Privacy Notice
This Privacy Notice (the “Notice”) provides information on how SIA “Ignitis Latvija”, registration No. 40103642991, legal address: Gustava Zemgala gatve 74A, LV-1039, Riga, Latvia (the “Company”) processes personal data.
The provisions of the Notice apply to natural persons whose personal data is processed by the Company:
i. costumer or costumers’ representatives (the “Customer Representative”) whose personal data is processed because the customer (the “Customer”) uses, has used, has expressed an intention to use, or is otherwise connected with the services provided by the Company;
ii. persons who wish to receive protected customer support for an electricity trade agreement concluded by another person and who apply to the Company for support as a sub-user.
iii. persons who charge electric cars at Ignitis charging stations and use the Ignitis ON electric car charging service application (the “Application”);
iv. Ignitis ON (electric car charging service) partners or partner representatives (the “Partner”);
v. persons who contact the Company by submitting applications, requests either directly or through remote means of communication, including telephone, e-mail, etc.;
vi. persons who visit the Company's website, etc.
This Notice contains general provisions. Additional information on the processing of personal data by the Company may be provided in the Company's agreements, other documents, on the website www.ignitis.lv or through remote customer service channels (telephone, e-mail, etc.).
The Company will notify you of any changes to this Notice by publishing them on the Company's website. In the event of significant changes, the Company will also notify individuals about the changes through additional means, such as by email or other appropriate channels (e.g., by publishing them in the press).
Definitions
In this Privacy Notice, the terms and abbreviations have the following meanings:
“Personal Data” is any information about an identified or identifiable natural person (e.g., name, surname, contact information, etc.).
“Natural Person” (data subject) means a person whose data is being processed (e.g., Customer representative or Company supplier employees, persons who contact the Company by submitting applications or requests, users of the Company’s website, etc.).
“Data Processing” is any action performed with Personal Data (e.g., registration, storage, granting access, transfer, etc.).
“Services” is all goods and services provided by the Company.
Other terms used in this Notice are interpreted as defined in the legislation governing the protection of Personal Data – the General Data Protection Regulation (EU) 2016/679 (the “Regulation”), the Personal Data Processing Law of the Republic of Latvia, and other legislations.
Purpose and legal basis of personal data processing
The Company processes Personal Data only in specific cases, for example, based on the legal basis specified in legislation, if data processing is necessary to conclude and/or perform an agreement concluded with a person, the person has given consent to the processing of their data for one or more specified purposes, the Company must process Personal Data to comply with legal requirements, or Personal Data must be processed for the legitimate interests of the Company.
The main objectives that the Company wishes to achieve by processing personal data. Categories of data processed.
We process various types of Personal Data, which largely depends on the Services you use as a data subject or the activities performed by the data subject themselves. In order to provide our Services in accordance with regulatory requirements and perform other functions, it is necessary to process your Personal Data. For example, your Personal Data may be processed for the following reasons:
i. To perform the functions of an electricity and gas supplier as stipulated by law
Purpose: The Company processes Personal Data in the performance of its functions and duties in relation to Customers and in the exercise of its rights as an electricity and gas supplier as stipulated by law. Historical data received from the system operator is processed on the basis of consent.
Personal Data processed:
• identification data: name, surname, personal identification number;
• contact information: declared place of residence, mailing address, telephone number, e-mail address;
• data related to the agreement and its performance, as well as the performance of obligations stipulated in legislation, including historical electricity consumption data obtained from the system operator, etc.
ii. Preparation of commercial offers
Purpose: The Company processes Personal Data in order to provide the Customer with a commercial offer for the Services that the Customer wishes to purchase.
Processed Personal Data:
• identification data: name, surname, personal identification number;
• contact information: declared place of residence, mailing address, telephone number, e-mail address;
• information about services of interest;
• data from previous communications or requests;
• technical information, if necessary (e.g., property address or service specification, as well as historical electricity consumption data obtained from the system operator).
iii. Provision of services and conclusion and performance of agreements
Purpose: The Company processes Personal Data to ensure the proper conclusion and performance of agreements with Customers, the provision of Services or delivery of goods to Customers on the basis of agreements, including to ensure the provision of protected customer support, and, based on the requirements of the agreement or legal acts, to properly provide the Customer with information on issues related to goods, Services, and the agreement. Historical data received from the system operator is processed on the basis of consent.
