Personal Data Processing Notice for Cooperation Partners, Clients, and Their Representatives, Website Visitors, Building and Site Visitors, and Other Individuals Whose Data May Be Processed in the Course of SIA DEVRE's Business Activities
1. Information about the data controller
Our name is SIA DEVRE, registration number 40103386423, legal address: Dzirnavu iela 31-2, Riga, LV-1010. You can contact us by phone at +371 29907994 or by email at: info@devre.lv.
2. Contact information for personal data protection matters
If you have any questions regarding this notice or the processing of your personal data, you can contact us by email at: info@devre.lv.
3. Description of our personal data processing activities
This section describes how we process the personal data of our partners, clients and their representatives, website visitors, visitors to buildings and sites, and other individuals whose data may come into the possession of SIA DEVRE in the course of business activities.
This is the current version of the notice; however, we reserve the right to make amendments and update this notice as necessary.
The purpose of this notice is to provide you with a general overview of our personal data processing activities and purposes.
The data processing rules contained in this notice apply only to the processing of data of natural persons.
4. Why do you need to provide us with your personal data?
We collect your information to fulfill contractual obligations, comply with legal requirements applicable to us, and to pursue our legitimate interests.
In these cases, the collection of certain information is necessary to achieve the relevant purposes, and failure to provide such information may hinder the initiation of a business relationship or the execution of a contract. If the data is not mandatory but may help us improve our services or offer you better contract terms and/or proposals, we will indicate that the provision of such data is voluntary at the time of collection.
5. For what purpose do we use your personal data?
We process personal data only for specific purposes, including:
A. To initiate and provide services, and to fulfill obligations specified in cooperation agreements
For this purpose, we need to identify you, ensure the calculation and processing of payments, and communicate regarding service provision and/or contract execution.
Therefore, we may require the following data: the name, surname, personal identification number, address, bank account number, phone number, and email of the client and/or the contact person of the cooperation partner.
The main legal grounds used for achieving this purpose are:
- Conclusion and performance of a contract with the data subject (Article 6(1)(b) of the GDPR);
- Compliance with a legal obligation (Article 6(1)(c) of the GDPR);
- Legitimate interests of the data controller (Article 6(1)(f) of the GDPR), such as identification of you as a client or the contact person of a client and/or cooperation partner, and ensuring communication with you.
B. Compliance with legal requirements related to service provision or other obligations under applicable law
For this purpose, we need to comply with regulations governing the construction sector, the requirements of the “Law on Accounting,” and the requirements of the Archives Law.
This may require us to process the following personal data: name, surname, personal identification number, address of the client or their contact person, and employee working time records on construction sites from the cooperation partner.
The main legal basis for achieving this purpose is:
- Compliance with a legal obligation (Article 6(1)(c) of the GDPR).
C. To carry out marketing activities
During SIA DEVRE corporate events and other company-organized activities, photography and video recording may be conducted to document and showcase the event. These materials may be used for marketing and communication purposes, including publication on the company’s social media accounts (e.g., Facebook, Instagram, LinkedIn, YouTube).
In addition, your personal data may be used in photos and videos for advertising and marketing purposes that showcase the company’s services, completed work, and executed projects. These materials may be published on the company website and other digital and print marketing channels.
The purpose of using photos and videos is to promote the company’s activities, increase visibility, and inform the public about our services and events.
If a participant does not wish for their image to be used, please inform the event organizers or contact us before or after the event at: info@devre.lv.
We ensure that all personal data is processed in accordance with the General Data Protection Regulation (GDPR) and applicable laws.
D. To monitor and protect security and property interests
For this purpose, we may need to carry out video surveillance of our premises, buildings, and other properties, engage data processors for various functions, and disclose information to courts and other state institutions when necessary.
This may involve processing the following personal data: name, surname, personal identification number, image, location and time of the client or their contact person, and other relevant data.
The main legal basis for this purpose is:
- Legitimate interests of the data controller (Article 6(1)(f) of the GDPR), such as identifying you as a client or contact person of a client and/or cooperation partner, and ensuring communication with you.
E. To ensure proper service delivery
For this purpose, we may need to maintain and improve technical systems and IT infrastructure, and use technical and organizational solutions that may involve your personal data (e.g., through the use of cookies) to ensure the proper delivery of services.
The main legal basis for this purpose is:
- Legitimate interests of the data controller (Article 6(1)(f) of the GDPR), such as identifying you as a client or contact person of a client and/or cooperation partner, and ensuring communication with you.
