and personal identification number of the represented person and present a notarised copy of the personal identity document and a copy of the document of the representation document certified in accordance with the established procedure;
- if the request is submitted by means of electronic communication, the request shall be signed by a qualified electronic signature or formed by electronic means which allow ensuring the integrity and inalterability of the text.
The Company may refuse to take actions under the person’s request if the person’s request is obviously unjustified or non-proportional.
Not later than within one month from the day of receipt of the request, the Company shall provide the person with a reply indicating information about the actions taken upon receipt of the request, in accordance with Articles 15–22 of Regulation. That period may be extended by two further months where necessary, taking into account the complexity of the request and number of the requests under consideration. Within one month from the receipt of the request, the Company shall inform the person of the extension of the term for the consideration of the request, while indicating the reasons for the extension.
The Company has the right to refuse to provide the person with information requested by that person if:
- Personal data have been collected directly from the person and that information has already been provided to the person;
- Personal data have been received not from the person himself;
- the provision of information requested by the person is impossible or would require non-proportional efforts;
- where the Personal data must remain confidential subject to an obligation of professional secrecy regulated by the law of the European Union or the Republic of Latvia, including the obligation to protect professional secret.
In implementing the person’s right to familiarise himself/herself with his/her Personal Data being processed by the Company:
- has the right to request the person to specify the presented request if the Company processes a big amount of information related to the person;
- to provide the person with information to the extent as not to infringe the rights of other persons if certain information about the person is also related with other persons.
In the event of a failure to deal with the issues concerning processing of Personal data by the Company and/or the person’s rights, the person is also entitled to apply, lodge a complaint to the State Data Protection Inspectorate.
Duties of persons
By providing their Personal data to the Company the persons certify that they have properly familiarized themselves with the terms and conditions of processing of Personal data set out in this Notice, does not object that the Company processed Personal data provided by the persons, the data and information provided by the persons are accurate and correct and the Company is not responsible for provision and processing of superfluous data if such data is provided by the person to the Company through negligence.
The person undertakes to notify the Company of any changes in the provided data or other related information.