PRIVACY POLICY

 

The purpose of the privacy policy of SIA “Prodigy”, unified registration No. 40203396589, registered address Slokas iela 17, Riga, LV-1048 (the Controller), is to provide you (the data subject) with information about the legal and factual circumstances of the processing of your personal data, namely information about the purposes, scope and protection of personal data processing, as well as other information about the processing of your personal data in accordance with the requirements of the General Data Protection Regulation (hereinafter – the Regulation) and other laws and regulations governing data protection. Please read this policy carefully and, if you have any additional questions, contact us using the contact information specified in this policy.

We respect your privacy; therefore, the security of your personal data is our priority. We use appropriate organizational and technical measures to ensure the continuous security of your personal data.

We comply with the requirements of personal data protection laws and regulations and, in each data processing process, ensure that we collect only the information necessary to achieve the purposes set out in this policy.

  1. Purpose and personal data controller

The purpose of the Privacy Policy is to provide an individual – the Data Subject – with information about the purpose, scope, protection and retention period of personal data processing at the time data are obtained and when the Data Subject’s personal data are processed.

The controller of personal data is SIA “Prodigy”, unified registration No. 40203396589, registered address Slokas iela 17, Riga, LV-1048, and the contact information for matters related to personal data processing is: ______.

The Policy applies to:

  1. natural persons – service recipients (including potential, former and current recipients);
  2. persons employed by the Controller in Latvia (including potential, former and current employees);
  3. employees of various service providers who provide services to the Controller in Latvia;
  4. submitters and recipients of correspondence with the Controller;
  5. visitors to the website managed by the Controller.

 

  1. Controller and its contact information

 

The controller of personal data processing is SIA “Prodigy”, unified registration No. 40203396589, registered address Slokas iela 17, Riga, LV-1048 (hereinafter – the Company), phone +371 26598592, e-mail: inese.brikena2@gmail.com.

 

  1. Purposes of personal data processing

 

2.1. The purposes of personal data processing are:

2.1.1. to provide and administer services (see more in the “Events” section of the website https://www.towerriga.lv/lv):

  • preparation, conclusion and performance of contracts with clients;
  • fulfilment of accounting requirements;
  • administration of payments;
  • review of client objections;

2.1.2. provision of information to public administration authorities and operational activity bodies in the cases and to the extent specified in external laws and regulations;

2.1.3. personnel management, including: recruitment; conclusion and performance of employment contracts; working time accounting; calculation and payment of remuneration; fulfilment of accounting requirements (preparation of relevant supporting documents, arrangement of business trips); provision of employee social benefits (health insurance); recording and monitoring the performance of work duties;

2.1.4. implementation of the legitimate interests of the Company and its clients: improvement of services and development of new services;

2.1.5. performance of record-keeping functions (receiving and registering applications / e-mail letters / requests, sending responses, etc.);

2.1.6. processing of received applications / e-mail letters / requests and preparation of replies.

2.1.7. maintenance of websites and improvement of their operation.

 

 

2.2. The data processing purposes referred to in Clause 2.1 of the Privacy Policy are indicative, and personal data may also be processed for purposes not expressly mentioned that are closely related to those indicated above and necessary for compliance with the requirements of laws and regulations.

 

  1. Legal basis for personal data processing

 

3.1. The Company processes your personal data on the following legal bases:

3.1.1. processing is necessary for the performance of a contract with the data subject (employee, client) or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) of the Regulation);

3.1.2. in cases where processing is necessary for the establishment, exercise or defence of the Company’s legal claims in court (Article 6(1)(f) and Article 9(2)(f) of the Regulation);

3.1.3. for the assessment of an employee’s working capacity (Article 9(2)(h) of the Regulation);

in cases where processing is necessary to ensure the Company’s legitimate interests (to organize an efficient service provision process and receive payment for the services provided) (Article 6(1)(f) of the Regulation);

3.1.4. processing is necessary for compliance with a legal obligation applicable to the Company (Article 6(1)(c) of the Regulation).

 

  1. Scope of personal data processed

 

4.1. When the Data Subject receives services, in accordance with the requirements of laws and regulations the Company is obliged to process the Data Subject’s identifying information and information related to the type, scope, quantity and similar details of the service used.

