Personal data processing principles

Personal data we process
Price surveys and procurements below the public procurement contract price threshold are organised in the Latvenergo AS Electronic Procurement System (hereinafter – LEIS), while procurements above the public procurement contract price threshold are organised in the Electronic Procurement System of the State Digital Development Agency (hereinafter – VDAA) and in LEIS. E-orders are placed in the VDAA Electronic Procurement System.

When organising price surveys and procurements and placing E-orders, various activities are carried out that involve the processing of personal data. Depending on the activities of the particular purchasing process, the following personal data may be processed:

• Authentication information;
• Identification information (first name, surname, personal identity number);
• Information on the represented company (name of workplace and registration number) (if applicable);
• Position (if applicable);
• Information contained in communication materials (for example, correspondence);
• Contact details (correspondence address, mobile telephone, telephone, e-mail address);
• Payment information (credit institution and its details, bank account)
• Information related to participation in price surveys, procurements and E-orders, including data on professional suitability, experience and education (work experience, education, qualifications, additional education and courses, information on language skills);
• Information on whether the exclusion criteria set out in laws and regulations apply to the tenderer;
• Resident or non-resident;
• Information on the contract termination date;
• Description and percentage share of the work to be subcontracted;
• Information included in the tender;
• Unstructured data attached in annexes.

An artificial intelligence solution may be used for the initial compliance check of submitted tenders, verifying the compliance of the submitted documents and information with the requirements of the procurement regulations. The final evaluation of the submitted tenders and the decision on the winner are made by authorised employees of Latvenergo AS.

Legal basis for data processing
When organising procurements and placing E-orders in the VDAA Electronic Procurement System, we will process your personal data on the basis of point (c) of Article 6(1) of the Regulation, i.e. the Public Procurement Law, the Law on Procurement by Public Service Providers, and Cabinet Regulation No. 816 of 20 December 2022 “Public Electronic Procurement Regulations”.

When organising price surveys, simplified procurements and procurement procedures in LEIS, we will process your personal data on the basis of point (f) of Article 6(1) of the Regulation – pursuing our legitimate interest “To organise and ensure procurements, including price surveys, and related activities below the public procurement contract price threshold, and to ensure the procurement process in LEIS”.

Who will receive your personal data?
Personal data will be processed by authorised employees of the Controller within the scope specified in their job duties, in compliance with the requirements of personal data protection and other laws and regulations, as well as the personal data processing requirements set out in the Controller’s internal regulations.
Personal data may be transferred to:

• the Controller’s outsourced service providers (processors), who are authorised to carry out certain data processing activities on behalf of and under the supervision of the Controller;
• a Latvenergo Group company, if the procurement is also carried out in the interests of a Latvenergo Group company;
• audit service providers;
• state authorities that provide services (for example, VDAA);
• state authorities to which the information specified in laws and regulations must be provided;
• under certain circumstances (for example, if a complaint is received about the service concerned), data may be transferred to law enforcement or supervisory authorities, courts, as well as the Controller’s processors – providers of legal services.

It is not intended to transfer personal data to recipients outside the European Union or the European Economic Area.

How long do We retain your data?
In accordance with Section 46 of the Law on Procurement by Public Service Providers, We, as a public service provider, will retain in LEIS the originals of all price survey and procurement procedure documents, as well as the originals of applications and tenders, for no less than three years after the decision regarding the procurement procedure has been taken, and for no longer than ten years, as specified in Section 40, Paragraph five of the Public Procurement Law.

If a complaint is received or a legal interest of the Controller is infringed, for example, if there is a dispute about the scope of the services received, the relevant information may be retained until the dispute is resolved or, if the dispute is being resolved in court, until the day the final court decision enters into force.

Personal data we process
The supplier list and Qualification Systems have been established and are maintained in LEIS. In the course of maintaining the supplier list and Qualification Systems, the following personal data may be processed:

• Authentication information;
• Identification information (first name, surname, personal identity number);
• Information on the represented company (name of workplace and registration number) (if applicable);
• Position (if applicable);
• Data on professional suitability, experience and education;
• Contact details (correspondence address, mobile telephone, telephone, e-mail address);
• Information related to participation in procurements, including data on professional suitability, experience and education (work experience, education, qualifications, additional education and courses, information on language skills);
• Payment information (credit institution and its details, bank account);
• Information on the qualification period;
• Type of works/services;
• Information contained in communication materials (for example, correspondence);
• Unstructured data attached in annexes.

Legal basis for data processing
When maintaining the supplier list and Qualification Systems, we will process your personal data on the basis of point (f) of Article 6(1) of the Regulation – pursuing our legitimate interest “To maintain the supplier list and to select and maintain a list of qualified suppliers (Section 55 of the Law on Procurement by Public Service Providers)”.

Who will receive your personal data?
Your personal data will be processed by authorised employees of Latvenergo Group who have access to the supplier list and/or Qualification Systems. Authorised employees process personal data within the scope specified in their job duties, in compliance with the requirements of personal data protection and other laws and regulations, as well as the personal data processing requirements set out in the Controller’s internal regulations.

Personal data may be transferred to:

• a Latvenergo Group company, if the supplier list and/or Qualification Systems are used by a Latvenergo Group company;
• the Controller’s outsourced service providers (processors), who are authorised to carry out certain data processing activities on behalf of and under the supervision of the Controller,
• audit service providers;
• state authorities that provide services (for example, VDAA);
• state authorities to which the information specified in laws and regulations must be provided;
• third parties who access the list of qualified suppliers published on the websites of Latvenergo Group;
• under certain circumstances (for example, if a complaint is received about the service concerned), data may be transferred to law enforcement or supervisory authorities, courts, as well as the Controller’s processors – providers of legal services.

It is not intended to transfer personal data to recipients outside the European Union or the European Economic Area.

How long do We retain your data?
We will process your personal data included in the supplier list and Qualification Systems for as long as you are included in the supplier list and/or Qualification System, but for no longer than 10 years, aligning the maximum period with the period specified in Section 40, Paragraph five of the Public Procurement Law.

If a complaint is received or a legal interest of the Controller is infringed, for example, if there is a dispute about the scope of the services received, the relevant information may be retained until the dispute is resolved or, if the dispute is being resolved in court, until the day the final court decision enters into force.