Privacy policy 2019

The purpose of this Privacy Policy is to provide the natural person, the data subject, with information about the purpose, legal basis, scope, protection and duration of the processing of personal data at the time of data acquisition and the processing of the personal data of the data subject.

Data controller and its contact information

1. The controller of personal data processing is JSC “VIRŠI-A”, unified registration no. 40003242737, legal address 17 Kalna iela, Aizkraukle, Aizkraukles parish, Aizkraukles district, LV-5101, (hereinafter - JSC “VIRŠI-A”);

2. Contact information of JSC “VIRŠI-A” regarding personal data processing -- data protection specialist Uvis Briedis, phone no. 25714265. By using this contact information or by contacting the legal address of JSC “VIRŠI-A”, you may ask questions about the processing of personal data. A claim for the exercise of one's rights may be made in accordance with paragraph 23.

3. The contact information of JSC “VIRŠI-A” for informing about possible data protection breaches is datuaizsardziba@virsi.lv.

   
   General provisions

4. Personal data means any information about an identified or identifiable natural person.

5. The Privacy Policy applies for the protection of privacy and personal data with respect to the following groups (collectively - the Clients):

   1. 4. Persons whose personal data are processed in social networks in connection with marketing activities organized by JSC “VIRŠI-A”.
   2. 3. Visitors to the websites maintained by JSC “VIRŠI-A”;
   3. 2. Visitors of JSC “VIRŠI-A” gas stations (hereinafter - gas stations), offices and other premises, including those subject to video surveillance;
   4. natural persons - clients of JSC “VIRŠI-A” (including potential, past and present);

6. JSC “VIRŠI-A” takes care of the Customer's privacy and protection of personal data, observes the Customer's right to the lawfulness of personal data processing in accordance with the applicable law - Personal Data Protection Law, European Parliament and Council Regulation 2016/679 the protection of natural persons with regard to the processing of personal data and the free movement of such data (hereinafter - the Regulation), and other applicable legislation in the field of privacy and data processing.

7. The Privacy Policy applies to the processing of data irrespective of the form and/or medium in which the Customer provides personal data (in person, on the website of JSC “VIRŠI-A”, in paper form or by telephone).

   
   Purpose of the processing of personal data

8.  JSC “VIRŠI-A” processes personal data for the following purposes:

   1. For the provision of services and the sale of goods:

      1. client identification;
      2. 2. preparation and conclusion of contracts;
      3. 3. the supply of goods and services (for the performance of contractual obligations);
      4. 4. development of new goods and services;
      5. 5. advertising or distributing goods or services for commercial purposes;
      6. 6. customer service;
      7. 7. consideration of objections or claims;
      8. 8. customer retention, loyalty building, satisfaction measurement;
      9. 9. administration of accounts;
      10. 10. for debt recovery and collection;
      11. 11. maintenance and performance of websites and mobile applications.
   2. For business planning and analytics purposes;
   3. Customer safety, company property protection;
   4. For other specific purposes for which Customer has given his consent at the time he submits the relevant data to JSC “VIRŠI-A”.

      Legal grounds for the processing of personal data

9. JSC “VIRŠI-A” processes Customer's personal data based on the following legal grounds:
   1. 4. for legal (legitimate) interests -- to fulfil the legal (legitimate) interests of JSC “VIRŠI-A” and the Client arising from the obligations or the contract.
   2. 3. with the consent of the Customer, the data subject;
   3. 2. for compliance with regulatory enactments -- to comply with the obligations specified in binding external regulatory enactments for JSC “VIRŠI-A”;
   4. for the conclusion and performance of the contract -- to enter into the contract upon the Customer's application and ensure its execution (the contract also includes an oral agreement on the purchase of a good or service);
10. The legal (legitimate) interests of JSC “VIRŠI-A” are:

