This Policy lays down the processing of personal data which is applicable to all Latvenergo’s:

• existing customers who are natural persons and who use Latvenergo’s Services;
• potential customers who are natural persons, who have not established a relationship with Latvenergo and who are interested in the terms and/or cost of Latvenergo’s Service Provision;
• former customers, including those whose contractual obligations have not been fulfilled or who have agreed to receive commercial notifications after the termination of the contract;
• protected users;
• customer and/or protected users’ representatives, including contact persons and legal representatives; persons who, in the interests of customers and/or protected users, make payments for Latvenergo Services;
• customer guarantors;
• persons present at the objects (facilities) or in their adjacent areas;
• employees of cooperation partners, contractors and service providers;
• users of Elektrum website and mobile applications and followers of social media accounts;
• participants and visitors to educational activities and other events;
• real estate owners, owners' representatives;
• bidders at auctions;
• real estate tenants and lessors;
• natural persons involved in marketing activities (such as contests, promotions, lotteries);
• any other natural person who contacts Latvenergo.

(hereinafter referred to as the Customers or You).

This Policy works in conjunction with Latvenergo’s other terms and conditions related to the use of Latvenergo’s Services, websites, mobile applications and Electrum portal.

To inform You about the processing of Your personal data, Latvenergo is providing the following information in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the Regulation) and the Personal Data Processing Law.

The controller of the personal data specified in this Policy is Latvenergo. The contact information of Latvenergo regarding matters of personal data processing is:
address: Pulkveža Brieža iela 12, Riga, LV-1230, Latvia
Phone number: +371 67 728 222
email: info@latvenergo.lv

A data protection officer has been designated in Latvenergo. The contact information regarding the processing of Your personal data and exercise of the rights:
address: Pulkveža Brieža iela 12, Riga, LV-1230, Latvia
email: fpda@latvenergo.lv

Latvenergo processes Your personal data (Personal Data) including for, but not limited to, the following purposes:

a. Provision of Latvenergo’s Services:

• conclusion and implementation of electricity and/or natural gas and other products/goods trade contracts and other contracts, as well as the provision of Services, including, for example:
  • Customer identification;
  • providing support to protected users;
  • settlement execution monitoring, creditworthiness assessment and debt management;
• for handling applications, requests, claims and proposals;
• Customer consultation;
• Customer registration and authentication on the Elektrum portal, mobile applications and websites;
• Provision of operation of websites, Elektrum portal, and mobile applications.

b. For the development and quality assurance of Latvenergo’s Services:

• for the improvement of services and business development;
• quality control and assurance of service provision.

c. For the purposes of protection of security and other legal interests:

• provision of safety of Latvenergo’s information systems and prevention and investigation of information technology security incidents (for example, in the case of unauthorised external access to Latvenergo’s information systems, websites or apps), as well as any kind of malicious activity against Latvenergo’s information systems, websites or apps (such as DDoS attacks);
• provision of physical security in Latvenergo’s premises, on the territory of sites or at the sites, including the performance of video surveillance and implementation of access control (for example, issuing of passes) and prevention and investigation of physical security incidents;
• to investigate and prevent possible or actual personal data breaches;
• identifying risks of fraud and corruption and ensuring transparency, including reporting of violations.

d. Marketing activities and loyalty promotion:

• Latvenergo’s Services promotion and marketing activities, including, for example:
  • direct Customer-orientated advertising;
  • compilation of marketing statistics;
  • analytics of the Customer habits of using the Services;
• ensuring of the functioning of the loyalty programme (such as “Friendly offers”);
• organisation and implementation of lotteries, competitions and prize draws;
• organisation of Customer visits and events at Latvenergo’s facilities as well as other public events and publicity measures for the events;
• organisation of Customer surveys and opinion polls regarding Latvenergo’s Services and products/goods.

e. Implementation of social responsibility and improvement of representative relationships:

• organisation of tours, visits and events at Latvenergo’s Energy museums, Pļaviņas HPP and Latvenergo’s facilities, such as those aimed at preserving biodiversity or providing Elektrum Energy-efficiency Centre educational, counselling and other activities;
• engagement of young people in the science subjects and supporting science teachers with teaching materials to create engaging and up-to-date lessons, by ensuring the creation, accessibility and use of portal content, as well as the organisation and delivery of FIZMIX Eksperiments competitions and other related activities;
• reception of visitors during events (such as Shadow Day);
• general development of the Controller’s operations and building of sustainable and trust-promoting relationships with Customers and other stakeholders.

f. Provision of commercial activity:

• record keeping, accounting and financial accounting, protection of financial interests (for example, transaction accounting, payment of bondholders' coupons and convening of meetings);
• provision of the generation process of electricity and thermal energy by Latvenergo, including the stages of design, construction, operation, etc., including ensuring the security and continuity of energy supply operations and the construction and approval process for energy supply facilities;
• movable and real estate management;
• organization of procurements and maintenance of the qualification system.

g. Fulfilment of the requirements of laws and regulations or exercise of Latvenergo’s rights in accordance with the laws and regulations:

• provision of information to state and local government control and pre-trial investigation authorities as well as other state and local government authorities within the limits of their competence, such as the Police, the State Audit Office or archives;
• the provision of information to other third parties, including state and municipal authorities, if it is provided for in regulatory enactments and/or necessary for the execution of the concluded contract (for example, to the Land Register in the case of the purchase or sale of the real estate, for protected user data information system for the provision of trade service to the protected user);
• request for information from public authorities or other authorised persons about the Customer in cases where it is permitted by regulatory enactments, for example, from the Land Register, the Cadastral Information System or local governments about the owner of the land/structures;
• processing of the received information of the distribution system operators;
• compliance with the requirement of prevention of money laundering and terrorism and proliferation financing and national and international sanctions.

If You want to know exactly which categories of Your Personal Data are being processed for the specific data processing purpose mentioned above, please refer to Annex 1 to the Policy.

Latvenergo processes your Personal Data in the following cases (see the information in Appendix No. 1 to the Policy):

• A contract has been concluded or will be concluded between You and Latvenergo. In this case, Latvenergo processes Your Personal Data if they are necessary for the performance of Latvenergo’s contract or in order to take steps at Your request prior to entering into a contract. This applies in particular to the electricity and/or natural gas trade contracts as well as to any other contract concluded between Latvenergo and You. If You do not provide the Personal Data necessary for the performance of Latvenergo’s contract, Latvenergo will not be able to fulfil the contract. Latvenergo shall not be held liable for a failure to comply with the obligations under this contract if the contract cannot be fulfilled due to a failure to submit the Personal Data.
• The processing of Your Personal Data is required for compliance with the legal obligations specified in laws and regulations to which Latvenergo is subject. For example, Latvenergo is obliged to ensure the provision of Your information to state institutions and information systems under their management, for example, the protected user data information system or, in the case of contractors' employees, a single electronic time and attendance recording system, managed by the State Construction Control Bureau, to comply with accounting document management obligations, as well as to archive documents;
• The processing of Personal Data is needed for the purposes of the legitimate (lawful) interests pursued by Latvenergo or by a third party. Legitimate interests are rights, the exercise of which is permissible in accordance with laws and regulations, including in connection with the contract concluded between You and Latvenergo. For a list of legitimate interests in relation to a specific purpose of data processing, please refer to Appendix 1 of the Policy.
• Latvenergo received Your consent to the processing of Personal Data (including in writing, electronically on websites, the Elektrum portal, or mobile applications, as well as by telephone or using other distance communication means). For example, this applies to receipt of commercial notifications, participation in lotteries, competitions and surveys organised by Latvenergo, the use of data collected through cookies to adjust the content according to your on-site activities.
• The processing of Personal Data is necessary for Latvenergo to fulfil a task in the public interest. For example, in accordance with the provisions of the Law on the Prevention of Money Laundering and Terrorism and Proliferation Financing, Latvenergo performs Customer research in the scope determined by law for public interest.

If you want to know exactly on what legal basis Personal Data is being processed for the specific data processing purposes mentioned above, please refer to Annex 1 of the Policy.

