Customer personal data processing principles

The Policy determines the processing of the data of natural persons relating to Latvenergo:

• existing customers who are natural persons and who use the Latvenergo Services;
• potential customers who are natural persons with whom no relationship has been established with Latvenergo and who are interested in the Latvenergo terms and/or costs of providing the Services;
• former customers, including those whose contractual obligations have not been fulfilled or who have agreed to receive commercial notices or take part in surveys after the termination of the contract;
• protected users;
• representatives of customers and/or protected users, including contact persons and legal representatives, persons who make payments for the Latvenergo Services or receive refunds in the interests of customers and/or protected users;
• customer guarantors;
• persons present at sites or in the territories adjacent to them;
• employees of cooperation partners, contractors and service providers;
• users of Elektrum website and mobile applications and followers of social media accounts;
• participants and visitors of educational activities, classes and other types of events;
• owners of real estate, owners' representatives, tenants, lessees and lessors;
• bidders at auctions;
• natural persons who have taken part in marketing activities (for example, contests, promotions, lotteries);
• any other natural person who contacts Latvenergo.

(hereinafter – Customers or You).

The Policy operates alongside other Latvenergo terms and conditions relating to the use of the Latvenergo Services, websites, mobile apps and the Elektrum portal.

In order to inform You about the processing of Your personal data, Latvenergo provides the information set out below in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – Regulation) and the Law on the Processing of Natural Persons' Data.

The controller of the personal data referred to in the Policy is Latvenergo. Latvenergo contact information for questions related to the processing of personal data:

address: 12 Pulkveža Brieža Street, Riga, LV-1230, Latvia

telephone number: +371 67 728 222

e-mail address: info@latvenergo.lv

Latvenergo has appointed a Data Protection Officer. Contact information for matters related to the processing of Your personal data and the exercise of Your rights:

address: 12 Pulkveža Brieža Street, Riga, LV-1230, Latvia

e-mail address: fpda@latvenergo.lv

Latvenergo processes Your personal data (Personal Data), including but not limited to, for the following purposes:

• Latvenergo Provision of Services:
• Conclusion and implementation of electricity and/or natural gas and other products/goods trade contracts and other contracts, as well as the provision of the aforementioned Services, including, for example, providing support to protected users;
• examination of applications, requests, complaints and proposals;
• Customer consultation;
• registration, identification, authentication and access rights management of the Customer in the Elektrum portal, mobile apps and websites;
• Provision of operation of websites, portals, mobile applications and other information system.
• 
  
• Latvenergo Development of Services and quality assurance:
• improvement of the Services and business development;
• ensuring the provision and quality control of the Services.
• 
  
• Protection of security and other legal interests:
• Latvenergo ensuring the security of information systems and preventing and investigating information technology security incidents (for example, in the event of unauthorised external access to Latvenergo information systems, any websites or apps, as well as any malicious activity in Latvenergo information systems, any websites or apps (for example, a DDoS attack));
• ensuring physical security at Latvenergo premises, in site territories or at sites, including carrying out video surveillance and implementing access control (for example, issuing passes), and preventing and investigating physical security incidents;
• collecting and compiling information for investigating events and obtaining evidence;
• identifying fraud and corruption risks and ensuring transparency, including reporting of possible violations;
• the transfer of personal data of personnel performing work on critical infrastructure facilities or providing services for critical infrastructure of information and communication technologies to state security institutions to assess their compliance with national security interests;
• provision, request and receipt of information from state and municipal authorities and other third parties;
• prevention of money laundering and terrorism and proliferation financing;
• compliance with national and international sanctions.
•  
• d.    Marketing and loyalty promotion:
• Latvenergo Promotion of Services and marketing activities, including, for example:
• direct Customer-orientated advertising;
• compilation of marketing statistics;
• analytics of the Customer habits of using the Services;
• ensuring of the functioning of the loyalty programme (such as “Friendly offers”);
• organising and carrying out lotteries, contests and prize draws;
• organising visits and events for Customers at Latvenergo sites, as well as other public events and ensuring publicity of events;
• organising surveys and opinion research on Latvenergo services and products/goods, including organising customer loyalty measurements (NPS).

e.     Corporate social responsibility and improvement of public relations:

