II Data subjects
2. A data subject is any identified or identifiable natural person whose data is processed by FVS, including persons subject to the supervision and control of FVS and legal and contractual representatives of these persons, employees and officials working in FVS, persons bound with contractual relations by FVS and legal and contractual representatives of these persons, and other persons whose data are processed by FVS on the basis of legitimate purpose and lawfulness of data processing.
III Personal Data Categories
3. Personal data may be collected from data subjects and third parties on the basis of regulatory enactments or agreements between third parties and FVS, as well as from the state and local government institutions of the Republic of Latvia and institutions of the European Union, including public registers.
4. Processed personal data categories by FVS:
- basic data of the data subject, such as name, surname, personal identity number;
- contact details, such as a declared or contact address of residence, e-mail address, telephone number;
- professional data, such as education, work experience, position, workplace;
- data resulting from the employment or civil service, such as salary, length of work experience;
- data resulting from the contractual relationship, such as the subject matter and amount of the contract;
- special categories of personal data, such as data concerning health in the field of employment or in the field of monitoring and control of FVS;
- data collected and/or created performing the duties provided for in regulatory enactments, such as the registration number given by FVS, data recorded in inspection protocols, results of laboratory examinations, administrative offences and penalties;
- payment and financial data, such as bank account number, payable contract amounts;
- data resulting from video surveillance, such as video image;
- data resulting from information systems and websites, such as IP address, cookies, audit logs;
- other and above in the list not mentioned personal data categories which are processed by FVS.
IV Purposes for the processing of personal data
5. FVS processes personal data for the following legitimate purposes:
- ensuring operational activities of FVS (performing monitoring and controlling functions in the field of food and veterinary, ensuring phytosanitary border control);
- ensuring the management and circulation of documents;
- ensuring the cooperation and information exchange with the state and local government institutions of the Republic of Latvia and institutions of the European Union;
- ensuring organizational functions and work management of FVS, the establishment, continuation or termination of work or civil service relationship;
- keeping and arranging accounting and financial records;
- concluding deals in the scope of private law necessary for operational activities of FVS;
- preventing or detecting criminal offences relating to the property protection and the protection of the vital interests and health of persons;
- informing the public about FVS activities;
- ensuring other, not mentioned above purposes of data processing.
V Lawfulness of data processing
6. For the purposes of personal data processing, FVS processes personal data on the basis of:
- the competence, duties and official powers specified in regulatory enactments;
- the agreement concluded or the necessary measures prior to the conclusion of the contract;
- public interest;
- the consent of the data subject;
- the legitimate interests of the controller or third parties, except where those interests are not superior to the rights and legitimate interests of the data subject.
VI Personal data recipients
7. Possible categories of recipients of personal data are:
- the State and local government institutions of the Republic of Latvia and/or institutions of European Union in accordance with regulatory enactments, such as the State Revenue Service, the police, the European Commission;
- natural and legal persons, based on the agreement between FVS and that person, or on the basis of the consent of the data subject, such as the insurance undertaking, outsourcing providers. The data processing requirements, conditions and restrictions shall be governed by the agreement concluded between FVS and that person, including the handling of personal data after the termination of the agreement, the duration of the storage of personal data, compliance with technical and organizational requirements;
- natural and legal persons, where the processing of the data is necessary to respect the legitimate interests of third parties, or to fulfil the task carried out in the public interest of that person.
VII Duration of data storage
8. FVS processes personal data only for as long as it is necessary for the processing of personal data. The duration of the storage of personal data is determined on the basis of regulatory enactments, including compliance with the provisions of the Archives Law, or by evaluating the purpose of data processing and the necessity of storage.
9. FVS keeps and processes personal data of data subjects until at least one of the following criteria is met:
- the agreement concluded between FVS and the data subject is in force;
- FVS or the data subject may exercise its legitimate interests (for example, to object or bring an action in court);
- FVS has a legal obligation to keep personal data;
- the data subject’s given consent to the relevant processing of personal data is in force and valid and if there is no other legitimate basis for the data processing.
10. In case no longer fulfils any of the criteria referred to in paragraph 9, data subject’s personal data shall be deleted in accordance with regulatory enactments.
VIII Protection and security of data processing
11. In its activities FVS shall comply with the principles of data processing and protection of personal data and shall implement appropriate technical and organizational measures for data processing in order to ensure the security of data processing.
12. When processing personal data, FVS shall comply with confidentiality requirements and shall not disclose any personal information to third parties without legal basis.
IX Rights of the data subject
13. The data subject has the right to obtain information regarding the processing of personal data and to get acquainted with his or her personal data, as well as to obtain a copy of such data which is in the information circulation of FVS, except where regulatory enactments prohibit disclosure.
14. The data subject has the right to erase, rectify his or her personal data, and to restrict and object to the processing of his or her personal data.
15. The right to erasure personal data shall not be valid if the personal data for which the erasure is requested are processed also on the basis of another legal basis, such as the agreement or the obligations arising from the relevant regulatory acts.
16. In the event that FVS does not respond within the time limits specified in regulatory enactments or does not comply with a substantiated request by the data subject, the data subject is entitled to refer the complaint to the State Data Inspectorate.