Latvenergo may transfer Your Personal Data to the following recipients of Personal Data if this is not in conflict with the applicable laws and regulations:

• Latvenergo’s employees and authorised persons processing the Personal Data specified in this Policy on behalf of Latvenergo within the scope of their competence and job assignments;
• to persons related to the provision of Latvenergo’s Services, if the Service provides for certain types of Personal Data processing or it arises from the provision of the Controller's business activities, including, but not limited to:
  • information system solution developers and maintenance service providers;
  • contractors (for example, within the framework of installing technology products, if it is necessary to install solar panels or heating solutions);
  • Customer opinion research service providers and research service providers;
  • service providers who provide delivery of information or goods to Customers;
  • creative and media agencies, advertising and marketing service providers, event organisers;
  • legal service providers;
  • real estate management and administration service providers;
  • commercial activity service providers;
  • printing service providers;
  • extrajudicial debt collection service providers;
  • security and safety service providers;
• insurance service providers;
• postal and logistics service providers;
• providers of public information services (such as media);
• Credit Information Bureaus;
• audit and audit service providers;
• banks and other providers of payment and financial services as well as providers ensuring information exchange between Latvenergo and financial service providers;
• cookie managers;
• online communication channel operators and service providers;
• verifiers of the secure electronic signature (European Commission and/or Latvijas Valsts radio un televīzijas centrs VAS);
• Customer authorised representatives with whom Latvenergo communicates to ensure the provision of the Services or protection of its interests as well as for other purposes specified in this Policy;
• Customer guarantors;
• Visitors of web-sites and followers of social media accounts;
• Latvenergo Group companies if the specific situation concerns Latvenergo Group company;
• state and municipal authorities (such as, Land Register, State Land Service, Office of Citizenship and Migration Affairs, State Revenue Service, State Construction Control Bureau);
• law enforcement agencies, courts.

Latvenergo may receive information about You from third parties, such as:

• state and municipal authorities (such as, Land Register, State Land Service, Office of Citizenship and Migration Affairs, building authority or other bodies performing the functions of building authority);
• credit information offices and other persons who have the right to maintain information about the creditworthiness of persons in order to check the Customer’s ability to pay for Latvenergo’s Services;
• cooperation partners that help Latvenergo accept payments from You (for example, in cases when there is a need to pay for Latvenergo’s Services in a supermarket or post office);
• service providers who ensure the exchange of information between Latvenergo and financial service providers, banks and other payment and financial services providers;
• service providers that provide the service of a charging station management system.

In addition, Latvenergo exchanges Your Personal Data joint stock company Sadales tīkls, registration number: 40003857687, legal address: Riga, 1 Šmerļa Street, LV-1006 (Sadales tīkls) and/or joint stock company Gaso, registration number: 40203108921, legal address: Riga, 20 Vagonu Street, LV-1009 (Gaso). The exchange of Personal Data is necessary for the following purposes and is carried out on the basis of laws and regulations and/or performance of contractual obligations on a number of occasions:

• maintenance of the electricity and natural gas distribution infrastructure and systems and supply of electricity and natural gas, connection and/or coordination of technology products, provision of the electricity net payment system service;
• provision of Customer service;
• accounting of settlements, payments and finances;
• handling Customers’ claims;
• ensuring the provision of services;
• protection of the interests of Latvenergo, Sadales tīkls and Gaso.

Your Personal Data are processed to the extent that is reasonably necessary depending on the specific purpose of the data processing under the provisions of the applicable laws and regulations.

Latvenergo will store Your Personal Data:

• for as long as it is necessary in order to achieve the purposes for the processing of Personal Data specified in Section 4 of the Policy, including in order to fulfil the obligations determined by regulatory enactments, such as:
  • information reflected in the contract and reflecting the fulfilment of the obligations under the contract shall be kept for 10 years after the termination of the contract and the fulfilment of the obligations. The Controller, if it considers that the information reflecting the fulfilment of the obligations under the contract is not relevant, reserves the right to erase information earlier;
  • if the product/good has a commercial guarantee, we will keep the information for the duration of the commercial guarantee, e.g. 10 years;
  • when fulfilling the obligation specified in the Law on the Prevention of Money Laundering and Terrorist and Proliferation Financing, we will store the information obtained during the inspection for 5 years after the termination of the transaction;
  • we will store information on issued invoices and information related to payments for at least 5 years, in compliance with the provisions of the Accounting Law;
  • we will store audio records for no longer than 3 years;
  • we will store video surveillance recordings for no longer than 30 days, if the video surveillance is carried out at the Controller's facilities and adjacent areas, or 40 days if the video surveillance is carried out at the Controller's electric vehicle charging service site;
  • we will keep your submissions, as well as the answers provided to you, within the limitation periods for temporarily kept documents set out in the Archives Law and in accordance with the current Latvenergo file nomenclature, which has been agreed with the Latvian National Archives in accordance with the procedure set out in the Archives Law, i.e. for 10 years from the date of registration,
• as long as Your consent to the processing of Personal Data, such as marketing activities or the processing of cookies, is valid;
• If a complaint is received or the Controller’s legal interest is breached, for example, there is a dispute about the amount of services received, the relevant information may be retained until the dispute is resolved, or, if the dispute is settled in court, until the date of entry into force of the court's final decision.

In order to improve the functionality of Latvenergo's website and adapt it to your usage habits, as well as to obtain statistics on the activities performed and, to provide a personalized user experience, tailoring content, advertising and offers to the activity on the website, Latvenergo processes cookies on its websites. The required cookies are processed in order to provide technical operations to comply with Latvenergo's legitimate interests and they do not require the user’s consent, while statistical and marketing cookies are processed if you have given your consent to the processing of these cookies. Detailed information regarding the Personal Data processing through cookies is available in the cookie management solution and cookie policies placed on Elektrum portal, mobile applications and websites.

Mobile applications, websites, and the Elektrum portal may contain links to other websites. However, if You use these links, it should be noted that Latvenergo has no control over other websites. For this reason, Latvenergo cannot be held responsible for the protection and confidentiality of any information that You provide when You visit such sites, nor are these sites covered by this statement. You must exercise caution and review the privacy or confidentiality statement of the website concerned.

In some cases, Latvenergo may transfer Personal Data outside the countries of the European Union, European Economic Area or countries and organisations for which the European Commission has not taken a decision on an adequate level of protection. Transfers may take place, for example, when using online communication solutions (such us WhatsApp) or engaging third parties that help Latvenergo in performing the business operation tasks specified in this Policy and/or provision of services, and are located in third countries and organisations for which the European Commission has not taken a decision on an adequate level of protection. For statistical and marketing purposes, Latvenergo may also use the cookies of third parties, such as Google, Meta, where the information generated by the cookies may be sent and stored in countries and organisations for which the European Commission has not taken a decision on an adequate level of protection.

Depending on the circumstances, Latvenergo may choose the special guarantees for the protection of Personal Data specified in the Regulation, such as concluding standard contractual clauses with the recipient of Personal Data or using exceptions, such as the need to perform an agreement between you and Latvenergo or your consent to data processing, for example by giving consent for the processing of cookies or after receiving relevant information about the communication channel used, you provide information containing Personal Data, thus consenting to the exchange of personalized information on the WhatsApp channel.

You have the right to get to know or receive the information about processing and/or mentioned safeguards using the contact information of Latvenergo specified in Section 2 or Section 3 of the Policy.

You have the following rights regarding the Personal Data referred to in this Policy:

• Right of access. You have the right of access to your personal data and to receive information from Latvenergo about the processing of your personal data. If the information is not available to You on the Elektrum portal or in a specific Service website or mobile application and the information provided in this Policy does not seem comprehensive enough to You, please contact Latvenergo by using the Latvenergo contact information provided in Section 2 or 3 of the Policy!
  
  Latvenergo may request a reasonable fee resulting from administrative costs for all additional Personal Data copies that You request from Latvenergo. In addition, if You submit a request in electronic form and do not request otherwise, Latvenergo provides information in a commonly used electronic format.
• Right to rectification. In the case of inaccuracies, You have the right to request that Latvenergo rectifies the inaccurate Personal Data.
• Right to erasure.You have the right to request that Latvenergo erases Your Personal Data if:
  • You withdraw Your consent to process Personal Data, taking into account the fact that the withdrawal of consent does not affect the data processing carried out during the validity of the given consent;
  • the Personal Data are no longer necessary in connection with the purposes referred to in Section 4 of this Policy for which they were processed;
  • You have objected to the processing and Latvenergo's legitimate reasons are not more important than Your legitimate reasons or if the Personal Data is processed for direct marketing purposes;
  • the Personal Data are unlawfully processed;
  • the Personal Data have to be erased in compliance with the requirements of laws and regulations.