• organising tours, educational classes and events at the Elektrum Energy Museum and Latvenergo sites, for example, for the preservation of biodiversity, providing educational classes, consultations and other events at the Elektrum Energy Centre;
• stimulating young people's interest in the exact sciences and supporting teachers of the exact sciences by creating engaging and modern lessons linked to study materials, ensuring the creation, availability and use of portal content, as well as organising and ensuring the FIZMIX Contest and other related activities and informing the public;
• receiving visitors during events (for example, Shadow Day);
• general development of the Controller’s operations and building of sustainable and trust-promoting relationships with Customers and other stakeholders.

f.  Ensuring business operations:

• provision of contractual relations within economic activities, record keeping, accounting and financial accounting, protection of financial interests (for example, transaction accounting, payment of bondholders' coupons and convening of meetings);
• Latvenergo ensuring the electricity and thermal energy generation process, including the design, construction and operation stages, among others, including ensuring the safety and continuity of energy supply operations and ensuring the construction and coordination process of energy supply facilities;
• management of movable and immovable property;
• organisation of price pools and procurements, including those with the suppliers qualified in qualification systems, as well as execution of e-orders;
• maintenance of suppliers list and qualification systems.

If You wish to find out which categories of Your Personal Data are processed for a specific data processing purpose, please see Appendix No. 1.

Latvenergo processes Your Personal Data in the following cases (see the information in Appendix No. 1 to the Policy):

• A contract between You and Latvenergo has been or will be concluded. In this case, Latvenergo processes Your Personal Data if it is necessary Latvenergo for the performance of the contract or for taking steps at Your request prior to concluding the contract. This applies, among others, to the electricity and/or natural gas trade agreement, as well as any other agreement concluded between Latvenergo and You. If You do not provide the Latvenergo Personal Data necessary for the performance of the contract, Latvenergo will not be able to perform the contract. Latvenergo is not responsible for failure to fulfil obligations under the said contract if the contract cannot be performed because the Personal Data was not provided.
• 
  
• The processing of Your Personal Data is necessary in order to comply with the legal obligations imposed by law and applicable to Latvenergo . For example, Latvenergo is obliged, in the cases specified in laws and regulations, to provide Your information to State authorities and the information systems under their management, for example, the protected user data information system or, in the case of contractors' employees, the unified electronic working time recording system, the controller of which is the State Construction Control Bureau, to comply with the obligations of accounting document management, and to archive documents.
• 
  
• The processing of Personal Data is necessary for the legitimate (lawful) interests of Latvenergo or a third party. Legitimate interests are rights the exercise of which is permitted under laws and regulations, including in connection with the contract concluded between You and Latvenergo . For a list of legitimate interests for a specific data processing purpose, please see Appendix No. 1 to the Policy.
• 
  
• Latvenergoreceived Your consent to the processing of Personal Data (including in writing, electronically on websites, in the Elektrum portal or in mobile apps, as well as by telephone or by using other means of distance communication). For example, this applies to receiving commercial notices, participating in Latvenergo lotteries, contests and surveys organised by it, and using data collected through cookies in order to adapt content and offers to Your activities on the website.
• 
  
• The processing of Personal Data is necessary in order to Latvenergo perform a task carried out in the public interest. For example, where Latvenergo AS, as the holder of critical infrastructure, is granted by law the right to take security measures to protect critical infrastructure in the public interest.
• 
  
• If You wish to find out on what legal basis Personal Data is processed for a specific data processing purpose, please see the Policy Appendix No. 1.

Latvenergo may transfer Your Personal Data, or depending on the purpose of data processing it may be made available, to the following recipients of Personal Data, unless this conflicts with applicable laws and regulations:

• Latvenergo employees and authorised persons who process the Personal Data specified in this Policy Latvenergo on its behalf within the scope of their competence and work duties;
• persons Latvenergo related to the provision of Services, where the Service involves a certain type of Personal Data processing or where this arises from ensuring the Controller's business operations, including, but not limited to:
• developers of information system solutions and providers of maintenance services;
• contractors (for example, electronic communications network operators within the scope of electronic communications services, service providers within the scope of chimney cleaning or gas boiler maintenance, or electrical installation inspection services);
• providers of customer opinion research services and providers of research services;
• service providers who ensure the dispatch and delivery of information or goods to Customers;
• creative and media agencies, providers of advertising and marketing services, event organisers;
• providers of legal services;
• providers of business support services;
• providers of printing services;
• providers of out-of-court debt recovery services;
• providers of guard and security services.
• providers of insurance services;
• postal and logistics service providers;
• providers of public information services (for example, media);
• credit information bureaus;
• providers of audit and auditing services;
• banks and other settlement and financial service providers, as well as service providers who ensure the exchange of information between Latvenergo and financial service providers;
• cookie managers;
• maintainers and providers of online communication channels;
• persons authorised by Customers with whom Latvenergo communicates in order to ensure the provision of Services or protect its interests, as well as for other purposes specified in this Policy;
• customer guarantors;
• users of websites, Elektrum portal and mobile applications, followers of social network accounts and other third parties, for example, visitors of Latvenergo AS organized events, including public consultation meetings;
• the expert committee and/or jury of the event, for example, within the framework of the FIZMIX Experiment competition;
• Latvenergo Group company, if the specific situation concerns the property or human resources of the Latvenergo Group company;
• state and municipal authorities (such as, Land Register, State Land Service, Office of Citizenship and Migration Affairs, State Revenue Service, Financial Intelligence Department, State Construction Control Bureau, State Environmental Bureau);
• law enforcement and state security agencies, courts.

Latvenergo may receive information about You from third parties, for example:

• State and local government authorities (for example, the Land Register, State Land Service, State Construction Control Bureau, Office of Citizenship and Migration Affairs, Environmental State Bureau, building boards or other institutions performing the functions of a building board);
• credit information bureaus, in order to check the Customer's ability to pay for the Latvenergo Services;
• cooperation partners who help Latvenergo to accept payments from You (for example, in cases where the Latvenergo Services must be paid for at a supermarket or post office);
• service providers who ensure the exchange of information between Latvenergo and financial service providers, banks and other settlement and financial service providers;
• electronic identification service providers and financial institutions that provide authentication using internet banking, Smart-ID, eSignature or other means of identification;
• providers of business support services as Your employers;
• service providers that provide the service of a charging station management system;
• legal representatives, guarantors, Customer authorised persons and other third parties providing us with information about you.

In addition, Latvenergo exchanges Your Personal Data with Sadales tīkls AS, registration number: 40003857687, legal address: 1 Šmerļa Street, Riga, LV-1006 (Sadales tīkls) and/or Gaso AS, registration number: 40203108921, legal address: 20 Vagonu Street, Riga, LV-1009 (Gaso). The exchange of Personal Data is necessary for the following purposes and in many cases is carried out on the basis of compliance with laws and regulations and/or contractual relationships:

• maintaining electricity and natural gas distribution infrastructure and systems, supplying electricity and natural gas, and providing the electricity net settlement system service;
• ensuring Customer service;
• settlements, payments and financial accounting;
• examining Customer complaints;
• ensuring the provision of Services;
• Latvenergo, Sadales tīkls and Gaso protection of interests.

Your Personal Data is processed to the extent reasonably necessary depending on the specific data processing purpose, in compliance with the provisions of applicable laws and regulations.

Latvenergo will store Your Personal Data for as long as it is necessary to achieve the Personal Data processing purposes specified in Section 4 of the Policy, including to fulfil obligations laid down in laws and regulations, for example:

• information reflected in the contract and reflecting the fulfilment of the obligations under the contract shall be kept for no longer than 10 years after the termination of the contract and the fulfilment of the obligations. The Controller, if it considers that the information reflecting the fulfilment of the obligations under the contract is not relevant, reserves the right to erase information earlier;

if a commercial guarantee is set for a product/goods, we will store the information for the duration of the commercial guarantee;

when fulfilling the obligation specified in the Law on the Prevention of Money Laundering and Terrorist and Proliferation Financing, we will store the information obtained during the inspection for 5 years after the termination of the transaction;

we will store information on issued invoices and information related to payments for at least 5 years, in compliance with the provisions of the Accounting Law;

we will store audio records and their written transcripts for no longer than 3 years;

we will store video surveillance recordings for no longer than 30 days if video surveillance is carried out at the Controller's sites and the territories adjacent to them, or for up to 40 days if video surveillance is carried out at the Controller's electric vehicle charging service locations;