Processed Personal Data:
• identification data: name, surname, personal identification number;
• contact information: declared place of residence, mailing address, telephone number, e-mail address;
• data related to the agreement with the Customer/Partner and its performance: object address/parking lot address, information related to the concluded agreement (plan, tariffs, rental fee), information related to meter readings, information related to electricity or natural gas consumption, information related to the issued invoice (amount, date, information related to the payment of the invoice (fact of payment of the invoice, amount, date), historical electricity consumption data obtained from the system operator;
• data related to the provision of protected customer support, for example, the name, surname, and personal identification number of the protected customer registered in the agreement, information about the granted payment reduction, information about the agreement number and address to which the payment reduction applies, contact information, protected customer category, and other information provided in the person's application.
iv. Ensuring compliance and quality
Purpose: To ensure compliance with applicable laws and internal regulations, such as conflict-of-interest prevention, partner screening, economic and financial sanctions screening, supply chain compliance, and quality control requirements. Such activities are essential for the Company to comply with legal requirements and, at the same time, effectively manage operational and reputational risks.
Personal Data processed:
• information on cooperation partners, which includes data held by the Company about potential or existing cooperation partners. This data may also be obtained from publicly available sources, such as the media, public registers or databases;
• sanctions list screening information to ensure that the customer, its officers, members, or beneficial owners are not included in the sanctions lists of the European Union, the United Nations, the United Kingdom, the United States of America, or the Republic of Latvia, or equivalent lists. At the same time, an assessment is made as to whether the persons concerned are involved in activities that could indicate involvement in money laundering, terrorist financing or tax evasion. Such processing is essential to prevent or detect money laundering and terrorist financing, as well as to ensure compliance with the Company's internal policies and legal requirements.
v. Monitoring of payment execution, creditworthiness assessment and debt management
Purpose: To ensure effective payment monitoring, assess customer creditworthiness before concluding an agreement or during its term, as well as to manage debt obligations and take the necessary debt recovery measures. Such processing is essential for the Company to assess and manage financial risks, protect its legal interests, and ensure the proper performance of service agreements. The scope of Personal Data processing varies depending on whether the customer is a natural or legal person.
Personal Data processed:
• payment and agreement data, including agreement number, type of service, billing information, payment dates, amounts and delays, as well as information about payment reminders and warnings sent;
• credit assessment data, which may include information from credit reference agencies or public registers, as well as financial history;
• information about the debt collection process, including the involvement of debt collection service providers, as well as, where applicable, information about litigation or enforcement proceedings.
vi. Conclusion and performance of agreements with Ignitis ON Partners and Customers
Purpose: The Company processes Personal Data in order to conclude and perform agreements with Ignitis ON partners and Customers.
Personal data processed:
• name, surname, personal identification number, contact information;
• content of the agreement, service specification, terms and conditions, etc.
vii. Provision of electric car charging services and related applications to customers
Purpose: The Company processes Personal Data in order to provide the Customer with appropriate electric car charging services and to enable the Customer to obtain information related to the charging of their electric car and to make payments conveniently.
Personal data processed: data related to the provision of electric vehicle charging services and the use of the Application, such as information about the Customer's electric car charging, payment information, information provided by the person when creating an account in the Application and using the Application.
viii. Review of requests
Purpose: The Company processes Personal Data when reviewing and resolving submitted questions and complaints based on the requirements of the agreement, consent, or legislation.
Personal data processed:
• identification data and contact information, such as name, surname, e-mail address, telephone number, address or customer identification number, to ensure communication and link the request to the specific customer;
• agreement data, if the request is related to an existing or previous agreement, including information about the services used, invoices, payment status, or service history;
• the content of the request, including the text of the application, question or complaint, as well as the Company's responses and communication records necessary for documenting communication and ensuring quality;
• any attached documents submitted as part of the request (e.g., copies of invoices, agreement extracts, screenshots, etc.).
ix. Direct marketing
Purpose: The Company may process Personal Data when providing Customers with offers and news regarding the Services provided, as well as information about ongoing events, based on the Customer's consent or other legal grounds. The Company may process e-mail communication data to manage Customer flows in Customer service channels and evaluate the effectiveness of e-mail communication.
