Notification on personal data processing

Your personal data controller is JSC Latvijas Gāze, registration number: 40003000642, legal address: Aristida Briāna Street 6, Riga, LV-1001, telephone +371 67 869 866, e-mail: lietvediba@lg.lv

If you have any questions in relation to this notification or processing of your personal data, you may contact with us by using our communication channels mentioned above or by contacting with our personal data officer by writing to the electronic mail address: datu.specialists@lg.lv.

This notification describes how we perform personal data processing of our clients, representative/contact persons of clients, shareholders, participants of raffles and lotteries, cooperation partners, website visitors and other persons, whose data may appear at our disposal within the framework of commercial activity performed by us.

We assume that before using our website or becoming our client, you have read this our notification and have accepted the terms and conditions thereof. This is an up to date wording of the notification. We reserve the right to make amendments and to update this notification as per the need.

The purpose of this notification is to provide the general insight to you about the activities of personal data processing performed by us and purposes, however, please, take into account that also in other documents (such as service contracts, cooperation contracts, terms and conditions of lotteries, regulations for use of the website www.lg.lv or customer portal https://mans.lg.lv/) additional information regarding your personal data processing may be provided.

This is to inform you that regulations on the personal data processing covered by this notification refer only to processing of personal data of natural persons.

In addition to these conditions, you may become acquainted with the following additional notifications on personal data processing:

• Terms and conditions for use of cookies (available on https://lg.lv/en/cookies);
• Regulations for use of the clients portal of JSC Latvijas Gāze (available on

  https://mans.lg.lv/)

We are aware of the fact that personal data is your value and we will process them in compliance with the confidentiality requirements and taking care for security of your personal data being at our disposal.

We will process your personal data only in accordance with the previously defined legitimate purposes, including:

a) Commencement and provision of services, as well as fulfilment and provision of liabilities laid down in the contract (including cooperation contract)

Within the framework of this purpose, it should be necessary for us to identify you, to identify the site, where the service will be provided, to ensure appropriate calculation of payments and to ensure payment performance process, to contact with you on the issues related to provision of the service and/or fulfilment of the contract (including also sending of invoices), in certain cases also to ensure recovery of unpaid payments, as well as to ensure provision of high quality service.

For this purpose and the above mentioned underlying purposes, at least the following personal data would be necessary for us: name, surname, telephone number, e-mail address of the client and contact person of the client, personal identity number of the client, communication address, address of the site, owner of the site, relation of the client with the site (in case of not being an owner), bank account number, information on gas consumption, data of personal identity documents and other data.

Principal legal grounds to be used for achievement of these purposes are:

• conclusion and performance of a contract with the data subject (Article 6(1)(b) of the General Data Protection Regulation (GDPR) [1]), for example, when you agree to submit information about your account No., in order to return your overpaid payment for use of natural gas;
• compliance with a legal obligation (Article 6 (1)(c) of the GDPR);
• legitimate interests pursued by the controller (Article 6(1)(f) of the GDRP), for example, identification of you as a client or contact person of a client, identification of the owner of the site and provision of communication with you.

REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

b) Performance of the requirements laid down in the regulatory enactments with regards to service provision or performance of requirements prescribed by other regulatory enactments

For this purpose it would be necessary for us to perform the requirements of both, the Energy Law, Cabinet Regulation No. 78 “Regulation On Sale and Use of Natural Gas” as well as other legal acts governing sales of natural gas. Besides, we shall also perform the requirements prescribed by regulatory enactments governing accounting, the Archive Law, Law On Regulators of Public Utilities, Law On the Procurement of Public Service Providers, EU Regulation No. 596/2014 and other regulatory enactments as well as the requirements of supervisory authorities.

For this purpose it should be necessary for us to process personal data required for performance of activities determined in each regulatory enactment, for example, to collect information about gasified objects, to exchange (transfer) information about the supplied gas with natural gas system operators and other persons set forth in regulatory enactments, including state authorities and courts.

For this purpose, we also process the personal data of the shareholders (personal identification data, contact information), which is required for the accounting of the shareholders and is regulated by the Commercial Law and other normative enactments regulating the financial instrument market.

Principal legal grounds to be used for the achievement of these purposes are:

• compliance with a legal obligation (Article 6 (1)(c) of the GDPR).

c) Provision of marketing activities

Within the framework of this purpose, we could send you commercial notices, ensure your participation in lotteries and/or raffles organized by us, as well as to publish materials from public events organized by us.