we will store Your applications, as well as the replies provided to You, without exceeding the limitation periods for temporarily stored documents laid down in the Archives Law and in accordance with the valid Latvenergo records classification schedule that has been agreed with the National Archives of Latvia in accordance with the procedure laid down in the Archives Law, i.e. for no longer than 10 years from the date of registration;

we will keep audit records from information systems for at least 18 months from the date of their completion, subject to the requirements of regulatory enactments;

we will keep certain types of data (e.g. identification data, contact details) as long as Your consent to the certain processing of Personal Data, such as marketing activities or the processing of cookies, is valid;

certain information may be stored longer, for example, if a complaint is received or the Controller’s legal interest is breached (there is a dispute about the services received etc.), the relevant information may be retained until the dispute is resolved, or, if the dispute is settled in court, until the date of entry into force of the court's final decision.

In order to improve the functionality of Latvenergo websites and mobile apps and adapt them to Your usage habits, as well as to obtain statistics on actions performed and to ensure a personalised user experience by adapting content, advertisements and offers according to activities on the website or in the mobile app, Latvenergo processes cookies on websites and in mobile apps. Required cookies are processed to ensure technical operation Latvenergo legitimate interests and do not require the user's consent, whereas statistical and marketing cookies are processed if You have given consent to the processing of these cookies. Detailed information regarding the processing of Personal Data carried out through cookies is available in the cookie management solution placed in the Elektrum portal, mobile apps and websites, and in the Cookies policy.

Mobile apps, websites and the Elektrum portal may contain links to other websites. However, if You use these links, please note that Latvenergo has no control over other websites. For this reason, Latvenergo cannot accept responsibility for the protection and confidentiality of any information that You provide when visiting such websites, and this notice does not apply to those websites. You must exercise caution and review the privacy or confidentiality notice of the relevant website.

In some cases, Latvenergo may transfer Personal Data outside the European Union, European Economic Area countries, or to countries and organisations in respect of which the European Commission has not adopted a decision on an adequate level of protection. The transfer may take place, for example, when online communication solutions are used or when third parties are engaged who help Latvenergo to perform the business tasks referred to in this Policy and/or to ensure the provision of Services, and who are located in third countries or organisations for which no European Commission decision on an adequate level of protection has been adopted. For statistical and marketing purposes, Latvenergo may also use cookies of third parties, for example, Google and Meta, where the information generated by cookies may be sent and stored in third countries or organisations for which no European Commission decision on an adequate level of protection has been adopted.

Depending on the circumstances, Latvenergo may choose the special Personal Data protection safeguards specified in the Regulation, for example, conclude standard clauses with the recipient of Personal Data, or use derogations, for example, such a basis as the necessity to perform the contract concluded between You and Latvenergo or Your consent to data processing, for example, by giving consent to the processing of cookies.

You have the right to obtain information about the processing and/or the said safeguards by using the Latvenergo contact information specified in Section 2 or 3 of the Policy.  

You have the following rights regarding the Personal Data referred to in this Policy:

• Right of access. You have the right to access Your personal data and to receive from Latvenergo information about the processing of Your Personal Data. If the information is not available to You in the Elektrum portal or on the website or in the mobile app of the specific Service, and the information provided in this Policy does not seem sufficiently comprehensive to You, please contact Latvenergo, using the Latvenergo contact information specified in Section 2 or 3 of the Policy!

For any additional copies of Personal Data that You request from Latvenergo, Latvenergo a reasonable fee based on administrative costs may be charged. In addition, if You submit a request in electronic form and do not request otherwise, Latvenergo provides the information in a commonly used electronic format.

• Right to rectification. In the event of inaccuracies, You can correct certain Personal Data yourself in the portal, on the website of the specific Service or in the mobile app, and You also have the right to request at any time that inaccurate Personal Data be corrected by Latvenergo.
• 
  
• Right to erasure. You have the right to request that Latvenergo erase Your Personal Data if:
• You have withdrawn Your consent to the processing of Personal Data, bearing in mind that the withdrawal of consent does not affect the data processing carried out while the consent given was valid;
• the Personal Data are no longer necessary in connection with the purposes referred to in Section 4 of this Policy for which they were processed;
• You have objected to the processing and Latvenergo legitimate grounds do not override Your legitimate grounds, or if the Personal Data is processed for direct marketing purposes;;
• the Personal Data are unlawfully processed;
• the Personal Data must be erased in accordance with the requirements of laws and regulations.