Personal data processed:
• identification data and contact information, such as name, surname, email address, telephone number;
• marketing communication data, such as the fact that a marketing message has been sent, opened, or links clicked on;
• service usage data, including information about the services selected by the customer, their frequency of use, duration, or interest in specific products, if this information is necessary for creating offers;
• interest and preference data, if provided (e.g., selected topics, service categories, preferred communication channels, participation in campaigns or events).
x. Video surveillance
Purpose: In order to ensure the safety of its employees, customers, and other persons who enter the field of view of video surveillance equipment, as well as the security of its property and equipment, the Company implements video surveillance based on legitimate interests. Video surveillance may be carried out at Ignitis electric car charging stations. A warning will be provided via video surveillance signs regarding the use of video surveillance at specific electric car charging stations.
Processed Personal Data: video surveillance recordings.
xi. Recording of telephone conversations
Purpose: The company may process Personal Data by recording telephone conversations with customers in order to provide evidence of the conclusion, amendment and performance of a agreement, as well as to ensure the quality of customer service and protect the rights of the parties. You will be informed about the recording of the conversation by means of a voice message.
Processed Personal Data: voice recording (audio recording), date of the conversation, time and duration of the conversation, incoming or outgoing phone number, as well as information provided during the conversation, such as name, surname, personal identification number, agreement number, address, contact information, or other information that the customer voluntarily provides during the conversation.
xii. Candidate selection
Purpose: When a person applies for a position at the Company, the Company receives, processes, and stores a range of personal data in order to fulfil the selection and regulatory requirements.
Processed Personal Data: data of the job candidate, such as data from candidate CV, application letters, and e-mails provided by the candidate.
xiii. Cookie processing
Purpose: To improve the functionality of the website, ensure its operation, and tailor the user experience to individual usage habits. Cookies are also used to obtain statistics on user interaction with the website, as well as to display personalized content, marketing materials, and offers based on user activity on the website.
Personal data processed: information collected using cookies, such as IP address, device type, browser settings, date and time of visit, website usage habits and activities. Detailed information about the cookies used and the options for opting out of them is available in our cookie policy.
xiv. Compliance with legal obligations, enforcement of rights, and other legitimate purposes
Purpose: The company processes personal data in order to provide information to state authorities in cases provided by law (e.g., the State Revenue Service, law enforcement agencies, supervisory authorities), as well as to pursue its legitimate interests in litigation, in the examination of claims or in other legal proceedings.
The Company may also process Personal Data for other purposes if it has obtained the consent of the individual, if it is required to process Personal Data in order to comply with legal requirements, or if it has the right to process data based on the Company's legitimate interests.
Processed Personal Data: Depending on the specific purpose of data processing.
In all of the above cases, the Company processes Personal Data only to the extent necessary to achieve the relevant clearly defined legitimate purposes in accordance with Personal Data protection requirements.
Receipt of personal data
The Company processes Personal Data that individuals provide themselves or that the Company receives from other sources, such as public or private registers and data information systems, to the extent necessary, based on an agreement, consent, legislation, or the Company's legitimate interests. In certain cases, we may receive data from cooperation partners or public authorities, etc.
Data may also be obtained through video surveillance cameras at Ignitis electric car charging stations. Data is also obtained through telephone call recordings in cases where calls are recorded.
Data is also collected using cookies and similar techniques, using methods that comply with the methods permitted by law. The use of cookies is explained in the Company's cookie policy.
Data may be obtained and updated based on the rules for the exchange of information applicable in the electricity and gas markets.
Provision of personal data
The Company has the right to transfer processed personal data to the following categories of recipients in accordance with legal requirements:
- Employees and authorized persons. Personal data may be available to Company employees or authorized persons who processes such data on behalf of the Company only to the extent and for the purposes of processing that arise from their job duties and competence.
