Personal data processing principles

Personal data that we process

Price surveys and procurements below the public procurement contract price threshold are organised in the Latvenergo AS Electronic Procurement System (hereinafter – LEIS), whereas procurements above the public procurement contract price threshold are organised in the Electronic Procurement System of the State Digital Development Agency (hereinafter in the text – VDAA) and in LEIS. E-orders are placed in the VDAA Electronic Procurement System.

When organising price surveys and procurements, as well as placing E-orders, various activities are carried out that involve the processing of personal data. Depending on the specific procurement process activity, the following personal data may be processed:

• Authentication information;
• Identification information (first name, surname, personal identity number);
• Information on the represented company (name of the workplace and registration number) (if applicable);
• Position (if applicable);
• Information contained in communication materials (for example, correspondence);
• Contact information (correspondence address, mobile phone, telephone, e-mail address);
• Settlement information (credit institution and its details, bank account)
• Information related to participation in price surveys, procurements and E-orders, incl. data on professional suitability, experience and education (work experience, education, qualifications, additional education and courses, information on language skills);
• Information on whether the exclusion criteria laid down in laws and regulations apply to the tenderer;
• Resident or non-resident;
• Information on the contract termination date;
• Description and percentage volume of the works to be subcontracted;
• Information included in the tender;
• Unstructured data attached in annexes.

Legal basis for data processing

When organising procurements and placing E-orders in the VDAA Electronic Procurement System, we will process Your personal data on the basis of Article 6(1)(c) of the Regulation, i.e. the Public Procurement Law, the Law on Procurement by Public Service Providers, and Cabinet Regulation No. 816 of 20 December 2022 “Regulations on Public Electronic Procurement”.

When organising price surveys, simplified procurements and procurement procedures in LEIS, we will process Your personal data on the basis of Article 6(1)(f) of the Regulation – pursuing our legitimate interest “To organise and ensure procurements, incl. price surveys, and related activities below the public procurement contract price threshold, as well as to ensure the procurement process in LEIS”.

Who will receive Your personal data?

Personal data will be processed by authorised employees of the Controller, within the scope specified in their work duties, in compliance with the requirements laid down in personal data protection and other laws and regulations, as well as the personal data processing requirements laid down in the Controller's internal regulations.

Personal data may be transferred to:

• the Controller's outsourced service providers (processors) who are authorised to carry out certain data processing operations on behalf of and under the supervision of the Controller;
• a Latvenergo Group company, if the procurement is also carried out in the interests of the Latvenergo Group company;
• providers of audit and auditing services;
• State authorities that provide services (for example, VDAA);
• State authorities that are required to be provided with information laid down in laws and regulations;
• under certain circumstances (for example, if a complaint is received regarding the relevant service), data may be transferred to law enforcement or supervisory authorities, courts, as well as the Controller's processors – providers of legal services.

Personal Data is not intended to be transferred to recipients outside the European Union or European Economic Area countries.

How long do We store Your data?

In accordance with Section 46 of the Law on Procurement by Public Service Providers, We, as a public service provider, will store the originals of all price survey and procurement procedure documents, as well as the originals of applications and tenders, in LEIS for no less than three years after the decision regarding the procurement procedure has been taken, and for no longer than ten years, as laid down in Section 40, paragraph five of the Public Procurement Law.

If a complaint is received or a legal interest of the Controller is infringed, for example, there is a dispute about the scope of the service received, the relevant information may be stored until the dispute is resolved or, if the dispute is being resolved in court, until the day the final court judgment enters into force.

Personal data that we process

The Supplier list and Qualification systems have been created and are maintained in LEIS. Within the maintenance of the Supplier list and Qualification systems, the following personal data may be processed:

• Authentication information;
• Identification information (first name, surname, personal identity number);
• Information on the represented company (name of the workplace and registration number) (if applicable);
• Position (if applicable);
• Data on professional suitability, experience and education;
• Contact information (correspondence address, mobile phone, telephone, e-mail address);
• Information related to participation in procurements, incl. data on professional suitability, experience and education (work experience, education, qualifications, additional education and courses, information on language skills);
• Settlement information (credit institution and its details, bank account);
• Information on the qualification period;
• Type of works/services;
• Information contained in communication materials (for example, correspondence);
• Unstructured data attached in annexes.

Legal basis for data processing

When maintaining the supplier list and Qualification systems, we will process Your personal data on the basis of Article 6(1)(f) of the Regulation – pursuing our legitimate interest “To maintain the supplier list and to select and maintain the list of qualified suppliers (Section 55 of the Law on Procurement by Public Service Providers)”.

Who will receive Your personal data?

Your personal data will be processed by authorised employees of the Latvenergo Group who have access to the Supplier list and/or Qualification systems. Authorised employees process personal data within the scope specified in their work duties, in compliance with the requirements laid down in personal data protection and other laws and regulations, as well as the personal data processing requirements laid down in the Controller's internal regulations.

Personal data may be transferred to:

• a Latvenergo Group company, if the supplier list and/or Qualification systems are used by a Latvenergo Group company;
• the Controller's outsourced service providers (processors) who are authorised to carry out certain data processing operations on behalf of and under the supervision of the Controller,
• providers of audit and auditing services;
• State authorities that provide services (for example, VDAA);
• State authorities that are required to be provided with information laid down in laws and regulations;
• third parties who access the list of qualified suppliers published on Latvenergo Group websites;
• under certain circumstances (for example, if a complaint is received regarding the relevant service), data may be transferred to law enforcement or supervisory authorities, courts, as well as the Controller's processors – providers of legal services.

Personal Data is not intended to be transferred to recipients outside the European Union or European Economic Area countries.

How long do We store Your data?

Your personal data included in the Supplier list and Qualification systems will be processed by Us for as long as You are included in the supplier list and/or Qualification system, but for no longer than 10 years, adjusting the maximum period to the period laid down in Section 40, paragraph five of the Public Procurement Law.

If a complaint is received or a legal interest of the Controller is infringed, for example, there is a dispute about the scope of the service received, the relevant information may be stored until the dispute is resolved or, if the dispute is being resolved in court, until the day the final court judgment enters into force.