Please note that the right to erasure does not apply in cases where, in accordance with the laws and regulations, Latvenergo is obliged to process personal data or the processing is necessary for archiving, public interest or statistical purposes, as well as due to bringing, implementing or defending a lawful requirement.

• Right to restrict the processing of data.You have the right to request that Latvenergo restricts Personal Data processing if:
  • You contest the accuracy of Personal Data or the lawfulness of its processing (restriction will be in force while the contestation process is in progress);
  • the Personal Data processing is unlawful, but You oppose the erasure of the Personal Data;
  • Latvenergo no longer needs the Personal Data for the purposes of processing, but they are required by You for the establishment, exercise or defence of legal claims;
  • You have objected to processing and as long as it is not verified whether the legitimate reasons of Latvenergo are more important than Your legitimate reasons.
• Right to object to processing. You have the right to object at any time, on grounds relating to Your particular situation, to the processing of Your Personal Data which is based on the legitimate interests and public interests referred to in Section 5 as well as profiling or automated decision-making described in Section 12. Latvenergo has the right to continue to process Your Personal Data despite the objections received if Latvenergo demonstrates compelling legitimate grounds for the processing which override Your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
  In cases where Latvenergo uses Your Personal Data for direct marketing purposes, You have the right to object at any time to the processing of Your Personal Data for such purposes when it includes profiling (as specified in Section 12 of this Policy).
• The right to withdraw consent. In cases where You have given Your consent to the processing of certain personal data, You have the right to withdraw it at any time. If your consent is given via the Elektrum portal, mobile application or websites, you may revoke your consent via the Elektrum portal, the application, websites or, in the case of cookies, by using the cookie management solution in the lower left corner of the website, or in the browser, as well as by clicking the unsubscribe link in a particular e-mail message accordingly, thus unsubscribing from receipt of further commercial communications. In other cases, You can use the contact information of Latvenergo specified in Section 2 or Section 3 of the Policy to withdraw consent.
  If You withdraw Your consent, including consent to the use of cookies, Latvenergo has the right to limit the functionality and scope of its Services, including the scope of the Elektrum portal, mobile application and website as well as the provision of related services, depending on the existence of the relevant Personal Data. The withdrawal of consent does not affect the data processing carried out during the validity of the given consent.
• Right to portability. You have the right to receive Your Personal Data, which You have provided to Latvenergo, in a structured, commonly used and machine-readable format and have the right to request to transmit those data to another controller (service provider) if the processing of such Personal Data is carried out by automated means or on the basis of consent (as specified in Section 5 of this Policy).
• Right to lodge a complaint. You have the right to lodge a complaint with Latvenergo, the Data State Inspectorate (Elijas iela 17, Rīga, pasts@dvi.gov.lv), if You consider that Your Personal Data protection rights have been infringed. However, before contacting the Data State Inspectorate, please contact Latvenergo or the Data Protection Officer in order to find a solution if Your right to the protection of Personal Data has been violated. Latvenergo takes care of Your Personal Data protection and will provide You with the support You need.

To exercise the mentioned rights, You can use the contact information of Latvenergo specified in Section 2 or Section 3 of the Policy, unless otherwise provided for in this section.

For the realisation of all the above-mentioned rights, you may use the contact information of Latvenergo specified in this Policy, indicating the following personal data in the request: name, surname, personal identification number, postal address (if you wish to receive a reply by registered mail) or e-mail address (if you wish to receive the answer to the email address).

We invite you to submit your request in one of the following ways:

• send a free-form application electronically to the e-mail info@latvenergo.lv or fpda@latvenergo.lv, signing the application with a secure electronic signature;
• send your signed free-form application by post to: Latvenergo AS; 12 Pulkveža Brieža Street, Riga, LV-1230.