- Persons authorized by customers. The Company may provide information to persons authorized by the Customer (e.g., a family member or legal representative) if the relevant authorization is received.
- Energy system operators. The Company may transfer Personal Data (identification data, contact information related to the provision of Services, and other necessary data) to energy system operators for the purposes of ensuring the supply of electricity and gas, transported gas accounting, loss determination and compensation, ensuring the reliability and technical safety of energy systems, emergency management and other legitimate purposes in accordance with the requirements of applicable law.
- Protected customer data information system administrator. The company may transfer data to the protected customer data information system administered by the State Construction Control Bureau, which grants and revokes protected customer status.
- Service providers. The Company has the right to transfer processed Personal Data to third parties acting on behalf of the Company and providing the Company with customer service, software support, accounting, legal, and other Services on behalf of the Company to ensure the proper provision, management, and development of the Company's Services. In such cases, the Company shall take all reasonable measures to ensure that the contracted Service Providers (including data processors) process the Personal Data provided only for the purposes for which the data was provided, ensuring appropriate technical and organizational security measures in accordance with the Company's instructions and the requirements of applicable law.
- Law enforcement and other responsible or supervisory authorities. The Company may provide the processed Personal Data to state authorities or law enforcement authorities, as well as supervisory authorities, if this is mandatory in accordance with applicable laws or to ensure the rights of the Company or the safety of the Company's Customers, employees and property.
- Banks. Personal data may be transferred to financial institutions (banks, payment institutions) to ensure payments.
- Debt collection companies. With regard to debt obligations, personal data may be transferred to debt collection companies to ensure the recovery of debts through legal means.
- Credit information agencies. The company may provide certain personal data to credit information agencies in accordance with the procedure established by regulatory enactments, for example, to assess solvency or to inform about the existence of debt.
- Group companies. Personal data may be transferred to companies belonging to the same group as the Company if this is necessary for administrative or customer service purposes, for example, to provide joint services or to ensure a consistent customer experience.
- Other third parties. The Company may provide personal data to other recipients based on legal grounds specified in legislation.
Data storage
The Company processes Personal Data in accordance with the following rules:
• it is stored for as long as necessary to fulfil the obligations set out in the regulatory framework;
• if Personal Data is processed on the basis of your consent, it is stored for as long as this consent is valid and has not been revoked;
• Personal data is stored for as long as necessary to achieve the specified processing purpose and in accordance with legitimate interests (e.g., reviewing requests, protecting rights, resolving issues, observing the statute of limitations for claims, etc.).
Data related to agreements concluded with Customers and Partners (legal entities) is stored for the duration of the agreement and for 5 years after the end of the agreement. Data related to agreements concluded with Customers and Partners (Natural Persons) is stored for the duration of the agreement and for 10 years after the agreement expires.
Video surveillance data is stored for 30 days. If illegal activities have been detected and video recordings are necessary for their detection, the data is stored for as long as necessary for the investigation of the criminal offense in accordance with applicable regulatory enactments.
The date of telephone call recordings is stored for the entire duration of the electricity trade agreement and for 3 years after the termination of the agreement.
Data related to direct marketing is stored for 5 years from the date of consent or until consent is withdrawn.
Applicable security measures
The company ensures the confidentiality of personal data in accordance with the requirements of the law and applies appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, accidental loss, alteration, destruction, or other unlawful processing.
Transfer of personal data outside the EU/EEA
The Company endeavours to process Personal Data within the European Union (EU) and the European Economic Area (EEA) as far as possible. However, in certain cases, such as for website traffic statistics and marketing purposes, the Company may use third-party cookies (e.g., from Google or Meta). The information generated by such cookies may be transferred to and stored on servers outside the EU/EEA, including in countries for which the European Commission has not adopted a decision on the adequacy of the level of personal data protection. In such cases, depending on the specific circumstances, the Company may apply one or more of the safeguards provided for in the Regulation, such as:
– Standard data protection clauses approved by the European Commission.