 

4.2. The categories of personal data processed by the Company depend on the purposes and type of data processing:

 

Purpose of personal data processing

Personal data

Organization of events (communication with the client or the client’s authorized person, conclusion of a contract, sale of entry tickets, record-keeping, delivery of invoices, administration of payments, provision of information to public administration authorities in cases specified by laws and regulations, video surveillance)

name, surname, personal identity number, name, surname and personal identity number of the authorized person, bank account, residential address, information about the bank account and contact information (telephone number, e-mail address), contract number, contract registration date, time of service provision, information about payments (invoice number, date, amount, method of invoice receipt, payment date, debt amount, information about debt recovery/collection).

Recruitment

All information included in the CV submitted by the candidate, as well as information obtained from persons who have provided references about the candidate on the basis of the candidate’s consent. If the candidate is invited to a job interview, the information provided during the job interview, completed tests and other assessment tasks.

Personnel management

Employee’s name, surname, personal identity number, address, telephone number, e-mail address, position, salary, time worked, bank account number, periods of sick leave, number of children and their years of birth, work experience, information about education and qualifications, language skills, etc., and other personnel management-related information containing personal data and information provided in the candidate’s CV.

Employment and career history, health information (mandatory health examination data, incapacity for work certificates), training information, information about ethics violations, etc.

Performance of record-keeping functions (within the receipt, processing and sending of replies to applications / requests / e-mail letters)

Name, surname, personal identity number, address, age, gender, date of birth, e-mail address and other information that the data subject indicates/adds in his or her application(s).

 

4.3. In implementing data processing purposes, the Company may store and process the following types of your personal data:

 

 

Categories of personal data

Examples

Identification data

name, surname, personal identity number, date of birth, basis of representation.

Contact information

Address, telephone number, e-mail addresses, etc.

 

Client data

identifying information; contact information;

information related to the service used (frequency, type, scope, quantity, etc.)

Employee data

identifying information; contact information; education and employment data; financial data. Mandatory health examination data, incapacity for work certificate, blood donor certificate, information about disability

Financial data

bank account number, delivery notes, salary or remuneration amount, other payment data regarding the Company’s service used.

Management function data

applications, contracts, orders, etc.

 

 

 

4.4. The specific amount of information depends on the specifics of the respective service provided, the purpose of data processing and the applicable laws and regulations governing the conditions for providing the service.

 

  1. Categories of recipients of personal data

 

5.1. Categories of recipients of personal data:

5.1.1. the data subject,

5.1.2. the Company and its authorized employees;

5.1.3. IT, marketing, security and accounting service providers;

5.1.4. potential or existing subcontractors of our business or any part of it, or their authorized consultants or representatives;

 

 

5.2. Data processors engaged by the Company may process your personal data only on our instructions and may not use them for other purposes or transfer them to other persons without our consent. Such persons may include database software maintainers, database administration service providers, data centre maintenance providers and cloud computing service providers. In each case, we provide data processors only with the amount of data necessary for performance of a specific task or provision of specific services. In addition, they must ensure the protection of your data in accordance with the requirements of applicable laws and regulations and the written agreement concluded with us, which, among other things, provides for irreversible deletion of any of your data after completion of the task assigned by us or termination of cooperation.

 

  1. Transfer of personal data to a third country or international organization and automated decision-making

 

6.1. The Company does not intend to transfer personal data to third countries or international organizations.

 

6.2. Automated decision-making is not carried out by the Company.

 

  1. Rights of the data subject

 

7.1. You have the right to receive confirmation from us as to whether we process your personal data, as well as:

7.1.1. the right to access your personal data and the manner in which they are processed;

7.1.2. the right to request correction or, taking into account the purposes of personal data processing, completion of incomplete personal data;

7.1.3. the right to request deletion of your data;

7.1.4. the right to request restriction of personal data processing;

7.1.5. the right to data portability;

7.1.6. the right to lodge a complaint with the Data State Inspectorate;

7.1.7. the right to withdraw consent.

 

7.2. In the event of withdrawal of consent, we may also store your consent and evidence of it for a longer period if this is necessary in order to protect our rights in connection with claims or complaints brought against us.

 

7.3. If you believe that we process your data in violation of the requirements of personal data protection laws and regulations, we invite you to contact us directly.

 

7.4. In order to protect the personal data of all our data subjects from unlawful disclosure, when we receive your request to provide data or exercise your other rights, we will need to verify your identity. For this purpose, we may ask you to present an identity document and, if the request relates to a person whom you lawfully represent, a birth certificate, power of attorney or another document confirming representation, unless the situation allows us to fulfil your request without such verification. If you do not confirm your identity and/or representation, we will reject your submitted request.

