Personal data processing principles

Principles for contractors' employees

LATVENERGO AS PRINCIPLES OF PERSONAL DATA PROCESSING FOR CONTRACTORS' EMPLOYEES

In accordance with the conditions of Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter in the text – Regulation), Latvenergo AS informs You about the processing of the personal data of contractors' employees (hereinafter in the text – Principles).

Controller: Latvenergo AS, registration number: 40003032949, legal address: 12 Pulkveža Brieža Street, Riga, LV-1230 (hereinafter – Latvenergo AS), info@latvenergo.lv.

Contact information of the Data Protection Officer: 12 Pulkveža Brieža Street, Riga, LV-1230, fpda@latvenergo.lv.

1. Purposes of personal data processing, categories of personal data and legal basis for data processing

Purpose of personal data processing	Categories of personal data	Legal basis for personal data processing
Ensuring business operations: To ensure the safety and continuity of energy supply operations, by registering and managing the rights of contractors' employees to carry out work at Latvenergo AS electrical installations and in territories with specified electrical safety groups and special rights and training, ensuring the organisational process, including the management of documentation and access to sites, and compliance with and supervision of safety requirements, carrying out Latvenergo AS occupational safety briefings, and the process of reporting, investigating and recording unsafe working conditions or environmental threats To ensure, within the construction process of energy supply facilities, electronic registration and recording of the working time of persons employed at the construction site and storage of the registered data, in order to comply with the requirements of laws and regulations, including to provide data to the unified electronic working time recording system For document management, accounting and financial records, protection of financial interests organisation of price pools and procurements, including those with the suppliers qualified in qualification systems, as well as execution of e-orders; maintenance of suppliers list and qualification systems.	Identification information Contact information Represented company Position Nationality Username Information on the contract Information contained in communication materials (for example, correspondence) Information on compliance with the requirements for ensuring the safety and continuity of energy supply operations (for example, information on the electrical safety group and/or special rights, certificate number and validity period, information on briefings) Audio recordings (for example, telephone call recordings) Video recordings Photographs Authentication information Access information Information on the time spent by a person at a construction site and other related information Information obtained during an investigation Information related to participation in price surveys, procurements and E-orders, incl. data on professional suitability, experience and education; Information included in the tender; Content of the report Signature	If You have expressed a wish to submit Your personal data, for example, in order to report unsafe working conditions or environmental threats and/or to receive information about the situation, we will process personal data on the basis of Your consent. In cases laid down in laws and regulations, we will process personal data in order to fulfil the legal obligations imposed on Latvenergo AS, and we will also process data in order to pursue, for example, the following legitimate interests of Latvenergo AS: to detect and prevent security risks at energy supply sites; to ensure the performance of contractual relationships in business operations; maintain a registry of suppliers and to select and maintain a registry of qualified suppliers; to organise and ensure procurements, incl. price surveys, and related activities below the public procurement contract price threshold, as well as to ensure the procurement process in the Latvenergo AS electronic procurement system.
Protection of security and other legal interests: To ensure the security of Latvenergo AS information systems (incl. maintaining audit logs) and to prevent and investigate IT security incidents (for example, in the event of unauthorised external access to Latvenergo AS IT systems, any websites or apps), as well as any kind of malicious activity against Latvenergo AS IT systems, any websites or apps (for example, a DDoS attack) To ensure physical security at Latvenergo AS premises, in site territories or at sites, including carrying out video surveillance and implementing access control (for example, issuing passes), and to prevent and investigate physical security incidents for the protection of persons and property and of legal interests Identifying fraud and corruption risks and ensuring transparency Obtaining and compiling information in order to assess situations, investigate events and obtain evidence Transferring the personal data of personnel who will perform work at critical infrastructure sites or provide services to critical information and communication technology infrastructure to national security authorities in order to assess compliance with national security interests Providing, requesting and receiving information