PRIVACY NOTICE OF JSC VIRŠI SHAREHOLDER’S LOYALTY PROGRAMME

 

1. General provisions

 

1.1 Upon implementing Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ), hereinafter referred to as the Regulation, JSC VIRŠI-A, reg. No. 40003242737, legal address Kalna iela 17, Aizkraukle, Aizkraukle Rural Territory, Aizkraukle Municipality (hereinafter - VIRŠI or Controller), provides you with transparent and fair processing of your personal data, as well as takes care of your privacy and security of personal data.

1.2 In this privacy statement of the shareholder loyalty program of JSC VIRŠI-A (hereinafter - the Statement) you will find all information about what personal data VIRŠI collects and processes, for what purposes they are used, for how long they will be stored, etc. Important information for you related to your participation in the shareholder loyalty program of JSC VIRŠI-A.

This is to inform you that VIRŠI will process your personal data for the loyalty program only if you have provided it to VIRŠI.

1.3 If you have not become acquainted with the terms and conditions of the JSC VIRŠI-A shareholder loyalty program (hereinafter - the Terms) and this Statement, VIRŠI will not be able to provide you with the opportunity to participate in the JSC VIRŠI-A shareholder loyalty program (hereinafter - the Program). VIRŠI will not be able to ensure the operation of the Program and grant to you the benefits of the Program. It is important that the personal information you provide is accurate and correct. If you provide incorrect (false) personal data or do not update it, VIRŠI may have difficulty in providing you with fulfilment of the obligations of the agreement (Terms) concluded with you (use of benefits of your Program). VIRŠI shall not be liable for any damages you may incur if you provide incorrect personal information. If the personal data submitted by you changes, please inform VIRŠI.

 

 

The statement was agreed by:	Head of the Legal Department D. Ščadro, Head of the Marketing Department M. Eihmanis, Security Officer U. Briedis, Lawyer A. Romanovska
Approved on:	during the meeting of the Board on 09.11.2021 Chairman of the Board Jānis Vība
Riga, The date of the document is the date of the time stamp of its last electronic signature. This document is signed with a safe electronic signature and contains a time stamp.

 

 

 

 

2. Controller and the contact information of its Data Protection Officer

 

         2.1. The controller of personal data processing is JSC VIRŠI-A (reg. No. 40003242737), whose contact information for communication is as follows:

                   - legal address: Kalna iela 17, Aizkraukle, Aizkraukle Rural Territory, Aizkraukle Municipality, LV-5101, Latvia;

                   - e-mail address: birojs@virsi.lv;

                   - telephone 80 700 070.

2.2. You can contact the Data Protection Officer of VIRŠI about all personal data processing and protection issues in the following ways:

- e-mail address: datuaizsardziba@virsi.lv ;

- address for correspondence: Bieķensalas iela 21, building B-302, Riga, LV-1004, Latvia.

Address the letter to: Data Protection Officer of AS Virši-A.

 

3. What is personal data?

 

3.1 Personal data means any information related to an identified or identifiable natural person (“Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

 

4. For what purpose and how is your personal data is processed by Virši, as well as what is the legal basis and deadline for the processing?

 

You can register for participation in this Program only if you own 100 or more shares of JSC VIRŠI - A. Prior to your approval for participation in this Program, VIRŠI will ascertain whether you meet the above criteria.

 

1. 1. Registration and participation in the Program.

 

You can register for participation in the Program at the website of VIRŠI www.virsi.lv/investoriem.
By registering for the Program, you are simultaneously providing your data to VIRŠI and the right to process it in accordance with the amounts, types and purposes set forth in this Statement and the Terms. Submission of your personal data is mandatory, otherwise you will not be able to participate in the Program (including to use the offers and benefits provided by VIRŠI for participation in the Program). By registering for the Program (filling in the application), you must confirm that you own 100 or more shares of JSC VIRŠI-A. Verification of the above-mentioned fact will be performed through the Latvian Central Depository (hereinafter - the Depository) on the 10th day of each month or on the next business day (if the 10th date is a day-off or public holiday). If at the moment of updating the list of shareholders it is established that the number of shares of JSC VIRŠI-A owned by you does not comply with the provisions of the Program, you will not be confirmed as a participant of the Program. If you are already registered as a participant of the Program, you will be excluded from participation in the Program.

