Privacy Policy

Data controller – LLC (SIA) "PM-TM", comp. reg. No. 40103443590 (hereinafter referred to as the Company), registered office: Riga, Jaunpils iela 1, LV-1002, ph. +371 20026326, e-mail: info@pmtm.lv.

In case of any questions regarding the processing of personal data, please feel free to contact us using the communication channels indicated above.

When processing personal data of natural persons, the Company shall comply with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 "On the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data", repealing Directive 95/46/EC (hereinafter referred to as the General Data Protection Regulation or the GDPR), Act on the Processing of Data of Natural Persons ["Fizisko personu datu apstrādes likums"] of the Republic of Latvia as well as other applicable and valid laws and regulations in the field of personal data processing and protection. (hereinafter referred to as the Regulation) and stipulations therein, as well as other requirements of the laws and regulations in force in Latvia, as well as shall protect the personal data using technical and organizational means that meet modern requirements.

This privacy policy explains how the Company processes the data of a natural person (customers, cooperation partners, representatives/contact persons of cooperation partners and other persons whose data may come to the Company's disposal within the scope of commercial activities), in what way it ensures the procedures for the implementation of the data subject's rights and issues related to the protection of personal data. The Company's privacy policy applies to all types of personal data processing as carried out by the Company.

We recognize that personal data is your value and will process it in a confidential manner, taking care of the security of your personal data in our possession.

1. Purposes of personal data processing

The Company's personal data processing purposes are related to the Company's commercial activities. The Company processes personal data for the following purposes:

• for the preparation, conclusion, execution and administration of the contract – for this purpose we need to identify the person, provide an appropriate payment calculations and ensure the payment process, to contact you regarding the provision of the service and/or the execution of the contract in related matters – also for sending the invoices;
• for selection and management of personnel (processes related to human resources, overview, etc.);
• in order to ensure an effective company management process;
• for consideration (review) and processing of objections;
• for providing information to state administrative institutions and subjects of operational activity;

in the cases and to the extent specified in external regulatory acts;

• in order to create and maintain the Company's internal processes, ensure document circulation and other internal processes (for example, archiving of contracts and other documents) to the extent necessary for this.

2. The Company processes personal data only in cases where it has a legal basis to do so:

• The Company processes personal data for service provision, in order to fulfill legal obligations applicable to the Company, in order to conclude contracts, monitor their implementation, fulfill the conditions of concluded contracts, before concluding the contract, when identifying the data subject. In order to ensure an appropriate calculation of payments, to communicate with you about the provision of the service and/or the execution of the contract in matters related to the contract (based on Paragraphs b), c) and f) of the first part of Article 6 of the Regulation).

- The Company processes personal data in order to fulfill the obligations set out in the regulatory enactments, for example, the requirements of the regulatory acts regulating accounting, the requirements of the Act on Archives ["Arhīva likums"] etc., as well as to provide answers to the requests of the state and law enforcement authorities in accordance with the procedure and to the extent prescribed by law. The Company processes personal data in order to process, store and list incoming and outgoing correspondence (postal letters, e-mails) (Paragraph c) of the first part of Article 6 of the Regulation).

• The Company processes personal data in order to ensure the legitimate interests of the Company, such as the quality of customer service, to examine possible customer complaints and claims, in order to ensure the protection of the property of the Company and its customers, as a result of which video surveillance may be carried out at the Company's legal address (registered office), at the place of economic activity, in order to apply to state administration and operational institutions and to the court for the protection of person's legal interests (provide evidence) (based on Paragraph f) of the first part of Article 6 of the Regulation).
• The Company processes the personal data of employees based on Paragraphs b) and c) of the first part of Article 6 of the Regulation.

3. Duration of personal data storage

The Company stores personal data in accordance with the defined purposes (reasons) of personal data processing and the requirements of regulatory acts, as long as at least one of the following criteria exists:

• as long as the Company can realize its legitimate interests (for example, submit objections or file a claim in court) in accordance with the procedures specified in external regulatory acts;
• as long as the Company has a legal obligation to store data;
• as long as the consent of the data subject to the relevant processing of personal data is valid, unless there is another legal basis for the processing of personal data.