    Personal data processing

    1. 17. to inform society about its activities.
    2. 16. to maintain video surveillance for business security;
    3. 15. to administer payments;
    4. 14.  to ensure and improve service quality;
    5. 13. to ensure effective company management processes;
    6. 12. to ensure corporate management, finance and business accounting and analytics;
    7. 11. to prevent fraudulent practices against the company;
    8. 10. to send other reports on the progress of the contract and events relevant to the performance of the contract, as well as conduct customer surveys on the goods and services and the experience of using them;
    9. 9. to advertise its goods and services by sending commercial notifications;
    10. 8. to design and develop goods and services;
    11. 7. to segment the customer data base for the more efficient provision of services;
    12. 6. to perform actions to attract and/or retain Customers;
    13. 5. to issue and administer customer loyalty cards;
    14. 4. to keep Customers’ applications and submissions for the purchase of goods and provision of services;
    15. 3. to ensure the fulfilment of contractual obligations;
    16. 2. to verify the Customer's identity before purchasing certain goods or services;
    17. to perform commercial activities;
11. JSC “VIRŠI-A” processes the Customer's data using modern technology possibilities, taking into account the existing privacy risks and the available organizational, financial and technical resources of JSC “VIRŠI-A”.
12. JSC “VIRŠI-A” can perform automated decision-making regarding the Client. The Client shall be notified separately about such activities of JSC “VIRŠI-A” in accordance with regulatory enactments.
13. Automated decision-making which has legal consequences for the Client (e.g. approval or rejection of the Client's application) can only be performed during the conclusion or execution of the agreement between JSC “VIRŠI-A” and the Client or with Client's explicit consent.

    
    Personal data protection

14. JSC “VIRŠI-A” protects Customer's data using modern technology, taking into account existing privacy risks and JSC VIRŠI-A's reasonably available organizational, financial and technical resources, including the following security measures:
    1. Firewall;
    2. Break-in prevention and detection programs;
    3. Other protective measures available considering modern technologies.

       
       Categories of recipients of the personal data

15. JSC “VIRŠI-A” shall not disclose to third parties the Customer's personal data or any information obtained during the provision of services and during the term of the contract, including information about the goods and services received, except:
    1. in accordance with clear and explicit consent;
    2. to persons provided in external regulations at their founded request in the amount and in accordance with the procedures specified therein;
    3. in cases stipulated in the external regulatory enactments, for the protection of the legitimate interests of JSC “VIRŠI-A”, for example, in court or other state institutions against a person who has violated the legitimate interests of JSC “VIRŠI-A”.

       
       Transfer of personal data

16. JSC “VIRŠI-A” does not disclose Personal Data to third parties except to the extent necessary for the reasonable conduct of commercial activities, provided that such third parties maintain the confidentiality of the Personal Data and provide appropriate protection.
17. JSC “VIRŠI-A” has the right to transfer Personal Data to JSC “VIRŠI-A” suppliers, subcontractors, strategic partners and others who assist JSC “VIRŠI-A” and its clients in commercial activities in order to carry out the respective cooperation. However, in such cases JSC “VIRŠI-A” requires the data recipients to use the information received only for the purposes for which the data were transmitted and in accordance with the requirements of the applicable laws and regulations.

    
    Access to personal data by third country entities

18. JSC VIRŠI-A does not transfer personal data to third countries (outside the European Union and the European Economic Area).

    
    Retention time of personal data

19.  JSC“VIRŠI-A” shall store and process the Customer's personal data as long as at least one of the following criteria exists:
    1. only as long as the contract with the Customer is in force or the service is provided to the Customer;
    2. the data are necessary for the purpose for which they were collected;
    3. while the Client's application is fully considered and/or executed;
    4. as long as JSC “VIRŠI-A” or the Client, in accordance with the procedure prescribed by external regulatory enactments, can realize their legitimate interests (for example, to submit objections or to bring a claim in court);
    5. as long as JSC “VIRŠI-A” has a legal obligation to store data;
    6. as long as the Customer's consent to the relevant processing of personal data is in force, unless there is not another legitimate basis for the processing.
20. After the circumstances referred to in Clause 19 cease, the Customer's personal data shall be deleted. Audit records shall be preserved for at least one year from the date of their completion.