         When registering in the Program, a unique profile of the participant of the Programme will be created for you, based on which VIRŠI will identify you as a participant of the Program.

 

Categories of data	In order to ensure your participation in the Program VIRŠI will process your phone number that will be used to clarify receipt of shipments provided for you (for example, receipt of a shareholder’s loyalty card), your name, personal identity number, the number of shares owned by you, to ascertain that you qualify for participation in the Program , as well as to monitor your further right to be a participant of the Program, address (street, house and apartment No./house name, city/ rural territory, municipality, postal code, country), to send the prepared loyalty card to you or other dispatches prepared for you as a shareholder and participant of this Program, e-mail address to inform about changes in the Program. Besides, to ensure the operation of the Program, the number of the loyalty card issued to you, the purchase history and other information related to participation in the Program and your right to use the benefits will be processed.
The legal ground for data processing	For the conclusion and fulfilment of the Agreement regarding participation in the Program where you are a contracting party (Article 6 (1)(b) of the Regulation), as well as, based on the legitimate interest of the VIRŠI (Article 6(1)(f) of the Regulation) - to analyse the effectiveness of the Program and to provide evidence that VIRŠI has correctly complied with the provisions of the Program.
Duration of data processing	For the entire period of the agreement on participation in the Program and your participation in it.  If at the moment of updating the list of shareholders it is established that the number of shares of JSC VIRŠI-A owned by you does not comply with the provisions of the Program, then VIRŠI shall be entitled to exclude you from participation in the Program. Data related to participation in the Program will be retained by the VIRŠI for at least for two years after your exclusion from the Program in order to analyse the effectiveness of the Program and provide evidence that the VIRŠI has properly complied with the terms and conditions of the Program.

 

 

1. 2. Administration of benefits of the Program.

 

As a participants of the Program, you will be granted discounts on a specific product or service provided in the Program. Once every six months, you can get a new product free of charge by receiving a text message with a code to the phone number you provided. In order to ensure the accounting of such transactions - VIRŠI, in addition to the data entered by you, processes also the data on your purchases with a loyalty card (hereinafter - purchase data).

 

 

Categories of data	In order to ensure your opportunity to use the benefits due to you and to keep records in accordance with the requirements of regulatory enactments, VIRŠI needs to process your loyalty card number, fuel filling station address, purchase date and time, product name, quantity, purchase price and benefits, discounts and their amount, payment method for purchases, payments made and payment information (bank, bank account, bank payment card data), history of offers provided to you and information on their use, as well as your telephone number to send you the code of the offer.
The legal ground for data processing	The agreement concluded by you for participation in the Program and the profile created by you in order to fulfil the obligations of the Agreement (Article 6 (1)(b) of the Regulation) with regard to the use of benefits. In order to fulfil the legal obligations of the VIRŠI (Article 6 1(c) of the Regulation), when performing accounting in accordance with the requirements of regulatory enactments of the Republic of Latvia (for example, the provisions of the Value Added Tax Law, Section 7 of the Law on Accounting etc).
Duration of data processing	Purchase data and accounting justification documents shall be stored by VIRŠI for 5 years from the date of the purchase transaction. Information on the benefits used by you and their formation shall be stored by VIRŠI completely or partially for a maximum of 2 (two) years, subject to the limitation period arising from the laws and regulations of Consumer Rights.

 

1. 3. Receipt of shareholder’s news.

 

         If, upon registration, you agreed to receive news intended for you as a shareholder of JSC VIRŠI-A, then VIRŠI shall process your personal data when preparing and sending you news. For example, shareholder news is information about the prepared reports. Withdrawal from receiving shareholder news shall not affect your participation in the Program.