Automated decision-making regarding Your Personal Data, including profiling, may occur in the following cases:

• The analysis, accounting and forecasting of activities for the development and offering of Services that meet the wishes and interests of Customers, for sending personalized messages and for granting personalised additional benefits are based on information that has been provided to Latvenergo and created during the use of the Services, as well as your interests and usage habits of the Services, for example, on the basis of the type of Service selected by the Customer and the usage habits of the Service, consumption data, type of payment, type of electricity meter, habits of payment of bills, address of the object and type of communication channel;
• Within the framework of settlement performance monitoring, creditworthiness assessment and debt management, in order to ensure that you are provided in a timely manner with information on delays in the fulfilment of obligations arising from already concluded agreements and to fully assess the possibility of conclusion of other agreements, automated Customer data profiling is performed with regard to the payment and settlement habits of the Customer. Customer payment and settlement habits (including negative payment history) may affect the content of the notifications and the range of Services available to You. The payment history for Latvenergo’s Services may affect Your right to make payments in instalments. If You have a positive settlement history, You will have access to the option to pay for the Services in instalments;
• In order to forecast, improve and ensure an electric vehicle charging process that meets your needs and the technical requirements of electric transport and to provide you with a quality service that optimizes the charging process and provides efficient electricity management, automated profiling can be used to develop and regularly apply an algorithm that will allow to model and predict the duration of charging and consumed electricity during charging according to a pre-defined data set by using your electric vehicle charging data created within the framework of receipt of the service, thus ensuring balanced distribution of electricity between electric vehicle charging equipment;
• Within the framework of electricity consumption analysis project Energo Pulss, automated profiling can be performed, with the purpose to develop and regularly apply an algorithm that will enable You to model and classify, using the data specified in the questionnaire of the project and created within the electricity trade service, the Customer's object (clusters) with similar indicators or characteristics according to a pre-defined data set.

In accordance with the procedure set forth in Section 11, you have the right to object to an automated decision, including profiling, and the right to ask Latvenergo to review the decision and ask to involve Latvenergo employees in assessment of the decision.

Participation of a minor (a child) in projects organised by Latvenergo, in which persons under the age of 18 may participate, is possible if the child’s legal representative has given Latvenergo his or her consent to the child’s participation in the particular project or if any other legal grounds determined in the Regulation exist. Registration on websites (for example, www.fizmix) may be independently perform by persons 13 years of age or older.

Principles of processing of Personal Data of children:

1. Latvenergo collects and stores the Personal Data of a child for as long as necessary for the organisation of the relevant project or event. If Latvenergo has the consent of the child or the child’s legal representatives (such as parents) to use the child’s Personal Data (such as pictures), Latvenergo stores the child’s data for as long as the consent of the legal representatives of the child is valid;
2. Latvenergo only processes the Personal Data of a child in relation to the projects and events for the organisation of which and for participation in which the child’s Personal Data have been collected;
3. Latvenergo processes the Personal Data of a child on the basis of the consent of the child or the child’s representatives (such as parents) as well as if any other legal grounds exist for the processing of such Personal Data, for example, it is provided by regulatory enactments or Latvenergo requires the child’s Personal Data to protect Latvenergo’s interests (for example, if a dispute arises relating to the Personal Data of the child);
4. Latvenergo may transfer the Personal Data of a child to those recipients of Personal Data who assist in organising events or competitions determined by Latvenergo, as well as in maintaining or using online portals (for example, if Latvenergo offers the opportunity to be authorised on Latvenergo’s websites through other portals, including social networks);
5. a child as well as the child’s representatives have the right to request to erase the child’s Personal Data, to stop carrying out actions (for example, collecting) with the child’s Personal Data, to provide information about the child’s Personal Data or a copy thereof and to contact the Data State Inspectorate in order to protect the right of the child to Personal Data protection;
6. in some cases, Latvenergo will not be able to ensure the participation of a child in certain events or other services if Latvenergo does not receive the information required for this purpose from the child (for example, information that the child has attained the age of at least 13 years old). In such cases, Latvenergo will inform the child or the child’s legal representatives thereof.