from State and local government authorities and other third parties Prevention of money laundering and terrorism and proliferation financing and compliance with national and international sanctions	Identification information Contact information Address of service provision Information on the contract Information on opinion Information contained in communication materials (for example, correspondence) Information on a meeting or conversation (time, date, place, topic, key aspects of the content of the conversation) Information on the use of information systems Information obtained during the customer check for the purpose of complying with laws and regulations Audio recordings (for example, telephone call recordings) Video recordings Photographs Authentication information Access information Information on the vehicle Represented company Information on the time spent by a person at a construction site and other related information Information related to participation in procurements Legal proceedings information Information obtained during an investigation Nationality Information provided in the response of national security authorities (information that would deny access exists/does not exist) Content of the report Position/specialisation Explanation of involvement in contract performance	We will process Personal Data on the basis of your consent if you wish to disclose your identity as a whistleblower to others or if your report submitted on the alleged violation is not considered a whistleblower's report but you want your personal data to be processed with the purpose to contact you about the content of the report. In cases laid down in laws and regulations, we will process personal data in order to fulfil the legal obligations imposed on Latvenergo AS, and we will also process data in order to pursue, for example, the following legitimate interests of Latvenergo AS: to clarify essential information by requesting and receiving it from State and local government authorities and other third parties; to prevent and detect security risks (for example, by carrying out video surveillance at sites and the territories adjacent to them, ensuring a pass regime and monitoring visitor access, creating audit logs); to detect and investigate incidents and secure evidence (for example, in the case of video surveillance, in order to store personal data for a certain period in the event of a potential dispute so that the dispute can be resolved); to introduce an organisational system to ensure that any person can submit a report about a possible violation or dishonest conduct by an employee, and to help Latvenergo AS monitor whether laws and regulations and the set of ethical conduct norms are complied with by an employee when performing their daily work duties and representing the employer; to ensure openness and fairness in cooperation with third parties, as well as to identify and reduce possible cases of fraud and corruption; to establish the circumstances of the incident, secure evidence and provide information to law enforcement, supervisory authorities and courts; to prevent and detect security risks by transferring the personal data of personnel to national security authorities to assess compliance with national security interests; to protect its rights by using information available from third parties about persons sanctioned in other countries in accordance with laws and regulations and by analysing publicly available information; to protect its rights by using information available from third parties in accordance with laws and regulations and fulfilling the obligation laid down in the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing.
Latvenergo AS provision, development and quality assurance of services: For examining applications, requests, complaints and proposals For advising persons For proving the provision of services (incl. communication) and ensuring quality control For registering and authenticating persons in mobile apps, information systems and websites Provision of operation of websites, portals, mobile applications and other information system.	Audio recordings (for example, telephone call recordings) Authentication information Identification information Information on the contract Information on the use of information systems Information on opinion Information contained in communication materials (for example, correspondence) Contact information Access information Address of service provision Video recordings Information on the language of communication Represented company	In cases laid down in laws and regulations, we will process personal data in order to fulfil the legal obligations imposed on Latvenergo AS, and we will also process data in order to pursue, for example, the following legitimate interests of Latvenergo AS: to protect the interests of the person and Latvenergo AS and monitor the quality of services provided and provide evidence of communication; to ensure the provision of Services and/or communications with the actual recipient of the Service and/or communications; to respond to information requests and ensure communication; to ensure operational continuity and performance in the process of delivering error fixes and new solutions, and to make sure that the developed information system solution and/or enhancement works in line with its intended purpose.