 

Categories of data	In order to inform you about the shareholder news, VIRŠI needs to process your name, surname and e-mail address. In case of sending out the offers, VIRŠI can use technical solutions to make sure that you have received the dispatch. In some cases, VIRŠI will be able to see whether you were interested in the offer or not (for example, if you opened the dispatch, clicked on the offer " find out more", etc.). In addition, VIRŠI can store information about the date you gave your consent to VIRŠI and when you revoked it.
The legal ground for data processing	Your consent (Article 6 (1)(a) of the Regulation) to receive shareholder news. Legitimate interest of VIRŠI (Article 6 (1)(f) of the Regulation) to make sure you receive the dispatches of VIRŠI and they have been interesting for you.
Duration of data processing	As long as your consent to receive shareholder news is valid. Information on the conditions for granting and withdrawal of consent may be stored for a maximum of five years, taking into account the limitation period of your rights as a data subject.

 

 

1. 4. Examination of requests and claims for protection of legitimate interests of VIRŠI.

 

         VIRŠl shall use your personal data to respond to your complaints, requests, claims and enquiries, and to administer your feedback (hereinafter – the Requests). VIRŠI may use the data obtained within the Program as evidence of legal action of VIRŠI (for example, that VIRŠI have complied with the laws and regulations governing the processing of consumer or personal data).

 

Categories of data	In order to ensure the protection of your legal interests and to process your or any other person's Requests, VIRŠI may process all your personal data held by VIRŠI listed in this Statement: name, surname, telephone number, e-mail address, city, date of birth, information, relating to your purchase history, both as a participant of the Program as well as without using the benefits of the participant of the Program, as well as any other information being at the disposal of VIRŠI as a controller for other data processing purposes, such as to ensure security and protection of legal interests of VIRŠI and third parties .
The legal ground for data processing	Fulfilment of legal obligations of VIRŠI (Article 6 (1)(c) of the Regulation) with regard to processing of your claims (for example, Consumer Rights Protection Law). Protection of the legitimate interests of VIRŠI (Article 6 (1)(f) of the Regulation) to evaluate your feedback as a customer, to retain information about the processing of the Request in accordance with procedure of regulatory enactments, and to provide evidence. Protection of the legitimate interests of VIRŠI (Article 6 (1)(f) of the Regulation) with respect to the provision of evidence on the provision of news of the Program (your consent, the conditions for its withdrawal), the handling of claims or complaints.
Duration of data processing	Your data will only be used to protect the legal interests of VIRŠI. Your data will be stored by VIRŠI for the period specified in the Statement, but not longer than five years, unless there is a dispute (in this case, VIRŠI may store your data longer until the statutory time limitation periods for filing a complaint or claim expires and/or the final decision enters into force).

 

 

5. From what sources does Virši obtain and collect your personal data?

 

         VIRŠI collects almost all of your personal data from you or the equipment you use. When you register for the Program, you submit your data to VIRŠI. When purchasing goods or services by using our profile and using an identifier (loyalty card), VIRŠI receives your purchase data. VIRŠI collects and processes the information reflecting your participation in the Program in order to achieve the data processing purposes set forth in this Statement.

         In order to make sure about the ownership of your shares, VIRŠI will receive your data from the Depository.

         VIRŠI will obtain data from you if you submit a Request in the manner specified in the Statement. In some cases, it may be necessary for VIRŠI to obtain additional information in order to process your Request. In such cases, the data of your Request may be linked by VIRŠI with the data available at the disposal of VIRŠI and/or the data collected during the processing of your Request (for example, VIRŠI may review the purchase transaction data, your profile usage history, interview the staff of VIRŠI, etc.).

