Privacy Policy of the Latvian National Centre of Culture
This privacy policy defines the general procedure for processing personal data, within which the Latvian National Centre of Culture ensures fair and lawful processing of personal data.
This privacy policy defines the procedure for processing personal data. It defines the minimum requirements and principles for processing and protecting personal data, as well as the rights of the data subject and the procedure for exercising these rights at the Latvian National Centre of Culture.
Latvian National Centre of Culture shall obtain personal data from data subjects, from third parties, as well as from the State administrative and local government institutions of the Republic of Latvia, including from public registers.
- Controller and its contact details
- 1. Controller of personal data processing is Latvian National Centre of Culture (hereinafter referred to as Controller), unified registration number 90000049726, legal address: Zigfrīda Annas Meierovica bulvāris 14–7, Riga, LV-1050, telephone: +371 67228985, website: https://www.lnkc.gov.lv/, e-mail: lnkc@lnkc.gov.lv_.
- Controller data protection specialists is Raivis Kapteinis-Miezeris, phone: +371 67228985, e-mail: Raivis Kapteinis-Miezeris@lnkc.gov.lv and Linda Roze, phone: +371 67228985, e-mail: Linda.Roze@lnkc.gov.lv.
- Applicable law
2.1. Regulation № 2016/679 of the European Parliament and the Council on the protection of individuals against the processing of personal data and on the free transfer of such data (April 27, 2016) (hereinafter – GDPR).
2.2. Law on the processing of personal data (announced on July 4, 2018).
2.3. Decree of the Cabinet of Ministers № 442 от 28 July 2015. "Procedures for ensuring the compliance of information-communication technologies with minimal security requirements." - Purpose and tasks of processing personal data
The purpose and tasks of processing personal data are set out in the register of processing personal data. When requesting personal data, the controller's employees provide the data subject with clear and understandable information about the purpose, type, basis of processing, data retention period, as well as about the rights of the data subject and the procedure for their implementation. - Data retention time
The Controller processes personal data only as long as it is necessary to achieve the purpose of processing personal data. The retention period of personal data is determined on the basis of normative acts regulating the management of documents and archives, or by evaluating the purpose of data processing and the need for their storage. The procedure for storing, issuing and destroying documents is governed by the internal rules of the Controller. - Data subject rights
5.1. In accordance with applicable legal acts, the data subject has the following rights regarding the processing of their personal data:
5.1.1. Right of access – the data subject has the right to request confirmation from the Controller whether their personal data is being processed, as well as to request information regarding all personal data being processed.
5.1.2. Right to rectification – if the data subject believes that information about them is incorrect or incomplete, they have the right to request that the Controller correct it.
5.1.3. Objection to processing based on legitimate interests – the data subject has the right to object to the processing of personal data based on the Controller's legitimate interests, except in cases where legal acts mandate such processing.
5.1.4. Deletion — under certain circumstances, the data subject has the right to request the deletion of their personal data, except in cases where legal acts prescribe a retention period for such data.
5.1.5. Restriction of processing – under certain circumstances, the data subject has the right to restrict the processing of their personal data, except in cases where legal acts determine the scope of data processing.
5.1.6. Withdrawal of consent: if the processing of the data subject's personal data is based on the data subject's consent, the data subject has the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
5.1.7. Data portability – if processing is based on the data subject's consent or contractual obligations, and if such processing is carried out by automated means, the data subject may request the Controller to provide the personal data concerning them in a structured, commonly used, and machine-readable format, so that the data subject may transmit such personal data to another controller or have it transmitted directly to another controller, where technically feasible.
5.1.8. Complaint – the data subject has the right to submit a complaint to the State Inspection for Data Protection.
5.1.9. Receipt of compensation – the data subject has the right to receive compensation for damage that may have been caused to him as a result of data processing that violates the Regulation and this privacy policy. - Data processing principles
6.1. Personal data processing is carried out in a fair, lawful, and transparent manner regarding the data subject, and only for the intended purpose and to the extent necessary for that purpose.
6.2. Personal data is stored in a manner that allows the data subject to be identified for a period not exceeding the timeframe established for the intended purpose of data processing.