    
    Access to Personal Data and other Customer Rights

21. The Client has the right to receive the information specified in regulatory enactments regarding the processing of his/her data.
22. The Customer also has the right, in accordance with the laws and regulations, to request JSC "VIRŠI-A" access to his/her personal data, as well as to request JSC "VIRŠI-A" to add, correct or delete it, including the processing of personal data based on the legitimate interests of JSC “VIRŠI-A”) and the right to data portability. This right shall be exercised insofar as the processing of the data does not result from the obligations of JSC “VIRŠI-A” imposed by the applicable regulatory enactments and which are performed in the public interest.
23. The Customer may submit a request for the exercise of his/her rights as follows:
    1. in written form at the offices of JSC “VIRŠI-A” in Aizkraukle (address: Kalna St. 17, Aizkraukle, Aizkraukles parish, Aizkraukles district, LV-5101) or in Riga (address: Bieķensalas St. 21, block B-302, Riga, LV-1004) or using the postal service;
    2. by e-mail, signing with secure electronic signature and sending to e-mail address - datuaizsardziba@virsi.lv
24. Upon receiving the Customer’s request for exercising his/her rights, JSC VIRŠI-A verifies the identity of the data subject, evaluates the request and executes it in accordance with applicable laws and regulations.
25. JSC “VIRŠI-A” shall send the reply to the Customer by post to his/her contact address by registered mail or by e-mail with a secure electronic signature (if the application is submitted with a secure electronic signature), taking into account the Customer’s preferred response type.
26. JSC “VIRŠI-A” ensures the fulfilment of data processing and protection requirements in accordance with regulatory enactments and, in case of the Customer's objection, takes reasonable steps to resolve the objection. However, if this fails, the Customer has the right to turn to the supervisory authority, the Data State Inspectorate.
27. The Customer is entitled to receive one copy free of charge with his/her personal data processed by JSC “VIRŠI-A”.
28. The receipt and/or use of the information referred to in paragraph 27 of this document may be limited in order to prevent adverse effects on the rights and freedoms of others (including JSC “VIRŠI-A” employees).
29. JSC “VIRŠI-A” undertakes to ensure the accuracy of the Personal Data and relies on its customers, suppliers and other third parties providing the Personal Data to ensure that the transmitted Personal Data is complete and correct.
     

    Customer's consent to data processing and right of withdrawal

30. The Customer gives consent for the processing of personal data, the legal basis of which is consent (for example, to receive commercial communications, to analyse personal data, to receive loyalty cards) in writing at JSC “VIRŠI-A” gas stations, offices, the JSC “VIRŠI-A” website, mobile apps or any other place where JSC VIRŠI-A organizes marketing activities.
31. The Customer shall have the right at any time to withdraw the consent for data processing in the same manner as and/or in accordance with paragraph 23. In this case, further processing based on prior consent for the specific purpose will not be performed.
32. The revocation of consent does not affect the data processing performed during the period of the Customer’s consent.
33. Withdrawal of the consent cannot terminate processing of data that is carried out based on other legal grounds.

    
    Commercial notices

34. Communications of commercial notifications of JSC “VIRŠI-A” and/or third parties and other communications not related to the provision of directly contracted services (e.g. customer inquiries) shall be carried out by JSC “VIRŠI-A” in accordance with external regulations or with the Customer’s consent.
35. Communication, including commercial notifications, can also be made by JSC “VIRŠI-A” using automatic calling or electronic communication equipment.
36. The Customer agrees to receive commercial communications from JSC “VIRŠI-A” and/or its cooperation partners in writing at JSC “VIRŠI-A” gas stations, offices, JSC VIRŠI-A website and mobile applications or any other place where JSC “VIRŠI-A” organizes marketing activities.
37. The Customer's consent to receive commercial communications is effective until revoked (even after the termination of the Service Agreement). The Customer may at any time opt out of receiving further commercial communications in any of the following ways –
    1. by sending an e-mail to the address: datuaizsardziba@virsi.lv;
    2. by calling to phone no. 25714265;
    3. by submitting a written application to the JSC “VIRŠI-A” offices;
    4. by using the automated option in the commercial communication to opt-out of receiving further notices by clicking on the opt-out link at the end of the relevant commercial notification (email).
38. JSC “VIRŠI-A” shall stop sending commercial communications as soon as the Customer's request is processed. Request processing depends on technological capabilities; processing can take up to three days.
39. By expressing his/her opinion in the surveys and leaving his/her contact information (e-mail, phone), the Customer agrees that JSC “VIRŠI-A” can contact him/her using the provided contact information in connection with the evaluation provided by the Customer.

    
    Website visits and cookie processing

40. JSC "VIRŠI-A" websites may use cookies –
    1. Cookies are files that websites place on users' computers in order to recognize the user and facilitate their use of the site. Internet browsers can be configured to alert the client to the use of cookies and allow them to choose whether or not the client agrees to their use. Not accepting cookies will not prohibit the client from using the website, but may limit the client's ability to use the website;
    2. JSC “VIRŠI-A” websites may include links to third party websites which have their own terms of use and personal data protection, for the completeness of which JSC “VIRŠI-A” is not responsible.

       
       Other Provisions

41. JSC “VIRŠI-A” has the right to make changes and additions to the Privacy Policy, as well as to make it available to the Customer, by posting it on the website of JSC “VIRŠI-A”.
42. JSC “VIRŠI-A” keeps the previous versions of the Privacy Policy and they are available on the JSC “VIRŠI-A” website.