Purpose of personal data processing

Categories of personal data

Legal basis for personal data processing

Ensuring business operations:

To ensure the safety and continuity of energy supply operations, by registering and managing the rights of contractors' employees to carry out work at Latvenergo AS electrical installations and in territories with specified electrical safety groups and special rights and training, ensuring the organisational process, including the management of documentation and access to sites, and compliance with and supervision of safety requirements, carrying out Latvenergo AS occupational safety briefings, and the process of reporting, investigating and recording unsafe working conditions or environmental threats
To ensure, within the construction process of energy supply facilities, electronic registration and recording of the working time of persons employed at the construction site and storage of the registered data, in order to comply with the requirements of laws and regulations, including to provide data to the unified electronic working time recording system
For document management, accounting and financial records, protection of financial interests
organisation of price pools and procurements, including those with the suppliers qualified in qualification systems, as well as execution of e-orders;
maintenance of suppliers list and qualification systems.

Identification information
Contact information
Represented company
Position
Nationality
Username
Information on the contract
Information contained in communication materials (for example, correspondence)
Information on compliance with the requirements for ensuring the safety and continuity of energy supply operations (for example, information on the electrical safety group and/or special rights, certificate number and validity period, information on briefings)
Audio recordings (for example, telephone call recordings)
Video recordings
Photographs
Authentication information
Access information
Information on the time spent by a person at a construction site and other related information
Information obtained during an investigation
Information related to participation in price surveys, procurements and E-orders, incl. data on professional suitability, experience and education;
Information included in the tender;
Content of the report
Signature

If You have expressed a wish to submit Your personal data, for example, in order to report unsafe working conditions or environmental threats and/or to receive information about the situation, we will process personal data on the basis of Your consent.

In cases laid down in laws and regulations, we will process personal data in order to fulfil the legal obligations imposed on Latvenergo AS, and we will also process data in order to pursue, for example, the following legitimate interests of Latvenergo AS:

to detect and prevent security risks at energy supply sites;
to ensure the performance of contractual relationships in business operations;
maintain a registry of suppliers and to select and maintain a registry of qualified suppliers;
to organise and ensure procurements, incl. price surveys, and related activities below the public procurement contract price threshold, as well as to ensure the procurement process in the Latvenergo AS electronic procurement system.

Protection of security and other legal interests:

To ensure the security of Latvenergo AS information systems (incl. maintaining audit logs) and to prevent and investigate IT security incidents (for example, in the event of unauthorised external access to Latvenergo AS IT systems, any websites or apps), as well as any kind of malicious activity against Latvenergo AS IT systems, any websites or apps (for example, a DDoS attack)
To ensure physical security at Latvenergo AS premises, in site territories or at sites, including carrying out video surveillance and implementing access control (for example, issuing passes), and to prevent and investigate physical security incidents for the protection of persons and property and of legal interests
Identifying fraud and corruption risks and ensuring transparency
Obtaining and compiling information in order to assess situations, investigate events and obtain evidence
Transferring the personal data of personnel who will perform work at critical infrastructure sites or provide services to critical information and communication technology infrastructure to national security authorities in order to assess compliance with national security interests
Providing, requesting and receiving information from State and local government authorities and other third parties
Prevention of money laundering and terrorism and proliferation financing and compliance with national and international sanctions

Identification information
Contact information
Address of service provision
Information on the contract
Information on opinion
Information contained in communication materials (for example, correspondence)
Information on a meeting or conversation (time, date, place, topic, key aspects of the content of the conversation)
Information on the use of information systems
Information obtained during the customer check for the purpose of complying with laws and regulations
Audio recordings (for example, telephone call recordings)
Video recordings
Photographs
Authentication information
Access information
Information on the vehicle
Represented company
Information on the time spent by a person at a construction site and other related information
Information related to participation in procurements
Legal proceedings information
Information obtained during an investigation
Nationality
Information provided in the response of national security authorities (information that would deny access exists/does not exist)
Content of the report
Position/specialisation
Explanation of involvement in contract performance

We will process Personal Data on the basis of your consent if you wish to disclose your identity as a whistleblower to others or if your report submitted on the alleged violation is not considered a whistleblower's report but you want your personal data to be processed with the purpose to contact you about the content of the report.

to clarify essential information by requesting and receiving it from State and local government authorities and other third parties;
to prevent and detect security risks (for example, by carrying out video surveillance at sites and the territories adjacent to them, ensuring a pass regime and monitoring visitor access, creating audit logs);
to detect and investigate incidents and secure evidence (for example, in the case of video surveillance, in order to store personal data for a certain period in the event of a potential dispute so that the dispute can be resolved);
to introduce an organisational system to ensure that any person can submit a report about a possible violation or dishonest conduct by an employee, and to help Latvenergo AS monitor whether laws and regulations and the set of ethical conduct norms are complied with by an employee when performing their daily work duties and representing the employer;
to ensure openness and fairness in cooperation with third parties, as well as to identify and reduce possible cases of fraud and corruption;
to establish the circumstances of the incident, secure evidence and provide information to law enforcement, supervisory authorities and courts;
to prevent and detect security risks by transferring the personal data of personnel to national security authorities to assess compliance with national security interests;
to protect its rights by using information available from third parties about persons sanctioned in other countries in accordance with laws and regulations and by analysing publicly available information;
to protect its rights by using information available from third parties in accordance with laws and regulations and fulfilling the obligation laid down in the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing.