At least the following personal data should be necessary for this purpose: Name, surname, telephone number and e-mail address of the client or contact person of the client and/or cooperation partner, description of activities performed on the internet environment, in certain cases image of a person in photographs and video records;

Principal legal grounds to be used for achievement of these purposes are:

• consent of a data subject (Article 6(1)(a) of the GDPR);
• conclusion and performance of a contract with the data subject (Article 6(1)(b) of the GDPR);
• legitimate interests pursued by the controller (Article 6(1)(f) of the GDPR), for example, provision of publicity of us as a controller

d) Provision of security, prevention of threat to the property interests and other significant legitimate interests of us or third persons

For this purpose it should be necessary for us to perform video surveillance of our territory, buildings and other properties, to perform recording of telephone conversations and conversations in presence in order to ensure proof for protection of our interests, to use personal data processors for provision of different functions, to ensure data storage, in case of need to disclose information to courts and other public authorities, acquisition of information about the owners of the site, to exchange with information within the framework of the group of companies, to use the rights granted by regulatory enactments in order to ensure our legitimate interests.

For this purpose it should be necessary for us to process at least the following personal data: image of visitors of our premises and territory in video surveillance records, place and time of location, voice records, to save audit records of activities performed by you on the internet environment, to identify you and to save this information, to store data in backup copies and other data as per the need;

Principal legal grounds to be used for achievement of these purposes are:

• Legitimate interests of the controller (Article 6(1)(f) of the GDPR), for example, for purpose of detection of criminal offences, provision of debt recovery, data recovery purposes, saving of proof.

e) For ensuring of proper provision of services and ensuring cooperation with service providers and other cooperation partners.

Within the framework of this purpose, it should be necessary for us to perform maintenance and improvement of technical systems and IT infrastructure, use of technical and organisational solutions that may also use your personal data (for example, by using cookies) with a purpose to ensure proper provision of services as well as to process your data specified as a contact person by cooperation partners, in order to ensure valuable communication with the cooperation partner.

Principal legal grounds to be used for achievement of these purposes are: Legitimate interests pursued by the controller (Article 6(1)(f) of the GDPR).

We perform appropriate measures in order to process your personal data in accordance with the applicable legal acts and ensure that third persons, who do not have any legal grounds for processing of your personal data, could not have access to your personal data.

The following persons could have access to your personal data as per the need:

• our employees or directly authorised persons, who shall require it for the performance of work duties;
• personal data processors according to services provided by them and only in the necessary scope, such as auditors, finance management and legal advisors, technical maintainer of the data base, security service provider, other persons, being related to provision of services to us;
• state and local authorities in cases prescribed by legal acts, such as law enforcement authorities, local governments, tax administrators, sworn bailiffs, courts, supervisory authorities;
• third persons, upon carefully evaluating whether such data transfer has appropriate legal basis, for example, debt recovery service providers, courts, extrajudicial dispute settlement authorities, administrators of the insolvency proceedings, third persons, maintaining registers (such as registers of debtors, credit information offices etc.).

We perform relevant measures in order to ensure your personal data processing, protection and transfer to data processors, in accordance with the applicable legal acts. We carefully select the personal data processors, and when performing the transfer of data, we evaluate the need thereof and volume of data to be transferred. Data transfer to processors is being performed in compliance with the personal data confidentiality and safe processing requirements.

Currently we can cooperate with the following categories of personal data processors:

• outsourcing accountants, auditors, translators, finance management and legal advisors;
• IT infrastructure, data base owner/ developer/ technical maintainer;
• debt recovery service providers;
• security service provider;
• other persons, being related to provision of our services.

Personal data processors may change time after time, regarding which we will make changes also in the present document.

We do not transfer your data to the countries outside of the European Union or European Economic Area.

Your personal data will be stored as long as the storage of them will be necessary in accordance with the appropriate purposes for personal data processing, as well as in accordance with the requirements of the applicable legal acts.

When evaluating the duration of storage of personal data, we take into account the requirements of regulatory enactments being in force, aspects of performance of contractual liabilities, your instructions (for example, in case of consent) as well as our legitimate interests. In case your personal data will not be necessary anymore for the set purposes, we will erase or destroy them.

Please, find below the most common time periods for storage of personal data:

• personal data required for performance of contractual liabilities - we will store until the contract will be fulfilled and as long as other terms of storage will be performed (see below);
• personal data to be stored in order to perform the requirements of legal acts - we will store for the relevant time period stipulated by regulatory enactments, for example the Law On Accounting stipulates that source documents shall be stored until the day, when they are necessary in order to establish the beginning of each commercial transaction and in order to track the course thereof, however for at least 5 years;
• data in order to ensure data recovery - we will store backup copies until the time, when the minimum number of newer backups will be established in order to be able to delete the previous backups;
• data in order to prove the fulfilment of our liabilities - we will store for the general limitation period of the claim, in accordance with the limitation periods for claims prescribed by regulatory enactments - 10 years in the Civil Law, 3 years in the Commercial Law and other terms, considering also the time periods set forth by the Civil Procedure Law for raising of claims.
• We will store the data acquired as a result of video surveillance for 1 month in order to detect possible criminal offences;
• We will store audio records for 18 months with regards to phone records and records made in the customer service centre, in order to ensure recording of our conversation and presentation in case of disagreements.

