1. The personal data controller is SIA “Galerija Romas dārzs” Ltd, Single Registration No 40103913405, legal address: Jūras Street 12, Liepāja, LV-3401.
2. Personal data are any information about an identified or identifiable natural person – a customer, employee, job candidate, etc. of the SIA “Galerija Romas dārzs” where it is possible to identify this person, including name, surname, personal identity number, location address, personal telephone number, personal e-mail, occupation, income volume, received and planned services, payment information, telephone and electronic communication information, etc. The privacy policy applies to data processing, regardless of the form and/or environment in which the Customer provides personal data to the SIA “Galerija Romas dārzs” on the Internet homepage, paper or electronically) and in which company systems or paper forms they are processed.
SIA “Galerija Romas dārzs” takes care of the Clients’ privacy and the protection of personal data, observes the Clients’ rights to the lawfulness of personal data processing in accordance with the applicable legal acts — the laws, subordinate legislation and regulations of the Republic of Latvia, Regulation (EU) of the European Parliament and of the Council No. 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (Regulation), and other applicable legal acts in the field of privacy and data processing.
3. SIA “Galerija Romas dārzs” processes personal data for the following purposes:
• Provision of services: identification of the client; preparation and signing of the contract; ensuring/maintaining the service operation; service improvement and development of new services; advertising and distribution of services or use for commercial purposes; customer service; complaint/claim review and processing; retaining the clients; improvement of loyalty; satisfaction measurements; administration of payments; debt recovery and collection; website maintenance and improvement of functioning.
· Business planning and analytics: statistics and business analysis; planning and accounting; measuring of effectiveness; data quality assurance; performance of market and public opinion surveys; preparation of reports; customer surveys; within the framework of the risk management activities.
· Providing information to state authorities and subjects of operational activities in the cases and to the extent specified in external laws and regulations.
· For the safety and security of SIA “Galerija Romas dārzs” property and persons within the frame of video surveillance, aimed to protect the property of SIA “Galerija Romas dārzs” and third parties located at the Gallery (office) premises and on its territory, to provide for the safety of individuals, prevent possible crimes, record the fact of the crime, as well as to monitor the progress and quality of the Gallery service. Video surveillance data will be stored for up to 14 days. At the end of this period, SIA “Galerija Romas dārzs” will ensure complete automatic deletion of data, unless the data has been requested prior to the expiration of the above deadline, or any crimes or other breaches of security have been established. If the data has been requested by the competent state or local authorities, or any security breaches have been recorded, the data will be stored upon necessity.
· For other specific purposes for which the Client is informed at the moment when he/she provides his/her data to SIA “Galerija Romas dārzs”.
4. SIA “Galerija Romas dārzs” processes the Client’s personal data, based on the following legal grounds:
· conclusion and execution of the contract – to enter into the contract based on the Client’s application and ensure its execution;
· execution of the laws and regulations – to fulfil an obligation of SIA “Galerija Romas dārzs” specified in binding external laws and regulations;
· in accordance with the consent of the Client – the data subject;
· for legitimate purposes – to pursue legitimate interests of SIA “Galerija Romas dārzs” arising from the obligations or a contract entered by and between SIA “Galerija Romas dārzs” and the Client, or arising out of law.
The legitimate interests of SIA “Galerija Romas dārzs” are as follows: to perform commercial activity; verify the Client’s identity prior to entering into a contract; ensure fulfilment of the contractual obligations; eliminate unjustified financial risks for its commercial activity; keep the Clients’ applications and requests regarding provision of services, other applications and requests, notes including written or orally, by calling, by e-mail, on website, etc.; analyse SIA “Galerija Romas dārzs” website, its performance, develop and introduce improvements thereto; take actions to retain Clients; segment the client database for more effective provision of services; design and develop services; advertise services by sending commercial messages; send other messages regarding execution course of the contract and events relevant to the execution of the contract, as well as conduct Client surveys regarding the services and experience of use thereof; prevent fraud; ensure corporate governance, financial and business accounting and analytics; ensure effective company management processes; effectiveness of the service provision; ensure and improve the service quality; administrate payments; administrate outstanding payments; file requests to the state authorities and the authorities of operational activities for the protection of its legal interests; inform society regarding its activities.
5. SIA “Galerija Romas dārzs” will process the Client data using the modern technologies, taking into account the existing privacy risks and organisational, financial and technical resources reasonably available to SIA “Galerija Romas dārzs”, including using the following security measures:
· Pseudonymisation of data to the extent possible;
· Firewalls;
· Intrusion prevention and detection programmes;
· Other protective measures in line with the possibilities provided by current technical developments.
SIA “Galerija Romas dārzs” may perform the adoption of automated decisions with regard to the Client. The Client is informed about these SIA “Galerija Romas dārzs” activities individually in accordance with laws and regulations. The Client may object to the adoption of automated decisions in accordance with legal acts, yet understanding that in separate cases this can restrict the Client’s right to use individual possibilities potentially available thereto (for example, to receive commercial offers).