Please note that the right to erasure does not apply in cases where, in accordance with laws and regulations, Latvenergo is obliged to process Personal Data or data processing is necessary for archiving, the exercise of tasks in the public interest, or statistical purposes, as well as in connection with the establishment, exercise or defence of legal claims.

• Right to restriction of processing of Personal Data. You have the right to demand that Latvenergo restrict the processing of Personal Data if:
• You contest the accuracy of the Personal Data or the lawfulness of the processing (the restriction will apply while the contesting process is under way);
• the Personal Data processing is unlawful, but You oppose the erasure of the Personal Data;
• Latvenergo the Personal Data is no longer necessary, but You need it for the establishment, exercise or defence of legal claims;
• You have objected to the processing and until it has been verified whether Latvenergo legitimate grounds override Your legitimate grounds.
• 
  
• Right to object to processing. On grounds relating to Your particular situation, You have the right to object at any time to the processing of Your Personal Data that is based on the legitimate interests specified in Section 5 and on public interests, as well as to the profiling or automated decision-making described in Section 12. Latvenergo has the right to continue processing Your Personal Data despite the objections received if Latvenergo demonstrates compelling legitimate grounds for the processing that override Your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
•  
• In cases where Latvenergo uses Your Personal Data for direct marketing purposes, You have the right to object at any time to the processing of Your Personal Data for such purposes, insofar as it involves profiling (as specified in Section 12 of the Policy).
• 
  
• Right to withdraw consent. Where You have given consent to the processing of certain personal data, You have the right to withdraw it at any time. If consent is given through the Elektrum portal, mobile app or websites, You can withdraw Your consent in the Elektrum portal, app or websites respectively or, in the case of cookies, by using the cookie management solution located in the lower left corner of the website or in the specific browser, as well as by clicking the unsubscribe link in the specific e-mail, thereby opting out of receiving further commercial notices. In other cases, to withdraw consent You can use the Latvenergo contact information specified in Section 2 or 3 of the Policy.
•  
• If You withdraw Your consent, including consent to the use of cookies, Latvenergo has the right to restrict the functionality and scope of Your Services, including the scope of operation of the Elektrum portal, mobile app and websites, as well as the provision of related services, if this depends on the existence of the relevant Personal Data. The withdrawal of consent does not affect the data processing carried out while the consent given was valid.
• 
  
• Right to data portability. You have the right to receive the Personal Data that You provided to Latvenergo, in a structured, commonly used and machine-readable format, and the right to demand that such data be transmitted to another controller (service provider), if this Personal Data is processed on the basis of a contract by automated means or on the basis of consent (as specified in Section 5 of the Policy).
• 
  
• Right to lodge a complaint. You have the right to lodge a complaint with Latvenergo and with the Data State Inspectorate (17 Elijas Street, Riga, pasts@dvi.gov.lv)if You believe that Your Personal Data protection rights have been infringed. However, before contacting the Data State Inspectorate, we ask that You contact Latvenergo or the Data Protection Officer in order to find a solution if Your right to Personal Data protection has been infringed. Latvenergo cares about the protection of Your Personal Data and will provide You with the necessary support.

To exercise the said rights, You can use the Latvenergo contact information specified in Section 2 or 3 of the Policy, except in cases where this Section states otherwise.

To exercise all of the above rights, You can use the Latvenergo contact information specified in this Policy, stating the following Personal Data in Your request: first name, surname, personal identity number, postal address (if You wish to receive the reply by registered letter) or e-mail address (if You wish to receive the reply by e-mail).

We invite you to submit your request in one of the following ways:

send a free-form application electronically to the e-mail address info@latvenergo.lv or fpda@latvenergo.lv, signing the application with a secure electronic signature;

• send Your signed free-form application by post to the address: Latvenergo AS, 12 Pulkveža Brieža Street, Riga, LV-1230.