Personal data update
In case if any changes have occurred in the personal data you have provided to us, such as change in the personal identity number, communication address, change of the phone number or e-mail address, change of the owner of the site, please, contact with us and submit to us the updated data in order we could achieve the relevant purposes of the personal data processing.

Your right to access your personal data and rectify them
In accordance with the provisions of the General Data Protection Regulation, you have the right to request us to have access to your personal data, being at our disposal, to request rectification, erasure, restriction of processing, to object to processing of your personal data as well as the right to data portability in cases and in accordance with the procedure prescribed by the General Data Protection Regulation.

We respect your right to have access to your personal data and to control them, therefore, in case of receipt of your request, we will reply to it within the time periods set forth in regulatory enactments (usually not later than within a time period of one month, if it will not contain any special request requiring longer period of time for preparation of a reply, regarding which we will inform you) and, if it will be possible, we will accordingly rectify or erase your personal data.

You may obtain information about your personal data being at our disposal or implement any other rights of you as a data subject in any of the following ways:

• by receiving certain type of information on the customer portal https://mans.lg.lv/;
• by submitting the relevant submission in presence and identifying yourself at our office: at Aristida Briāna Street 6, Riga, LV-1001 (each working day, during the working hours 8.00-17.00);
• by submitting the relevant submission, sending it to us via mail to the address: Aristida Briāna Street 6, Riga, LV-1001;
• by submitting the relevant submission, sending it to our e-mail address:

  lietvediba@lg.lv; it should be preferred to sign it with a safe electronic signature.

When receiving your submission, we will evaluate the content thereof and a possibility of your identification, and depending on the relevant situation we reserve the possibility to request you to additionally identify yourself in order to ensure your data safety and disclosure to the relevant person.

Withdrawal of a consent
If the processing of your personal data is based on the consent provided by you, you have the right to withdraw it at any time and further on we will not process your personal data that we processed on the basis of your consent for the relevant purpose. However, we would like to inform that withdrawal of consent shall not affect processing of such personal data, which is necessary for performance of requirements of regulatory enactments, or which is based on the contract, our legitimate interests or other grounds prescribed by regulatory enactments for lawful data processing.

You may also object to processing of your personal data if the processing of personal data is based on legitimate interests or is used for marketing purposes (such as sending of commercial notices or participation in raffles).

If you have any questions or objections in relation to the processing of your personal data performed by us, please, turn to us at first.

If you still consider that we have failed to mutually settle the arising issue and you consider that we violate your right to the personal data protection, you have the right to submit a complaint to the State Data Inspectorate. You may find samples off submissions to the State Data Inspectorate and other related information on the website of the State Data Inspectorate (http://www.dvi.gov.lv/lv/datu-aizsardziba/privatpersonam/iesniegumu-paraugi/).

Primarily we collect your information in order to fulfil the undertaken contractual liabilities, to perform legal obligations binding to us and in order to implement our legitimate interests. In such cases the acquisition of certain information is necessary for us in order to achieve certain purposes, therefore, failure to provide such information may make difficult the commencement of business relations or fulfilment of a contract. If data will not be mandatory required, but submission thereof could help to improve the service or offer you more beneficial provisions of the contract and/or offers, we will indicate at the collection of data that the provision of data is voluntary.

We may acquire your personal data in any of the following ways:

• during the process of conclusion of a mutual contract, acquiring data from you;
• if the contract is concluded with a third person and it has specified you as a contact person or a person related with the site, or submitted documents (such as Land Register Certificate), where your data are showed;
• from you, if you will submit to us any submissions, e-mails or call us;
• from you, if you apply for our services online;
• from you, when performing authorization on the customer portal https://mans.lg.lv/ and entering data;
• from you or the Nasdaq, if you are our shareholder;
• on the website https://mans.lg.lv/ and www.lg.lv, using cookies
• in certain cases from data bases of third persons, for example, when assessing your creditworthiness or establishing your right to represent the company, we may obtain data from third persons in order to achieve the purpose;
• in the relevant cases, from video surveillance and voice records.

We will not use your data for automated decision making.