Privacy policy
SIA "CIRTAS" complies with the European Parliament and Council Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), the Personal Data Processing Law, and other legal requirements regarding the legality and protection of personal data.
Below, we provide information on the main purposes of our personal data processing, their legal basis, and other information in accordance with the conditions of Article 13 of the General Data Protection Regulation:
Owner: SIA “CIRTAS”. Address: Ogres novads, Krapes pagasts, “Dzelmes”-18, registration number 40203498839, Email: cirtainimati@gmail.com
Main purposes of personal data processing: Customer registration; accounting records; personnel records; record-keeping of business documents.
Legal basis for personal data processing: The lawfulness of our personal data processing is determined by at least one of the following justifications: · The data subject has given consent to the processing of their personal data for one or more specific purposes; · Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; · Processing is necessary for compliance with a legal obligation to which the controller is subject.
Categories of personal data: Only individuals involved in the implementation of the relevant personal data purpose.
Retention period of personal data: The retention period depends on the specific purpose of personal data processing, not exceeding the term set by the laws of the Republic of Latvia.
Recipients of personal data: The data subject about themselves; Authorized employees of the Owner; Processor only to the extent necessary for the Processor to provide services to the Owner in accordance with the mutually concluded agreement; State supervisory authorities (if they have appropriate authorization). Personal data is not transmitted to third countries or international organizations.
Data subject rights: The rights of the data subject are determined and regulated by the General Data Protection Regulation, including, but not limited to, the right to request access to their personal data and its correction or deletion, or restriction of processing concerning themselves, or the right to object to processing, as well as the right to data portability; withdraw consent without affecting the lawfulness of processing based on consent before its withdrawal; the right to contact and lodge a complaint with the Owner or the Data State Inspectorate.
Decision-making: Automated decision-making, including profiling, is not carried out in the processing of personal data.
Appendix
Information on the purposes of personal data processing by SIA "CIRTAS" in accordance with Article 13 of the General Data Protection Regulation: Customer registration. Legal basis for personal data processing: Article 6(1)(a) and (b) of the General Data Protection Regulation. Categories of personal data: Customers. Maximum retention period of personal data: 5 years. Recipients of personal data: The data subject about themselves; Authorized employees of the Owner; Processor only to the extent necessary for the Processor to provide services to the Owner in accordance with the mutually concluded agreement; State supervisory authorities (if they have appropriate authorization). Personal data is not transmitted to third countries or international organizations. Data subject rights: The rights of the data subject are determined and regulated by the General Data Protection Regulation, including, but not limited to, the right to request access to their personal data and its correction or deletion, or restriction of processing concerning themselves, or the right to object to processing, as well as the right to data portability; withdraw consent without affecting the lawfulness of processing based on consent before its withdrawal; the right to lodge a complaint with the Owner and/or the supervisory authority - Data State Inspectorate. Decision-making: Automated decision-making, including profiling, is not carried out in the processing of personal data.
2. Accounting records. Legal basis for personal data processing: Article 6(1)(a), (b), and (c) of the General Data Protection Regulation (Latvian laws, including the "Accounting Law" and regulations issued on the basis of this law). Categories of personal data: Customers and employees. Retention period of personal data: According to the "Accounting Law" (10 years for accounting organization documents and registers, and 5 years for supporting documents). Recipients of personal data: The data subject about themselves; Authorized employees of the Owner; Processor only to the extent necessary for the Processor to provide services to the Owner in accordance with the mutually concluded agreement; State supervisory authorities (if they have appropriate authorization). Personal data is not transmitted to third countries or international organizations. Data subject rights: The rights of the data subject are determined and regulated by the General Data Protection Regulation, including, but not limited to, the right to request access to their personal data and its correction or deletion, or restriction of processing concerning themselves, or the right to object to processing, as well as the right to data portability; withdraw consent without affecting the lawfulness of processing based on consent before its withdrawal; the right to lodge a complaint with the Owner and/or the supervisory authority - Data State Inspectorate. Decision-making: Automated decision-making, including profiling, is not carried out in the processing of personal data.
3. Personnel records. Legal basis for personal data processing: Article 6(1)(a), (b), and (c) of the General Data Protection Regulation (Latvian laws: Labor Law and regulations issued on the basis of this law). Additional sources of obtaining personal data: Information provided by the data subject. Categories of personal data: Employees and job applicants. Retention period of personal data: For employee personnel files - 75 years, for applicant files - 2 years. Recipients of personal data: The data subject about themselves; Authorized employees of the Owner; Processor only to the extent necessary for the Processor to provide services to the Owner in accordance with the mutually concluded agreement; State supervisory authorities (if they have appropriate authorization). Personal data is not transmitted to third countries or international organizations. Data subject rights: The rights of the data subject are determined and regulated by the General Data Protection Regulation, including, but not limited to, the right to request access to their personal data and its correction or deletion, or restriction of processing concerning themselves, or the right to object to processing, as well as the right to data portability; withdraw consent without affecting the lawfulness of processing based on consent before its withdrawal; the right to lodge a complaint with the Owner and/or the supervisory authority - Data State Inspectorate. Decision-making: Automated decision-making, including profiling, is not carried out in the processing of personal data.
4. Record-keeping of accounting documents. Legal basis for personal data processing: Article 6(1)(a) of the General Data Protection Regulation. Additional sources of obtaining personal data: Information provided by the data subject. Categories of personal data: Data subjects. Retention period of personal data: 3 years. Recipients of personal data: The data subject about themselves; Authorized employees of the Owner; Processor only to the extent necessary for the Processor to provide services to the Owner in accordance with the mutually concluded agreement; State supervisory authorities (if they have appropriate authorization). Personal data is not transmitted to third countries or international organizations. Data subject rights: The rights of the data subject are determined and regulated by the General Data Protection Regulation, including, but not limited to, the right to request access to their personal data and its correction or deletion, or restriction of processing concerning themselves, or the right to object to processing, as well as the right to data portability; withdraw consent without affecting the lawfulness of processing based on consent before its withdrawal; the right to lodge a complaint with the Owner and/or the supervisory authority - Data State Inspectorate. Decision-making: Automated decision-making, including profiling, is not carried out in the processing of personal data.