Automated decision-making regarding Your Personal Data, including profiling, may occur in the following cases:

• analysis, activity recording and forecasting for developing and offering Services that match Customers' wishes and interests, sending personalised news and granting individualised additional benefits are carried out on the basis of the information that has been transferred to Latvenergo and generated during the use of the Services, as well as depending on Your interests and Service usage habits, for example, based on the type of Service chosen by the Customer and Service usage habits, consumption data, payment method, type of electricity meter, bill payment habits, site address and type of communication channel;
• as part of monitoring settlement performance, creditworthiness assessment and debt management, in order to ensure that You are provided in good time with information about delays in the fulfilment of obligations arising from contracts already concluded, and to fully assess the possibility of concluding other contracts, automated profiling of Customer data is carried out in relation to the Customer's payment and settlement habits. In the debt management process (credit control), a limited-risk artificial intelligence solution is used that helps to predict the Customer's ability to pay for the Services received on time. The forecast affects only the sequence of steps in the debt management process, in order to ensure that You are provided in good time with information about the interruption of service delivery and that You can react to it in good time, so as not to contribute to the growth of overdue obligations. The Customer's payment and settlement habits (including a negative payment history) may affect the content of warnings. The payment history for Latvenergo Services may affect the range of Services available to You and Your right to pay in instalments;
• In order to forecast, improve and ensure an electric vehicle charging process that meets your needs and the technical requirements of electric transport and to provide you with a quality service that optimizes the charging process and provides efficient electricity management, automated profiling can be used to develop and regularly apply an algorithm that will allow to model and predict the duration of charging and consumed electricity during charging according to a pre-defined data set by using your electric vehicle charging data created within the framework of receipt of the service, thus ensuring balanced distribution of electricity between electric vehicle charging equipment;

In processing personal data, we use artificial intelligence solutionsthat provide significant support in information processing, increasing efficiency and improving the quality of Services. These solutions are used, for example, to convert audio conversations into text, create summaries and classify text, posing minimal or no risk to the Customer. When using artificial intelligence solutions, we comply with the provisions of the Artificial Intelligence Act, the Regulation and other binding laws and regulations.

You have the right, in accordance with the procedure laid down in Section 11, to object to automated decision-making, including profiling, and the right to ask Latvenergo to review the decision and to request the involvement of Latvenergo employees in assessing the decision.

The participation of a minor (child) in Latvenergo projects organised by it, in which persons under 18 years of age may take part, is possible if the child's legal representative has Latvenergo given consent to the child's participation in the specific project or if another legal basis laid down in the Regulation exists. Registration on websites (for example, www.fizmix.lv) can be carried out independently by persons aged 13 and over.

Principles of processing children's personal data:

• the child's Personal Data Latvenergo is collected and stored for as long as necessary to organise the relevant project or event. If Latvenergo has the consent of the child or the child's legal representatives (for example, parents) to use the child's Personal Data (for example, photographs), then Latvenergo processes the child's data for as long as the consent of the child's legal representatives is valid;
• Latvenergo processes the child's Personal Data only in connection with those projects and events for the organisation of and participation in which the child's Personal Data was collected;
• Latvenergo processes the child's Personal Data on the basis of the consent of the child or the child's representatives (for example, parents), as well as if another legal basis exists for processing such Personal Data, for example, it is provided for by laws and regulations or Latvenergo needs the child's Personal Data Latvenergo for the protection of interests (for example, if a dispute arises that is related to the child's Personal Data);
• Latvenergo may transfer the child's Personal Data to those recipients of Personal Data who help Latvenergo to organise specified events or contests, as well as to maintain or use online portals (for example, if Latvenergo offers the option to log in Latvenergo to websites via other portals, including social networks);
• the child, as well as the child's representatives, have the right to request the erasure of the child's Personal Data, to stop performing operations (for example, collection) with the child's Personal Data, to be provided with information about the child's Personal Data or a copy thereof, and to contact the Data State Inspectorate in order to protect the child's right to Personal Data protection;
• in some cases Latvenergo will not be able to ensure the child's participation in certain events or other services if Latvenergo does not receive from the child the information necessary for this purpose (for example, information that the child has reached at least 13 years of age). In such cases Latvenergo will inform the child or the child's legal representatives accordingly.

Latvenergo has the right to make additions to the Policy, making its current version available to You in the Elektrum portal, Latvenergo on the website and in other Latvenergo websites and mobile apps.

Appendix No. 1.

Purposes of personal data processing, categories of personal data and legal basis