7.5. We may refuse to examine your request to exercise rights or ask for an appropriate fee if the request is manifestly unfounded or excessive, in particular because of its repeated nature.

 

7.6. If you wish to exercise your rights as a data subject or have other questions about the processing of your personal data, please contact us using the contact information provided above.

 

  1. Storage of personal data

 

8.1. In accordance with its file nomenclature, the Company stores personal data no longer than is necessary to achieve the relevant purpose of personal data processing.

 

8.2. When selecting criteria for storing personal data, the Company takes into account the circumstances listed below:

8.2.1. whether the personal data storage period is determined by or follows from the laws and regulations of the Republic of Latvia and the European Union;

8.2.2. for what period the relevant personal data must be stored in order to ensure the exercise and protection of the legitimate interests of the Company or a third party;

8.2.3. until the consent given by the person for the processing of personal data has been withdrawn and there is no other legal basis for data processing, for example, to comply with obligations binding on the Company.

 

8.3. When providing services, the Company complies with special laws and regulations that determine its obligation to retain certain data. If you wish to obtain detailed information, please contact the Company using the contact information provided above;

 

8.4. Records of incoming and outgoing communications (e-mail letters, postal letters), kept to ensure observance of the Company’s legitimate interests, will be stored for a period not exceeding five years, unless the relevant communication reflects potentially unlawful conduct or conduct that may help the Company or third parties ensure their legal interests. In such case, the relevant document may be retained until the legal interest has been ensured.

 

8.5. If an applicant has not been hired, the Company destroys or deletes the information obtained about the applicant during the recruitment process within 6 months from the day when a decision is made regarding the relevant personnel selection. If it is necessary to retain information about the applicant for possible further recruitment for other positions, your consent as the applicant to data storage will be requested.

 

8.6. After the end of the storage period, personal data will be irreversibly deleted unless there is an obligation to store them under laws and regulations.

 

8.7. Longer storage of your personal data specifically indicated in this Policy may be carried out only if:

  • it is necessary for us to ensure the protection of our rights in connection with claims, complaints or demands;
  • there are reasonable suspicions of unlawful activities requiring investigation;
  • your data are necessary for the proper examination of a dispute or complaint.

 

Photography and filming at events organized by the Company

The Company organizes various public events during which photography and filming are carried out. Information about the organized events may be posted on the Company’s website and social networks. In public places, filming and photography may be carried out without special notice. By being present in the event area, the Data Subject confirms that he or she is informed and does not object to being included in audio-visual material created about the course of the event. The Company posts information that photography or filming will take place at the event on the event poster and places special notices at event venues.

If a group or team is photographed, the Company may publish such photograph or video without requesting the Data Subject’s consent, considering that the image does not relate to a specific person but to the whole group.

The Company is entitled to publish images submitted by the Data Subject if no other natural person is visible in them.

The Company is entitled to transfer photographs or video recordings from public events organized by the Company to third parties in order to present the Company’s activities to a wider audience.

 

Video surveillance

To ensure and promote the Company’s safety, reduce risks of threats to public order and safety, and prevent and detect criminal offences in connection with protection of property and the vital interests of persons, including protection of life and health, video surveillance is carried out in the Company’s public premises.

Warning signs are installed before video surveillance zones in the Company’s territory or premises.

Access to video surveillance recordings is granted only to the Company’s responsible person for specific personal data processing purposes, or to verify that the video surveillance system is operating.

The Company does not create backup copies of video recordings and does not transfer data to third parties, except in cases specified by laws and regulations. Video recordings are stored no longer than the time period specified by laws and regulations, i.e. the video recordings made by the Company are stored for no longer than 14 days. Recordings are deleted automatically in chronological order from the time of recording.

 

Necessity of providing personal data

Personal data are necessary and are used for the provision of the relevant services, achievement of data processing purposes and implementation of the Company’s activities, to the extent necessary for this and in accordance with the requirements of laws and regulations. If personal data are not provided, the Company has no legal basis to provide the relevant service to the Data Subject and the purposes of personal data processing will not be achieved.

 

Changes to the Privacy Policy

The Company reserves the right to make changes to its Privacy Policy if certain circumstances affecting the regulation of personal data processing change. The Company recommends visiting this section regularly to obtain up-to-date information.