Principles of Customer Personal Data Processing

This document (hereinafter referred to as the Policy) has been drawn up to inform the natural persons specified in this Policy about the activities which are carried out with their personal data by the public limited company Latvenergo, registration number: 40003032949, registered office: 12 Pulkveža Brieža Street, Riga, LV-1010 (hereinafter referred to as Latvenergo).

 Latvenergo is a power supplier, which provides the following services (hereinafter referred to as the Services):

  • electricity and thermal energy generation;
  • electricity and thermal energy sale;
  • Smart House services;
  • solar panel services;
  • other related services (such as customer support services and social responsibility measures).

Personal data is any information relating to an identified or identifiable natural person (data subject).

 1. Policy scope

This Policy lays down the processing of personal data which is applicable to all Latvenergo’s:

  • existing customers who are natural persons and who use Latvenergo’s Services;potential customers who are natural persons, who have not established a relationship with Latvenergo and who are interested in terms and/or cost of Latvenergo’s Service Provision;
  • former customers, including those whose contractual obligations have not been fulfilled or who have agreed to receive commercial notifications after the termination of the contract;
  • customer representatives, including contact persons and legal representatives;
  • persons present at the objects (facilities) or in their adjacent areas;
  • users of information systems, website and technical solutions (such as applications);
  • owners of the real property which is required for the provision of the Services and owners’ representatives;
  • bidders at auctions;
  • real property tenants and lessors;
  • natural persons involved in marketing activities (such as contests, promotions, lotteries and social responsibility measures).

(hereinafter referred to as the Customers or You).

This Policy provides information on how Latvenergo handles Your personal data in connection with the Services offered by Latvenergo, using its internal resources, including information systems (hereafter referred to as the Systems), websites www.latvenergo.lv, www.fizmix.lv, www.skolotajiem.fizmix.lv and www.izdziedam100.lv (hereinafter referred to as the Web Pages) as well as www.elektrum.lv (hereafter referred to as the Portal) and Elektrum mobile app, Elektrum Viedā māja (Elekrum Smart House) mobile app and Izdziedam100 mobile app (hereinafter referred to as the App).

This Policy works in conjunction with other Latvenergo’s terms and conditions related to the use of Latvenergo’s Services, Web Pages, App and Portal:

In order to inform You about the processing of Your personal data, Latvenergo provides You with the following information in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the Regulation) and the Personal Data Processing Law (hereinafter referred to as the Law).

 2. Controller

The controller of Your personal data specified in this Policy is Latvenergo. The contact information of Latvenergo in regard to the matters of personal data processing is:
address: 12 Pulkveža Brieža Street, Riga, LV-1230, Latvia
phone number: +371 67 728 222
email: info@latvenergo.lv

 3. Data protection officer

A data protection officer has been designated in Latvenergo AS. The contact information in regard to the processing of Your personal data and exercise of the rights:
address: 12 Pulkveža Brieža Street, Riga, LV-1230, Latvia
email: fpda@latvenergo.lv

 4. Personal data and purposes of the processing of personal data

Latvenergo processes Your personal data (Personal Data) including for, but not limited to, the following purposes:
a.    Provision of Latvenergo’sServices:

  • conclusion and implementation of the electricity trade contract and other contracts as well as provision of the Services, including, for exampl

ž -   Customer identification;
ž -   Customer support for different Customer categories (including protected users);
ž -   settlement and payment execution as well as debt management;
ž -   financial accounting and protection of financial interests;

  • Customer registration and authentication on the Portal, in the App and on the Web Pages;
  • maintenance of the operation of the Web Pages, the Portal and the App.

 b.   Improvement of Latvenergo’sServices quality and business planning:

  • examination of applications, requests, claims and proposals;
  • Customer guidance;
  • Customer surveys and opinion polls regarding Latvenergo’s Services and products;
  • provision of notifications and information to Customers about Latvenergo’s news, activities, events and other occurrences;
  • statistics and business analysis (including business planning and reporting);
  • record-keeping and accounting arrangements, including archiving of information.

 c.    Security and law enforcement purposes:

  • maintenance of the audit trails of Latvenergo’s Systems;
  • prevention and investigation of IT security incidents (for example, in case of unauthorised external access to Latvenergo’s Systems, any websites or apps), as well as any kind of malicious activity against Latvenergo’s Systems, any websites or apps (such as DDoS attacks);
  • prevention and investigation of violations of the processing of Personal Data (such as unauthorised access to Latvenergo’s premises);
  • security in Latvenergo’s premises, in the territory of Latvenergo’s facilities or at Latvenergo’s facilities, including video surveillance and implementation of access control (such as issuance of passes);
  • provision of information to public authorities and other persons such as the police, the State Audit Office or archives.

 d.    Marketing activities and loyalty promotion:

  • Latvenergo’s Services promotion and marketing activities, including, for example:

ž -   direct Customer-oriented advertising;
ž -   compilation of marketing statistics;
ž -   analytics of the Customer’s habits of using the Services;

  • ensuring of the functioning of the loyalty programme (such as the Friendly offers);
  • organisation and implementation of lotteries, competitions and prize draws;
  • organisation of Customers’ visits and events at Latvenergo’s facilities as well as other public events and publicity measures for the events.

e.    Implementation of social responsibility and improvement of representative relationships:

  • organisation of tours, visits and events at Latvenergo’s museums and facilities, such as those aimed at preserving biodiversity or providing energy-efficiency advice;
  • engagement of young people in the exact subjects;
  • provision of public comments on Latvenergo’s activities;
  • reception of visitors during events (such as the Shadow Day);
  • general development of the Controller’s business operations and building of sustainable and trust-promoting relationships with Customers and other stakeholders, such as sending of collective or personalised greetings.

 f. Fulfilment of the requirements of laws and regulations or exercise of Latvenergo’s rights in accordance with laws and regulations:

  • provision of information to state and local government control and pre-trial investigation authorities as well as other state and local government authorities within the limits of their competence, such as the police, the State Audit Office or archives;
  • provision of information to other third parties, including state and local government authorities, if this is provided for in laws and regulationsand is necessary for the fulfilment of the concluded contract (such as the Land Register in case of purchase or sale of real property);
  • request of information from public authorities or other authorised persons about the Customer in cases where it is permitted by law, for example, from the Land Register, the Cadastral Information System or local governments about the owner of the land/structures;
  • processing of the received information of the distribution system operator.

 If You want to know exactly which categories of Your Personal Data are being processed for the specific data processing purpose mentioned above, please refer to Annex 1 to the Policy.

 5. Legal bases of Personal Data processing

Latvenergo processes Your Personal Data in the following cases:

  • A contract has been concluded or will be concluded between You and Latvenergo. In this case, Latvenergo processes Your Personal Data if they are necessary for the performance of Latvenergo’s contract or in order to take steps at Your request prior to entering into a contract. This applies in particular to the electricity trade contracts as well as to any other contract concluded between Latvenergo and You. If You do not provide the Personal Data necessary for the performance of Latvenergo’s contract, Latvenergo will not be able to fulfil the contract. Latvenergo shall not be held liable for failure to comply with obligations under this contract ifthe contract cannot be fulfilled due to failure to submit the Personal Data;
  • The processing of Your Personal Data is required for compliance with the legal obligations specified in laws and regulations to wich Latvenergo is subject. For example, Latvenergo is obliged to provide in some cases your information to public authorities, to fulfil accounting document management responsibilities and to archive documents;
  •  The processing of Personal Data is neededfor the purposes of the legitimate (lawful) interests pursued by Latvenergo or by a third party. Legitimate interests are rights whose exercise is permissible in accordance with laws and regulations, including in connection with the contract concluded between You and Latvenergo. Latvenergo has the following legitimate interests:

ž -   to ensure the development of its commercial activities;
ž -   to provide power supply services, to elaborate and develop its Services and to ensure their improvement;
ž -   to ensure the maintenance of positive relationships with the Customers as well as greater Customer satisfaction;
ž -   to ensure the provision of the Services and/or communication with the true recipient of the Services and/or communication;
ž -   to prevent potential financial and organisational risks (for example, to store information about Customers’ settlements and manage debts);
ž -   to prevent legal risks (for example, in order to keep Your Personal Data in case of a potential dispute for a certain time to resolve the dispute);
ž -   to prevent security risks (for example, through video surveillance at facilities and in adjacent areas);
ž -   to organise auctions (for movable and immovable property, including vehicles);
ž -   to ensure fulfilment of contractual obligations and to ensure proper fulfilment of contracts;
ž -   to protect its financial interests (including managing payments and debts);
ž -   to keep and attract Customers;
ž -   to maintain the operation of the System, the Web Pages, the Apps and the Portal, to develop and implement their improvements as well as to ensure their use by the Customers;
ž -   to carry out marketing activities, including advertisement of the Services and promotion of their distribution;
ž -   to maintain and develop the electricity generation infrastructure;
ž -   to promote social responsibility and enhance representative relationships by participating in, and organising, activities of the relevant nature, including by maintaining and developing the activities of the Museum of Energy and the activities of the Energy Efficiency Centre;
ž -   to inform the public about its activities and to ensure publicity of the events organised by Latvenergo;
ž -   to ensure business management, analysis and planning;
ž -   to protect its rights using the services of authorised and competent authorities. 

  •  Latvenergo has received Your consent to the processing of personal data (including in writing, electronically on the Web Pages, on the Portal or in the App as well as by telephone when Customers identify themselves). For example, it concerns participation in lotteries and prize draws organised by Latvenergo, use of the Personal Data collected through cookies, monitoring Your habits online or participation in Latvenergo projects (such as http://www.izdziedam100.lv). 

 6. Recipients and sources of the Personal Data

Latvenergo may transfer Your Personal Data to the following recipients of Personal Data if this is not in conflict with the applicable laws and regulations:

  • Latvenergo’s employees and authorised persons processing the Personal Data specified in this Policy on behalf of Latvenergo within the scope of their competence and job assignments;
  • persons related to the provision of Latvenergo’s Services and business development, including but not limited to:

ž -   information system consultants and system service providers;
ž -   contractors (such as the building contractors who receive the Personal Data of real property owners);
ž -   Customer opinion survey service providers;
ž -   research service providers;
ž -   service providers ensuring communication with Customers or sending information to Customers (such as call centres);
ž -   Customer service providers;
ž -   postal and delivery service providers;
ž -   banks and other providers of payment and financial services as well as providers ensuring information exchange between Latvenergo and financial service providers;
ž -   creative and media agencies, advertising and marketing service providers, event sponsors and organisers;
ž -   providers of public information services (such as media);
ž -   developers, managers and suppliers of Latvenergo solutions (for example, if it is necessary to install solar panels);
ž -   insurance service providers;
ž -   legal service providers;
ž -   real property management and administration service providers;
ž -   printing service providers;
ž -   debt collection service providers and credit information offices;
ž -   security and safety service providers;

  • Your authorised representatives with whom Latvenergo communicates to ensure the provision of the Services or protection of its interests as well as for other purposes specified in this Policy;
  • law enforcement authorities, other state authorities and public persons and similar persons, such as courts, the police, the Prosecution Office, the State Revenue Service and notaries);
  • health service providers (for example, if medical assistance is required in a customer service centre).

In addition, Latvenergo may receive information about You from third parties, such as:

  • state and local government authorities (such as the Land Register, the Cadastral Information System, local governments, archives, the Office of Citizenship and Migration Affairs and the State Physician Board for Health and Working Capacity Evaluation (for example if the Customer belongs to the group of protected users));
  • credit information offices and other persons who have the right to maintain information about the solvency of persons in order to check the Customer’s ability to pay for Latvenergo’s Services;
  • cooperation partners that help Latvenergo accept payments from You (for example, in cases when there is a need to pay for Latvenergo’s Services in a supermarket or post office).

In addition, Latvenergo exchanges Your Personal Data with the public limited company Sadales tīkls, registration number: 40003857687, registered office: 1 Šmerļa Street, Riga LV-1006 (Sadales tīkls). The exchange of the Personal Data is necessary for the following purposes and is carried out on the basis of laws and regulations in a number of occasions:

  • maintenance of the power distribution infrastructure and systems and supply of electricity;
  • provision of the Customer service;
  • accounting of settlements, payments and finances;
  • examination of Customers’ claims and opinion polls;
  • provision of the Services;
  • protection of the interests of Latvenergo and Sadales tīkls.