Below we list the most common retention periods for personal data:

• personal data necessary for the fulfilment of contractual obligations – the Company will keep them until the contract is fulfilled and until other retention periods are fulfilled (see below);
• personal data that must be stored in order to meet the requirements of legal acts, we will keep for the deadlines specified in the relevant regulatory enactments, e.g., in the Act on Book-keeping ["Likums par grāmatvedību"] a stipulation exists that justification and substantiation documents must be kept until the day when they are no longer necessary to establish the beginning of each economic transaction and trace its course, but for no less than 5 years;
• We will keep the data necessary to prove the fulfilment of our obligations for the general limitation period of the claim, in accordance with the statutory limitation periods for claims – 10 years in the Civil Act ["Civillikums"], 3 years in the Commercial Act ["Komerclikums"] and in accordance with other terms, taking into account also the terms for bringing actions specified in the Civil Procedure Law ["Civilprocesa likums"].
• Data obtained during video surveillance is deleted after 30 (thirty) days.

If your personal data is no longer required for the specified purposes, the Company will delete or destroy it.

4. Receivers of personal data

The Company takes appropriate measures in order to process personal data in accordance with applicable laws and in order to ensure that the personal data is not accessed by third parties who do not have an appropriate legal basis for processing the person's personal data.

The following persons may have access to the personal data, as required:

• Company's employees or directly authorized persons who need it for the performance

of their duties;

• In order to fulfill the obligations set out in the regulatory acts, the Company may transfer data to state and local government authorities in the cases set out in the legal acts, for example, law enforcement authorities, tax administration, courts, bailiffs).
• For the provision of certain services, the Company may transfer personal data to cooperation partners – processors in accordance with the services they provide and only to the extent necessary, who perform the necessary data processing on behalf of the Company, such as auditors, the technical maintainer of the database and other persons related to the provision of services to the Company.
• Third parties, after carefully evaluating whether there is an appropriate legal basis for the specific transfer of data, such as courts, out-of-court dispute resolution institutions, insolvency administrators.

Personal data are not transferred to third countries (outside the European Union and the European Economic Area).

5. Selection of cooperation partners in personal data processing or personal data processors

The Company takes appropriate measures in order to ensure that the personal data is processed, protected and transferred to data controllers in accordance with applicable law. The Company carefully selects the processors of personal data and, when transferring data, evaluate its necessity and the amount of data to be transferred. The transfer of data to processors is carried out in compliance with the requirements of confidentiality and secure processing of personal data.

6. Access to one's own personal data and other rights of the data subject

In order to receive information about personal data processed by the Company as a data subject, the data subject must submit an application:

• appearing in person or in writing, by submitting it to the Company's legal address, namely, Riga, Jaunpils iela 1, LV-1002, Latvia, presenting an identity document;
• submitting the application electronically signed with a secure electronic signature by sending it to the e-mail address: info@pmtm.lv

The data subject has the right to access his/her data (submit an application to the Company), request restriction of personal data processing, deletion of personal data, portability of personal data, object to the processing of personal data or request correction of personal data, as well as other rights arising from the provisions of the Regulation.

The Company communicates with the data subject using the contact information provided by the data subject (phone number, e-mail address, mail address). The Company ensures data processing and security in accordance with the requirements of regulatory enactments, in case of objections by the data subject, the Company performs operative actions to find a solution to the situation. However, if the data subject believes that the data subject's right to the protection of personal data has been violated, the data subject has the right to submit a complaint to the supervisory authority – the State Data Inspectorate [Datu valsts inspekcijai].

After receiving the data subject's written request, the Company shall carry out the following:

• verifies the identity of the data subject;
• evaluates the respective application (request);
• complies with the request in accordance with regulatory enactments.

If the Company requires additional information to identify the data subject requesting the information or to fulfill the request, then the Company may ask to provide additional

information to be able to correctly fulfill the request and select information (for example, clarify the reference to specific documents and dates).

The Company does not use the person's data in making automated decisions.

8. Right to withdraw consent

If the processing of personal data has started and takes place in accordance with the consent of the data subject, the data subject has the right to withdraw it, in person or in writing, by submitting an application to the Company's registered office: Riga, Jaunpils iela 1, LV-1002 (by presenting a personal identification document) or with a secure electronic signature by sending electronically to an e-mail address: info@pmtm.lv.

Withdrawal of consent does not affect data processing performed at the time when the data subject's consent was still valid.

By withdrawing the consent, the data processing carried out by the Company based on other legal grounds cannot be stopped.