Personal rights
A person who contacts the Company to exercise their rights and whose identity is verified by the Company has the right to:
a. access their personal data processed by the Company;
b. correct their incorrect, incomplete, or inaccurate Personal Data;
c. request the destruction of Personal Data or the suspension of Personal Data processing activities if this is done in violation of the requirements of applicable law;
d. receive Personal Data about themselves that they have provided in a structured, commonly used and machine-readable format;
e. request the deletion of Personal Data processed by the Company if the Personal Data is processed in violation of applicable legal requirements or if the Personal Data is no longer necessary for the purposes for which it was collected or otherwise processed;
f. restrict the processing of their Personal Data in accordance with applicable law, for example, for the period during which the Company assesses whether the person has the right to request the deletion of their data;
g. object to the processing of Personal Data and/or withdraw consent given to the processing of Personal Data. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal;
h. not to be subject to automated decision-making, including profiling, if it produces legal effects concerning the person or similarly significantly affects the person, as well as the right to request human intervention in the decision-making process, to express their point of view or to contest such a decision, in accordance with Article 22 of the Regulation;
i. A person has the right to lodge a claim with a court or a complaint with a supervisory authority - the Data State Inspectorate in Latvia - if they consider that the processing of their personal data is contrary to applicable law.
Automated decision-making
We may use automated decision-making and profiling, for example:
• to prepare personalized offers and notifications based on your service usage habits;
• for the purposes of monitoring payment performance, assessing creditworthiness and managing debt;
• to ensure and improve the quality of our services, for example, by optimizing the consumption of electricity or other resources.
These processes help us to provide you with more relevant and convenient services. You have the right to object to automated decision-making and request that a human be involved in the decision-making process.
Exercising the rights of Natural Persons
Individuals may submit an application regarding this Notice or the processing of Personal Data by the Company in writing by e-mail to [email protected] , +371 2 000 50 95 or in writing to the address: Gustava Zemgala gatve 74A, LV-1039, Riga, Latvia.
To exercise their rights, individuals shall submit a written request to the Company in person, by mail, through a representative, or using electronic means of communication. The request must be legible, signed by the individual, and must include the person's name and surname, address of residence and contact information, information about the reasons why, what rights and to what extent the person wishes to exercise, as well as information about how the person wishes to receive a response.
When submitting a request, the person must prove their identity:
- if the request is submitted in person, the person must present an identity document;
- if the request is submitted by mail, a notarized copy of the identity document must be attached to the request;
- if the request is submitted through a representative, the representative must indicate their name and surname, as well as contact information through which the representative of the natural person wishes to receive a response, and the name, surname, and personal identification number of the represented person, and shall present a notarized copy of the identity document and a copy of the representation document certified in accordance with the established procedure;
- if the request is submitted using electronic means of communication, the request shall be signed with a qualified electronic signature or drawn up using electronic means that ensure the integrity and immutability of the text.
No later than one month from the date of receipt of the request, the Company shall provide the person with a response, indicating the information on the actions taken after receipt of the request, in accordance with Articles 15-22 of the Regulation. This period may be extended by a further two months, if necessary, taking into account the complexity of the request and the number of requests to be examined. Within one month of receiving the request, the Company shall inform the person of the extension of the deadline for processing the request, stating the reasons for the extension.
The Company has the right to refuse to provide the person with the requested information if:
We have the right not to comply with your request:
• if it is not formulated in an understandable manner;
• if we are unable to identify you;
• we have already responded to such request;
• the amount of information requested is disproportionate;
• if the request is unfounded (does not apply to our company, no explanation is provided as to why the request should be fulfilled);
• if regulatory enactments stipulate that we are not entitled to provide you with such information or that we are obliged to store certain data about you.
Taking into account the data subject's right to access their personal data, the Company:
• has the right to ask the person to clarify their request if a large amount of data is being processed,
• may only provide information to the extent that it does not infringe on the rights of other persons if the data also relates to third parties.
If you have any concerns about how we use your personal data, you can submit a complaint to us. If you believe that we have processed your data inappropriately, you have the right to submit a complaint to the supervisory authority. In Latvia, this is the Data State Inspectorate. The contact details of all EU supervisory authorities are available here.
If any discrepancies arise between this English version of the Privacy Notice and the Latvian version, the Latvian version shall prevail.