7.        Personal Data processing period

Your Personal Data are processed to the extent that is reasonably necessary depending on the specific purpose of the data processing under the provisions of the applicable laws and regulations.
Latvenergo will store Your Personal Data:

  • for as long as it is required or permitted by laws and regulations (for example, an electricity trade contract is stored for 10 years after its termination), and
  • as long as the contract signed between You and Latvenergo (if these Personal Data are related only to this particular contract) (such as information about a contact person or authentication information for the use of the Portal) is in force, and
  • as long as it is necessary in order to achieve the purposes of the Personal Data processing specified in Section 4 of the Policy (for example, the audit trails of the System are stored for 10 years, audio recordings in Latvenergo’s customer service are stored for 2 years, video surveillance data may be stored from 2 weeks to 6 months depending on the functions and technical configuration of the facility).

 8.        Transfer of Personal Data outside the European Union

In some cases, Latvenergo may transfer Personal Data outside the European Union, for example, when using data storage solutions that ensure data storage services outside the European Union or when engaging third parties that help Latvenergo in performing the business operation tasks specified in this Policy, as well as when responding to requests from You and their authorised representatives outside the European Union.

Depending on the circumstances, Latvenergo may choose the special Personal Data protection safeguards referred to in the Regulation, for example, conclude standard contractual clauses with the recipient of the Personal Data or use exceptions, for example, the grounds such as the need to fulfil the agreement signed between You and Latvenergo.

You have the right to get to know or receive the information about the mentioned safeguards using the contact information of Latvenergo specified in Section 2 or Section 3 of the Policy.

9.        Your rights in the processing of Personal Data

You have the following rights regarding the Personal Data referred to in this Policy:

  • Right of access. This means that You have the right:

žž -   to obtain from Latvenergo confirmation as to whether or not the Personal Data concerning You are being processed,
ž -   if Latvenergo processes Your Personal Data, You have the right to access the Personal Data concerned and receive information about the purposes of the processing, the categories of the Personal Data, the categories of recipients of the Personal Data, the period for which the Personal Data will be stored, Your data protection rights, the source of receipt of the Personal Data and automated decision-making (if any). You can read the mentioned information in this Policy. Most Personal Data of Customers – electricity users – are available to them through authentication in the user profile on the Portal www.elektrum.lv. If You would like to receive additional information about Your Personal Data, please use the contact information of Latvenergo specified in Section 2 or Section 3 of the Policy.

Latvenergo may request a reasonable fee resulting from administrative costs for all additional Personal Data copies that You request from Latvenergo. In addition, if You submit a request in electronic form and do not request it otherwise, Latvenergo provides information in a commonly used electronic format.

  •  Right to rectification. In case of inaccuracies, You have the right to request that Latvenergo rectifies the inaccurate Personal Data.
  • Right to erasure. You have the right to request that Latvenergo erases Your Personal Data if: 

ž -   You withdraw Your consent to process Personal Data, taking into account that the withdrawal of the consent does not affect the data processing carried out during the validity of the given consent;
ž -   the Personal Data are no longer necessary in connection with the purposes referred to in Section 4 of this Policy for which they were processed;
ž -   the Personal Data are unlawfully processed;
ž -   the Personal Data have to be erased in compliance with the requirements of laws and regulations.

Please note that the right to erasure does not apply to cases where according to the law Latvenergo has the obligation to process Personal Data or the data processing is necessary for archiving, implementation of public interests or statistical purposes as well as in connection with the establishment, exercise or defence of a legal claim.

  •  Right to restriction of Personal Data processing. You have the right to request that Latvenergo restricts Personal Data processing if:

ž -   You contest the accuracy of Personal Data or the lawfulness of its processing (restriction will be in force while the contestation process is in progress);
ž -   the Personal Data processing is unlawful, but You oppose the erasure of the Personal Data;
ž -   Latvenergo no longer needs the Personal Data for the purposes of the processing, but they are required by You for the establishment, exercise or defence of legal claims.