 

6. How Virši stores and destroys data?

 

         VIRŠI will ensure that your data is only accessed by authorized persons and processed only in countries of the European Union or the European Economic Area that ensure adequate protection of your rights and freedoms. At the end of the processing and storage period of your data set forth in this Statement, VIRŠI will destroy (anonymise) your data as soon as possible, within a reasonable period of time, within the time limits set out above.

 

7. In what cases and to what personal data recipients Virši will disclose your data?

 

         VIRŠI may transfer your data for processing to personal data receivers, i.e., persons, who help VIRŠI to execute and administer the Program, and provide to VIRŠI the services related to the administration of Requests. Such persons can be a courier who will deliver a shareholder loyalty card to you, IT database software maintainers, database administration service providers, etc. In any case, VIRŠI provides data processors with only as big volume of data as is necessary to perform a specific task or provide a specific service. Data processors attracted by VIRŠI may only process your personal data according to the instructions of VIRŠI and they may not use them for other purposes or transfer them to other parties without the consent VIRŠI. Besides, they must ensure the protection of your data in accordance with the applicable laws and regulations and the relevant conditions specified in the agreements concluded between VIRŠI and the respective service provider.

         The data may also be transferred to competent/supervisory and law enforcement authorities, such as the police, the prosecutor's office, the court, and auditors of VIRŠI. Data may be transferred only if it is necessary in accordance with the applicable laws and regulations or in order to ensure the security of customers and employees of the state, municipal or law enforcement institutions and/or VIRŠI and IT resources, to raise, submit and defend the legal interests of VIRŠI, etc.

 

 

8. What are your rights and how can you exercise them?

 

         You may freely exercise your rights as a data subject by turning to VIRŠI. VIRŠI will give you the opportunity to use them. Information on your specific rights and how to exercise them is provided by VIRŠI in this Statement, please read them carefully:

 

 

1. 1. Right to access your personal data processed by VIRŠI.

 

         You have a right to receive information about whether VIRŠI process your personal data. You have the right to become acquainted with your personal data processed by VIRŠI and information about the purposes of data processing, categories of data to be processed, categories of data recipients, data processing period, sources of acquisition of data, automated decision-making, including profiling, as well as their meaning and consequences. The majority of this information is provided by VIRŠI in this Statement.

         If you are a participant of the Program, you may become acquainted with your personal data processed by VIRŠI in your profile at any time.

         If the information provided in this Statement or your profile is not sufficient for you (or you wish to receive the purchase operation history), you may turn to VIRŠI in the forms specified in this Statement.

 

 

1. 2. Right to request rectification of personal data.

 

         If the personal data provided at the time of your registration has changed or you find that the information processed by VIRŠI about you is inaccurate or incorrect, you have the right to request that this information be clarified or rectified.

         In order to exercise this right, you can independently correct your personal data in your profile or by contacting VIRŠI in the ways specified in this Statement.

 

1. 3. Right to withdraw consent.

 

         If VIRŠI processes your data on the basis of consent provided by you (in the case referred to in Paragraph 4.3 of this Statement), you have the right at any time to withdraw your consent. In such case the data processing based on your consent will be terminated. Withdrawal of consent shall not affect the lawfulness of processing which is based on the consent before withdrawal.

         For example, you may withdraw your consent to receive the news of the Program at any time. Withdrawal of consent will not restrict your participation in the Program, but VIRŠI will not be able to provide you with current news through the specified communication channel. Besides, the withdrawal of consent does not affect the fact that you will be able to receive up-to-date information such as official public market statements and reports both, on the website of VIRŠI, the NADAQ Riga website and other resources.

         You may change your consent by contacting VIRŠI in the manner set forth in this Statement.

         If your consent expires, VIRŠI will delete the data, unless there is another legal basis for processing it, and in the cases specified in the Statement - shall permanently anonymise the data.

 

1. 4. Right to lodge a complaint.

 

         If you consider that VIRŠI is processing your data in violation of regulatory requirements, please turn to VIRŠI in the ways specified in this Statement.