6. How do we obtain your personal data?
Your personal information may come into our possession through the following means:
- by entering into a mutual agreement and receiving data directly from you;
- if the agreement is concluded with another person who has indicated you as their contact person or representative;
- when you submit documents to us, send us emails, or call us;
- when you register for our online services;
- by using our website www.devre.lv and consenting to the use of cookies;
- in specific cases – from third parties, such as credit information databases, to assess your creditworthiness;
- from video surveillance recordings, if such monitoring is in place.
7. Who may have access to your personal data?
We take appropriate measures to process your personal data in accordance with applicable laws and to ensure that unauthorized third parties do not gain access to your personal data.
Your personal data may be accessed, as necessary, by:
- our employees or specifically authorized persons who require it to perform their job duties;
- data processors, according to the services they provide and only to the extent necessary;
- state and municipal institutions in cases defined by law, such as law enforcement authorities, tax authorities, sworn bailiffs;
- third parties, after carefully evaluating the legal basis for such data disclosure—for example, debt collection agencies, courts, out-of-court dispute resolution bodies, bankruptcy or insolvency administrators, or third parties maintaining public registers (such as the Population Register, debtors’ registers, etc.).
8. Are your personal data transferred outside the European Union or European Economic Area?
No.
9. How long will we retain your personal data?
Your personal data is retained for as long as it is necessary for the relevant purposes of personal data processing and in accordance with the applicable legal requirements.
When assessing the retention period of personal data, we take into account the requirements of applicable legislation, the aspects of fulfilling contractual obligations, your instructions (e.g., in cases of consent), as well as our legitimate interests. If your personal data is no longer necessary for the specified purposes, we will delete or destroy it.
Common personal data retention periods:
- Personal data required for the performance of contractual obligations – we will retain until the contract is fulfilled and as long as other retention periods apply;
- Personal data required to comply with legal obligations – we will retain it for the periods specified in the relevant legal acts. For example, the “Law on Accounting” requires supporting documents to be retained until the date they are needed to identify the beginning and trace the progress of each economic transaction, but for no less than 5 years;
- Data used to prove compliance with obligations – we will retain it for the general statute of limitations period, according to the time limits set in legal acts – 10 years under the Civil Law, 3 years under the Commercial Law, and other periods, also considering the time limits set in the Civil Procedure Law for filing claims.
10. What are your rights as a data subject regarding the processing of your personal data?
Updating of personal data
If there have been changes in the personal data you have provided to us, such as changes in name, ID number, contact address, phone number, or email address, please contact us and provide the updated data so we can fulfill the relevant data processing purposes.
Your rights to access and correct your personal data
Under the General Data Protection Regulation (GDPR), you have the right to request access to your personal data held by us, request its correction, deletion, restriction of processing, object to its processing, and the right to data portability in the cases and according to the procedures specified in the GDPR.
The company respects your rights to access your personal data, and upon receiving your request, we will respond within the timeframes set by law (usually no later than within one month, unless it is a complex request), and, if possible, we will correct or delete your personal data accordingly.
You can obtain information about your personal data held by us or exercise other rights as a data subject in one of the following ways:
- Submit a request in person at our office at Abulas iela 2, Riga, LV-1026, on working days, from Monday till Friday, 8 AM to 5 PM;
- Submit a request by mail to the address Dzirnavu iela 31-2, Riga, LV-1010;
- Submit a request electronically, by sending it to the email info@devre.lv, signed with a secure electronic signature.
Withdrawal of consent
If the processing of your personal data is based on your consent, you have the right to withdraw it at any time, and we will no longer process your personal data for the relevant purpose. However, please note that withdrawal of consent does not affect the legality of processing based on other legal grounds, such as compliance with legal obligations, contracts, our legitimate interests, or other statutory grounds.
You also have the right to object to the processing of your personal data if the processing is based on legitimate interests or used for marketing purposes.
11. Where can you submit a complaint related to personal data processing?
If you have any questions or objections regarding our processing of your personal data, we encourage you to first contact us directly (please see the contact details in point 10).
If you believe that we have not been able to resolve the issue and that we are violating your rights to data protection, you have the right to file a complaint with the Data State Inspectorate (http://www.dvi.gov.lv/lv/datu-aizsardziba/privatpersonam/iesniegumu-paraugi/).