Latvenergo AS provision, development and quality assurance of services:

For examining applications, requests, complaints and proposals
For advising persons
For proving the provision of services (incl. communication) and ensuring quality control
For registering and authenticating persons in mobile apps, information systems and websites
Provision of operation of websites, portals, mobile applications and other information system.

Audio recordings (for example, telephone call recordings)
Authentication information
Identification information
Information on the contract
Information on the use of information systems
Information on opinion
Information contained in communication materials (for example, correspondence)
Contact information
Access information
Address of service provision
Video recordings
Information on the language of communication
Represented company

to protect the interests of the person and Latvenergo AS and monitor the quality of services provided and provide evidence of communication;
to ensure the provision of Services and/or communications with the actual recipient of the Service and/or communications;
to respond to information requests and ensure communication;
to ensure operational continuity and performance in the process of delivering error fixes and new solutions, and to make sure that the developed information system solution and/or enhancement works in line with its intended purpose.

For occupational safety and protection needs, Latvenergo AS video surveillance cameras with an artificial intelligence solution integrated into the video system may be used, which remotely check the use of personal protective equipment at Latvenergo AS critical infrastructure sites.

2. Source of personal data

Personal data may be obtained from You, Your employer, a State administration authority or information systems under its control, or another person who provides information about You, including national security authorities.

3. Recipients of personal data

The processing of Your personal data will be carried out by authorised Latvenergo AS employees within the scope specified in their work duties, in compliance with the requirements laid down in personal data protection and other laws and regulations, as well as the personal data processing requirements laid down in Latvenergo AS internal regulations.

Your personal data may be transferred to:

Latvenergo AS outsourced service providers (processors) who are authorised to carry out certain personal data processing operations on behalf of and under the supervision of Latvenergo AS, for example, guard and security service providers, developers of information system solutions and providers of maintenance services, service providers who ensure the dispatch of information;
Your employer;
providers of postal and delivery services (if applicable);
a Latvenergo Group company, if the relevant case concerns the property or human resources of a Latvenergo Group company;
providers of audit and auditing services;
State authorities that are required to be provided with information laid down in laws and regulations;
under certain circumstances, law enforcement authorities, including national security authorities, courts, as well as Latvenergo AS processors – providers of legal services.

Within the scope of personal data processing, it is not intended to transfer personal data to other recipients outside the European Union or European Economic Area countries or to countries and organisations in respect of which the European Commission has not adopted a decision on an adequate level of protection, unless the recipient is Your employer.

4. Personal data processing period:

Your personal data is processed to the extent reasonably necessary depending on the specific data processing purpose, in compliance with the provisions of applicable laws and regulations.

Latvenergo AS will store Your personal data:

for as long as it is necessary to achieve the personal data processing purposes specified in Section 1 of the Principles, including to fulfil obligations laid down in laws and regulations, for example:
- we will store information reflected in the contract concluded between Latvenergo AS and Your employer for the entire period of validity of the contract and for 10 years after the termination of the contract and the fulfilment of obligations. If, in its view, the information reflecting the performance of obligations assumed under the contract is not significant, Latvenergo AS retains the right to delete the information sooner;
- we will store information included in briefing logs for at least 5 years after the last entry;
- when fulfilling the obligation specified in the Law on the Prevention of Money Laundering and Terrorist and Proliferation Financing, we will store the information obtained during the inspection for 5 years after the termination of the transaction;
- we will store information on issued invoices and information related to payments for at least 5 years, in compliance with the provisions of the Accounting Law;
- we will store audio recordings for no longer than 3 years;
- we will store video surveillance recordings for no longer than 30 days if video surveillance is carried out at Latvenergo AS sites and the territories adjacent to them;
- in accordance with Section 46 of the Law on Procurement by Public Service Providers, the originals of all price survey and procurement procedure documents, as well as the originals of applications and tenders, are stored in the Latvenergo AS Electronic Procurement System (LEIS) for no less than three years after the decision regarding the procurement procedure has been taken, and for no longer than ten years, as laid down in Section 40, paragraph five of the Public Procurement Law,
- personal data included in the supplier list and Qualification systems is processed for as long as the data subject is included in the supplier list and/or Qualification system, but for no longer than 10 years, adjusting the maximum period to the period laid down in Section 40, paragraph five of the Public Procurement Law.
if processing is based on Your consent, until the moment the consent is withdrawn, for example, if You have reported unsafe working conditions or environmental threats and wish to receive information about the resolution of the situation;
if a complaint is received or a legal interest of Latvenergo AS is infringed, for example, there is a dispute about the scope or quality of work carried out, the relevant information may be stored until the dispute is resolved or, if the dispute is being resolved in court, until the day the final court judgment enters into force.