         If you are not satisfied with the proposed solution to the problem, you have the right to submit a complaint to the personal data protection supervisory authority of the Republic of Latvia - the Data State Inspectorate.

 

1. 5. The right to object to the processing of data on the basis of our legitimate interests

 

              You have the right to object to the processing of personal data, if the personal data is processed on the basis of legitimate interests of VIRŠI. However, taking into account the objectives of the Program and the balance of legitimate interests of both parties, in this case, VIRŠI will not be able to provide you with the opportunity to continue participating in the Program and the concluded agreement will be terminated.

         If you wish to exercise the rights set out in this section, you must submit a written request to the VIRŠI Data Protection Officer.

 

1. 6. Right to request to erase data (right to be forgotten)

 

         In certain circumstances referred to in regulatory enactments (for example, if personal data is processed unlawfully, if the legal basis of the data processing expires, if personal data is no longer necessary for the purposes for which it was collected or otherwise processed, etc.), you have the right to request VIRŠI to delete your personal data. If you wish to exercise this right, please submit a written request to the Data Protection Officer of VIRŠI.

 

        

1. 7. Right to request to restrict data processing.

 

         In certain circumstances mentioned in regulatory enactments (for example, if personal data is processed illegally, you dispute the accuracy of the data, you file objections to the processing of data on the basis of the protection of our legitimate interests, etc.), you have the right to restrict your data processing. Due to such restrictions of data processing, it may not be possible for VIRŠI to provide you with all the benefits of the Program.

         If you wish to exercise the rights set out in this section, you must submit a written request to the VIRŠI Data Protection Officer.

9. How does Virši handle and process your requests?

To protect the customer data of VIRŠI from unauthorized disclosure, VIRŠI will need to verify your identity upon receiving your request to provide you with your data or the exercise of your other rights. During this inspection, VIRŠI has the right to send a control notice to you to your contact information available at the disposal of VIRŠI (in the form of a text message or e-mail), requesting to perform authorization. If the verification procedure fails, VIRŠI may reject your request.

Upon receipt of your request for the exercise of any of your rights and the successful completion of the review procedure, VIRŠI shall undertake to provide the information requested by you as soon as possible, but no later than within one month from the date of receipt of your request. If your request is complicated, VIRŠI has the right to extend the above-mentioned period for another two months, informing you on that and stating the reasons for the extension.

If your request is submitted by electronic communication means, VIRŠI will also provide a reply in the same way, unless this is impossible (for example, due to the large amount of information) or if you ask to provide a reply in any other way. VIRŠI will not fulfil your request if any obstacles to the execution of such a request will be identified (for example, due to circumstances specified in regulatory enactments).

 

10. How safe is your data?

 

         VIRŠI uses different technologies and procedures in order to protect your personal information from unauthorized access, use, or disclosure. VIRŠI monitors that the implemented measures are appropriate and sufficient.

          VIRŠI requests its cooperation partners to use appropriate measures to protect confidentiality of personal data and ensure safety of your personal information. If the information is transmitted through internet or mobile communications, VIRŠI cannot completely guarantee its safety, therefore, you have to independently assess the risks related to confidentiality of the information thus transferred. VIRŠI recommends to carefully treat the security of your data. If you face any suspicious situation (for example, it seems that VIRŠI unreasonably wishes you to enter your username, password etc.), immediately inform VIRŠI about that.

         VIRŠI takes care in order to comply with the principle of minimization of personal data - VIRŠI does not process data that is not necessary for VIRŠI for the achievement of the purposes specified in this Statement.

 

11. Validity and changes in the Statement

 

         This Statement shall be in force as of 9 November 2021.

         This Statement may be changed (supplemented, updated) and the updated version of the Statement will be placed on the website www.virsi.lv/investoriem.

         You will always find the latest version of the Statement on the website www.virsi.lv/investoriem. Upon using the contact information specified by you, you will be informed on any changes, inviting to become acquainted with them.