  •  Right to object to processing. You have the right to object, on grounds relating to Your particular situation, at any time to the processing of Your Personal Data which is based on the legitimate interests and consent referred to in Section 5 as well as profiling or automated decision-making described in Section 10. Latvenergo has the right to continue to process Your Personal Data despite the objections received if Latvenergo demonstrates compelling legitimate grounds for the processing which override Your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

 In cases where Latvenergo uses Your Personal Data for direct marketing purposes, You have the right to object at any time to the processing of Your Personal Data for such purposes when it includes profiling (as specified in Section 10 of this Policy).

  •  Right to withdraw consent. You have the right to withdraw Your consent to process Personal Data in cases where grounds for the processing of Personal Data is consent (as specified in Section 5 of this Policy). If the consent is given through the Portal, the App or the Web Pages, You may withdraw Your consent on the Portal, in the App or on the Web Pages respectively. In other cases, You can use the contact information of Latvenergo specified in Section 2 or Section 3 of the Policy to withdraw consent.

 If You withdraw Your consent, including the consent to the use of cookies, Latvenergo has the right to limit the functionality and scope of its Services, including the scope of the Portal, the App and the Web Page as well as the provision of related services, depending on the existence of the relevant Personal Data. In such cases, Latvenergo will not be able to provide You with the relevant Services if Latvenergo does not have the Personal Data required to provide the Services and/or functionality due to the withdrawal of consent. The withdrawal of consent does not affect the data processing carried out during the validity of the given consent.

  •  Right to portability. You have the right to receive Your Personal Data, which You have provided to Latvenergo, in a structured, commonly used and machine-readable format and have the right to request to transmit those data to another controller (service provider) if the processing of those Personal Data is carried out by automated means or on the basis of consent (as specified in Section 5 of this Policy).
  • Right to lodge a complaint. You have the right to lodge a complaint with Latvenergo as well as the Latvian supervisory authority, Data State Inspectorate, if You consider that Your Personal Data protection rights have been infringed. If You want to lodge a complaint with the Data State Inspectorate, please contact Latvenergo before contacting the Inspectorate. Latvenergo takes care of Your Personal Data protection and will provide You with the support You need.

To exercise the mentioned rights, You can use the contact information of Latvenergo specified in Section 2 or Section 3 of the Policy, unless otherwise provided for in this section.

10.     Automated decision-making in Personal Data processing

Automated decision-making in regard to Your Personal Data may occur in the following cases:

  • Customer profiling for sending personalised messages based on the information that has been transferred to Latvenergo and depending on Your interests and habits of using the Services. In order to implement Latvenergo’s marketing needs, Your Personal Data are selected, determining the category of data subjects. For example, commercial notifications are sent to Customers based on the type of payment chosen by the Customer and bill payment habits;
  • automated profiling of Customer data concerning the Customer’s payment and settlement habits takes place within the settlement function, including debt collection operations. Customer payment and settlement habits (including negative payment history) may affect the content of the notifications and the range of the Services available to You;
  • the payment history for Latvenergo Services may affect Your right to make payments in instalments. If You have a positive settlement history, You will have access to the option to pay for the Services in instalments.

11.     Personal Data processing through cookies

Detailed information in regard to Personal Data processing through cookies is available on the Portal, in the Apps and on the Web Pages.
The Apps, the Web Pages and the Portal may contain links to other websites. However, if You use these links, it should be noted that Latvenergo has no control over other websites. For this reason, Latvenergo cannot be held responsible for the protection and confidentiality of any information that You provide when You visit such sites, nor those sites are covered by this statement. You must exercise caution and review the privacy or confidentiality statement of the website concerned.

12.     Personal Data of children

Participation of a minor (a child) in projects organised by Latvenergo, in which persons under the age of 18 may participate (for example, when applying for tours and other Latvenergo’s projects), is possible if the child’s legal representative has given Latvenergo his or her consent to the child’s participation in the particular project or event. Persons aged 13 or over may register on the Web Pages (such as www.fizmix.lv or www.izdziedam100.lv) on their own.