5. Rights of the data subject (you)

Right of access. You have the right to access Your personal data and to receive from Latvenergo AS information about the processing of Your personal data. Using the contact information of Latvenergo AS, You can ask for information about the processing of Your personal data if the information provided in these Principles does not seem sufficiently comprehensive.

Right to rectification. If You notice inaccuracies in Your personal data, You have the right to request that Latvenergo AS correct the inaccurate personal data.

Right to erasure. You have the right to request that Latvenergo AS erase Your personal data if:

the personal data is no longer necessary in relation to the purposes specified in the Principles for which it was processed;
the personal data has been processed unlawfully;
You have objected to the processing and the legitimate grounds of Latvenergo AS do not override Your legitimate grounds;
the personal data must be erased in accordance with the requirements of laws and regulations.

Please note that the right to erasure does not apply in cases where, in accordance with laws and regulations, Latvenergo AS is obliged to process personal data or data processing is necessary for archiving, the exercise of tasks in the public interest, or statistical purposes, as well as for the establishment, exercise or defence of legal claims.

Right to restriction of processing of personal data. You have the right to request that Latvenergo AS restrict the processing of Your personal data if:

You believe that the data is being processed unlawfully or is inaccurate (the restriction will apply while the contesting process is under way);
You believe that the processing is unlawful, but You do not wish to have this personal data erased;
You have objected to the processing and until it has been verified whether the legitimate grounds of Latvenergo AS override Your legitimate grounds;
Latvenergo AS no longer needs Your data to achieve a specific purpose, but You need it in order to defend Your legal interests and rights.

Right to object to processing. You have the right to object at any time to the processing of Your personal data that is based on the legitimate interests specified in the Principles. Latvenergo AS has the right to continue processing Your personal data if Latvenergo AS demonstrates compelling legitimate grounds for the processing that override Your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Right to withdraw consent. Where You have given consent to the processing of certain personal data, You have the right to withdraw it at any time, however, such withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To withdraw consent, You can use the contact information specified in the Principles.

Right to data portability. You have the right to receive Your personal data that You submitted to Latvenergo AS in a structured, commonly used and machine-readable format, and You have the right to request that such data be transmitted to another controller, if this personal data is processed on the basis of consent, in accordance with Article 6(1)(a). Please note that You can request the exercise of the right to portability only in respect of the personal data that You submitted to Latvenergo AS.

Right to lodge a complaint. You have the right to lodge a complaint with Latvenergo AS, as well as with the Data State Inspectorate (17 Elijas Street, Riga, pasts@dvi.gov.lv), if You believe that Latvenergo AS has infringed Your rights or has not sufficiently protected Your personal data. However, before contacting the Data State Inspectorate, we invite You to contact Latvenergo AS or the Data Protection Officer in order to find a solution.

6. Procedure for submitting requests

To exercise all of the above rights, You can use the Latvenergo AS contact information specified in these Principles, stating the following Personal Data in Your request: first name, surname, personal identity number, postal address (if You wish to receive the reply by registered letter) or e-mail address (if You wish to receive the reply by e-mail).

We invite you to submit your request in one of the following ways:

send a free-form application electronically to the e-mail address info@latvenergo.lv or fpda@latvenergo.lv, signing the application with a secure electronic signature;
send Your signed free-form application by post to the address: Latvenergo AS, 12 Pulkveža Brieža Street, Riga, LV-1230.

7. General provisions:

Latvenergo AS has the right to make changes to these Principles and to inform You of them by publishing the current version of the Principles on its website and/or by sending the information to the responsible person at Your company.

These Principles were updated on 26 March 2026