For the high-quality and fast execution of the contractual obligations arising out of the contract entered into with the Client, SIA “Galerija Romas dārzs” may authorise its cooperation partners to perform some delivery or service provision activities, such as individual works, provision of catering services, sending of invoices and similar. If, by carrying out these tasks the cooperation partners of SIA “Galerija Romas dārzs” process the Client’s personal data in the possession of SIA “Galerija Romas dārzs”, the relevant cooperation partners of SIA “Galerija Romas dārzs” will be considered as the processors of SIA “Galerija Romas dārzs” data processing, and SIA “Galerija Romas dārzs” is entitled to transfer the necessary Client’s personal data to the cooperation partners of SIA “Galerija Romas dārzs” to the extent necessary for the performance of these activities.
SIA “Galerija Romas dārzs” cooperation partners (in the status of personal data processor) will ensure fulfilment of the requirements for personal data processing and the protection according to SIA “Galerija Romas dārzs” requirements and laws and regulations, and will not use personal data for other purposes, except for the fulfilment of the contractual obligations arising out of the contract entered into with the Client on behalf of the SIA “Galerija Romas dārzs”.
6. SIA “Galerija Romas dārzs” does not disclose to third parties any Client’s personal data or any information obtained during the provision of services and the validity period of the contract, inter alia, information regarding received electronic communications, content or other services, except the following:
· if data have to be transferred to the third party within the framework of the concluded contract to perform any function necessary for the execution of the contract or any function delegated by law (e.g., to a bank within a settlement);
· in accordance with the Client’s explicit and unambiguous consent;
· to persons stipulated in the external laws and regulations upon their reasonable request, in accordance with the procedure and volume specified in the external laws and regulations;
· in the cases stipulated in the external laws and regulations to protect the legitimate interests of SIA “Galerija Romas dārzs”, e.g., by appealing to a court or other state institutions against a person who has violated these legitimate interests of SIA “Galerija Romas dārzs”.
7. Personal data of SIA “Galerija Romas dārzs” may not be accessed by the developers or service providers in the status of the data processor (operator) in the third countries (i.e. countries outside the European Union and the European Economic Area) (for the purpose of the Regulation – transmission to third countries).
8. SIA “Galerija Romas dārzs” stores and processes the Client’s personal data as long as at least one of the following criteria exists:
· only as long as the contract concluded with the Client is in force;
· as long as, in accordance with the procedures specified in the external laws and regulations, the SIA “Galerija Romas dārzs” or the Client can exercise its legitimate interests (for example, submit objections or bring an action in court);
· as long as either party has a legal obligation to keep the data;
· as long as the Client’s consent for the relevant processing of personal data is valid, unless there is another legitimate basis for the processing of the data.
When the above conditions cease to exist, the Client’s personal data will be deleted.
9. The Client has the right to receive information specified in laws and regulations regarding the processing of his/her data, ensure the accuracy of his/her data and correct it.
In accordance with the laws and regulations, the Client has the right to request SIA “Galerija Romas dārzs” to get access to his/her personal data, as well as request SIA “Galerija Romas dārzs” the supplementation, correction or deletion thereof, or to restrict the processing with respect to the Client, or the right to object against the processing (including against processing of personal data carried out on the basis of the legitimate interests of SIA “Galerija Romas dārzs”, as well as the right to data portability). These rights are exercisable in so far the processing does not arise out of the obligations of SIA “Galerija Romas dārzs” imposed thereon by the applicable laws and regulations and which are carried out in the public interest.
The Client may submit a request on exercising of his/her rights:
· in person at SIA “Galerija Romas dārzs” in writing, producing a personal identification document;
· according to the procedure stipulated in laws and regulations, SIA “Galerija Romas dārzs” or the Client may exercise his/her legitimate interests (such as submit objections or bring an action in court);
· in electronic form by signing it with a secure electronic signature.
Upon receiving the Client’s request for the exercise of its rights, SIA “Galerija Romas dārzs” verifies the Client’s identity, evaluates the request and executes it in accordance with laws and regulations.
SIA “Galerija Romas dārzs” will send a reply to the Client by post to his/her specified contact address in a registered letter or taking into account the method of or taking into account the type of receiving replies, specified by the Client to the extent possible.
10. The Client may give consent for the personal data processing, the legal grounds for which is consent, on the SIA “Galerija Romas dārzs” website or in person at the SIA “Galerija Romas dārzs”.
The data subject has the right to withdraw the consent for the processing of data at any time in the same manner in which it was given, and in that case, the further processing of data based on the consent for the above specific purpose will not be carried out in the future.
Withdrawal of consent will not affect the data processing carried out at a time when the Client’s consent was valid.
Processing of data carried out according to other legal grounds may not be terminated by withdrawing consent.
11. SIA “Galerija Romas dārzs” will communicate with the Client using contact information (phone number, e-mail address, postal address) provided by the Client.
Communication regarding the performance of the contractual obligations are handled by SIA “Galerija Romas dārzs” on the basis of the signed contract (for example, coordination of the work performance time, invoicing information, changes in services, etc.).