Principles of processing of Personal Data of children:

a.      Latvenergo collects and stores the Personal Data of a child for Latvenergo’s projects and events for as long as necessary for the organisation of the project or event concerned. If Latvenergo has the consent of the child or the child’s legal representatives (such as parents) to use the child’s Personal Data (such as pictures), Latvenergo stores the child’s data as long as Latvenergo may use the consent of the child’s legal representatives;
b.      Latvenergo uses the Personal Data of a child only in connection with the projects and events for the organisation of which and for participation in which the child’s Personal Data have been collected;
c.      Latvenergo uses the Personal Data of a child on the basis of the consent of the child or the child’s representatives (such as parents) as well as if required by law or if Latvenergo requires the child’s Personal Data to protect Latvenergo’s interests (for example, if a dispute arises relating to Your Personal Data);
d.      Latvenergo may transfer the Personal Data of a child to those recipients of Personal Data who assist in organising events or competitions determined by Latvenergo as well as in maintaining or using online portals (for example, if Latvenergo offers the opportunity to authorise on Latvenergo’s websites through other portals, including social networks);
e.      a child as well as the child’s representatives have the right to request to erase the child’s Personal Data, to stop carrying out actions (for example, collecting) with the child’s Personal Data, to provide information about the child’s Personal Data or a copy thereof and to contact the Data State Inspectorate (the supervisory authority) in order to protect the right of the child to Personal Data protection;
f.       in some cases, Latvenergo will not be able to ensure the participation of a child in certain events or other services if Latvenergo does not receive the information required for this purpose from the child (for example, information about age). In such cases, Latvenergo will inform the child or the child’s legal representatives thereof.

13.     Policy

Latvenergo has the right to make additions to this Policy, making its current version available to You on the Portal, Latvenergo’s website and other Web Pages and Apps specified in this Policy.

ANNEX 1

On data processing purposes and categories of personal data types

Data processing purpose

Categories of personal data types

Provision of Latvenergo’s Services

Identification information

Contact information

Information about the contract

Payment information

Information about solvency

Information about consumption

Information about the object (real property)

Information contained in communication materials (such as correspondence)

Information about the Service and/or product

Information about the use of the Systems, the Web Pages, the App and the Portal

Information on the status of a protected user and related information (status of a poor/low-income person, large family, disabled person or family with a disabled child)

Audio recordings (such as telephone conversations)

Authentication information

Access information

Improvement of Services quality and business planning

Identification information

Contact information

Information about the contract

Payment information

Information about solvency

Information about consumption

Information about the object (real property)

Information about Your opinion

Information contained in communication materials (such as correspondence)

Information about the Service and/or product

Information about the use of the Systems, the Web Pages, the App and the Portal

Information about the status of a protected user and related information (status of a poor/low-income person, large family, disabled person or family with a disabled child)

Audio recordings (such as telephone conversations)

Authentication information

Access information

Social media information

Security and rights protection

Information contained in communication materials (such as correspondence)

Information about the use of the Systems, the Web Pages, the App and the Portal

Audio recordings (such as telephone conversations)

Video recordings

Photos

Authentication information

Access information

Information about the vehicle

 Marketing activities and loyalty promotion

Identification information

Contact information

Information about the contract

Payment information

Information about solvency

Information about consumption

Information about the object (real property)

Information about the communication channels used

Information about Your opinion

Information contained in communication materials (such as correspondence)

Information about the Service and/or product

Information about the use of the Systems, the Web Pages, the App and the Portal

Information about the status of a protected user

Audio recordings (such as telephone conversations)

Video recordings

Photos

Social media information

Information specific for a particular project (for example, Fizmix.lv: status “teacher” or “pupil”).

Implementation of social responsibility and improvement of representative relationships

Identification information

Contact information

Information about the contract

Payment information

Information about the object (real property) Information about Your opinion

Audio recordings (such as telephone conversations)

Information contained in communication materials (such as correspondence)

Information about the Service and/or product

Video recordings

Photos

Social media information

Fulfilment of the requirements of laws and regulations or exercise of Latvenergo’s rights in accordance with laws and regulations

Any of the Personal Data listed above

More options