6.3. Personal data is accurate and, where necessary, kept up to date; the controller takes reasonable steps to ensure that inaccurate personal data – having regard to the purposes for which they are processed – are erased or rectified without delay.
6.4. Personal data is stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed, unless otherwise provided by regulatory enactments.
6.5. Personal data is processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures. - Legal bases for personal data processing
7.1. Data subject's consent – the data subject has personally given consent for the collection and processing of data.
7.2. Before or after the conclusion of a contract – data processing is necessary to conclude the relevant contract. This legal basis applies to data processing where a contract with the data subject is intended to be concluded and the processing of the relevant personal data arises directly from the performance of contractual obligations.
7.3. Public interest – for example, audio, visual, and audiovisual recording for the preservation and development of intangible cultural heritage.
7.4. Legitimate interests of the Controller – provision of services; identification of data subjects; management, accounting, records management, archiving, and ensuring internal processes of the Controller; handling complaints and providing support regarding services provided; legal proceedings, etc.
7.5. Legal basis – applicable regulatory enactments, including but not limited to the State Administration Structure Law and Cabinet of Ministers Regulations No. 931 of 18 December 2012, "Regulations of the Latvian National Centre of Culture". - Processing of special categories of personal data
The Controller applies specific security measures to protect information constituting special categories of personal data (for example, by strictly limiting access to such information). Special protection measures are implemented for the processing of special categories (sensitive) of data. - Confidentiality
9.1. The Controller’s employees process personal data only within the scope of their direct work duties and only to the extent necessary for the performance of such duties; they must not use the data for other, particularly private, purposes.
9.2. Personal data must not be disclosed or transferred to other persons unless the Controller is authorized to transfer such data in accordance with the legal framework and this Privacy Policy.
9.3. Within the scope of their direct duties, personal data may be transferred only to a cooperation partner who processes personal data on behalf of the Controller based on a written agreement. In such cases, personal data may be transferred only to the extent and for the purposes specified in the written agreement, provided that the agreement contains data processing and protection requirements in compliance with the Regulation.
9.4. The Controller’s employees who have permanent or regular access to personal data receive regular training on all essential aspects of data protection; such training is also provided prior to the granting of access rights. - Personal data security requirements
10.1. When handling data, particularly personal data, the Controller has implemented appropriate technical and organisational measures suited to data protection needs. These measures are defined by the Controller’s IT security policy and must be observed by all employees and cooperation partners who process personal data on behalf of the Controller.
10.2. An employee of the Controller who processes personal data must report potential threats to data security (floods, lightning, fire, power supply disruptions, computer equipment failure, temperature and humidity fluctuations, dust, theft, software errors, etc.) to the data protection officer. The Controller implements a set of measures to mitigate potential consequences, acting in accordance with the instructions of the data protection officer. - Transfer of personal data
The Controller may transfer personal data to third parties in cases prescribed by regulatory enactments or upon receiving the data subject's consent. - Processing of data subject cookies
12.1. Cookies are small text files created and stored on the data subject's device (computer, tablet, or mobile phone) when visiting the Controller's websites. Cookies "remember" the user's experience and basic information, thereby improving the usability of the website.
12.2. Cookies are used to process general user habits and website usage history, diagnose issues and shortcomings in the website's operation, collect statistics on user habits, and ensure the full and convenient functionality of the website.
12.3. If the data subject does not wish to use cookies, they may adjust their browser settings accordingly; however, doing so may significantly hinder the use of the website. Stored cookies can be deleted via the device's browser settings by clearing the cookie history. - Contact Information
If the data subject has any questions or concerns, they may contact the Controller at: Zigfrīda Annas Meierovica bulvāris 14-7, Riga, LV-1050, or contact the personal data protection specialists: Raivis Kapteinis-Miezeris (phone: +371 67228985, e-mail: Raivis.Kapteinis-Miezeris@lnkc.gov.lv) and Linda Roze (phone: +371 67228985, e-mail: Linda.Roze@lnkc.gov.lv).
If the data subject is not satisfied with the response received, they have the right to lodge a complaint with the State Data Inspectorate (www.dvi.gov.lv).
The Controller reserves the right to regularly update or amend the privacy policy. The Controller will inform the data subject of any changes by publishing the current version of the privacy policy on the website https://www.lnkc.gov.lv/.