Privacy policy

The purpose of this Privacy Policy is to provide natural persons – data subjects – with information about the purposes, scope, protection and storage period of personal data processing, as well as about the rights of data subjects at the time of data collection and processing and when data are transferred to competent authorities or another data controller.

1. Controller and contact details
1.1. The controller of personal data processing is Sia “FRANIKS” (hereinafter – the Controller), registration No. 40003263211, registered office: Latgales iela 240-3, Rīga, LV-1063, phone: +371 27330071, website: https://www.franiks.lv;
1.2. Contact details of the Controller’s data protection specialist for questions related to personal data processing.

2. Applicable legislation
2.1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR);
2.2. Personal Data Processing Law of the Republic of Latvia (promulgated on 4 July 2018).

3. Purposes of personal data processing
3.1. Provision of services:
3.1.1. identification of the client;
3.1.2. preparation and conclusion of contracts;
3.1.3. provision and maintenance of services;
3.1.4. improvement of services and development of new services;
3.1.5. promotion and distribution of services for commercial purposes;
3.1.6. customer service;
3.1.7. examination and handling of objections/claims;
3.1.8. customer retention and improvement of their loyalty, satisfaction measurements;
3.1.9. administration of settlements/payments;
3.1.10. effective cash flow management / recovery and collection of debts;
3.1.11. maintenance and improvement of the website;
3.1.12. ensuring franchise relationships.
3.2. Business planning and analytics:
3.2.1. statistics and business analysis;
3.2.2. planning and accounting;
3.2.3. performance measurement;
3.2.4. ensuring data quality;
3.2.5. market and public opinion research;
3.2.6. preparation of reports;
3.2.7. conducting customer surveys;
3.2.8. risk management within various activities.
3.3. Fulfilment of legal obligations and responding to requests from state authorities.
3.4. Management implemented by the Controller, accounting and ensuring internal processes.
3.5. Record-keeping and data archiving by the Controller.
3.6. Ensuring the functioning of the whistleblowing system.
3.7. Employment relationships and staff recruitment by the Controller.
3.8. Conclusion and performance of the Controller’s commercial contracts.
3.9. Ensuring the safety of the Controller’s clients, visitors and employees and protection of the Controller’s property.
3.10. Protection of the Controller’s rights and interests in state and municipal institutions and representation in court proceedings.
3.11. Video and photo recording and audio recording of events organized by the Controller.
3.12. Other specific purposes about which the data subject is informed at the time when the data are submitted to the Controller.

4. Categories of personal data processed by the Controller
4.1. name, surname, personal identity number or date of birth, correspondence address, declared place of residence, phone number, e-mail address;
4.2. data of an identity document;
4.3. list of received and planned services;
4.4. bank account numbers;
4.5. information related to payment administration;
4.6. information on telephone and electronic communication;
4.7. CV (Curriculum vitae) and description of education and work experience;
4.8. information contained in personnel files, including information about education, dependants, copies of birth, death and marriage certificates, data on employees’ health checks;
4.9. photographs;
4.10. audit logs of workstations;
4.11. audit logs of work e-mail, internet and telephone use;
4.12. video surveillance recordings;
4.13. data on website visits;
4.14. audit logs of access control devices and alarm systems containing data of employees, visitors or subcontractors;
4.15. for the purposes referred to in Section 3, other data provided by the data subject to the Controller may also be processed.

5. Legal grounds for collection and processing of personal data
5.1. consent of the data subject – the data subject has given consent to the collection and processing of data for one or more specific purposes;
5.2. before or after the conclusion of a contract – management of customer relationships (including remotely), ensuring the conclusion and performance of contracts and the implementation of related processes, cooperation with clients and implementation of the related processes;
5.3. legitimate interests of the Controller – to carry out economic activity, to provide services, customer retention, identification of data subjects, customer segmentation for more effective service provision, promotion and development of the Controller’s image and services, prevention of fraud, examination of complaints and provision of support related to the services provided, marketing activities, management of company and financial risks, corporate governance, financial, business and analytical accounting, record-keeping, data archiving, ensuring internal processes, video surveillance for the safety of customers and the Controller, analysis of website audit logs, effective cash flow management, debt administration, administration of customer payments, court proceedings, franchise relationships, health and safety of employees and clients (visitors) and compliance with the applicable legal requirements, as well as other legitimate interests of the Controller that are relevant at the time of data processing;
5.4. legal obligation – fulfilment of requirements laid down in applicable laws and regulations;
5.5. vital interests of the data subject or another natural person – data processing is necessary to protect the vital interests of the data subject or another natural person.

6. Sources of personal data
6.1. documents and information submitted by data subjects;
6.2. data from other controllers, processors and sub-processors;
6.3. data generated during the provision of services;
6.4. data from video and/or photo equipment used by the Controller;
6.5. data from the Controller’s IT network devices;
6.6. data generated by visiting or browsing the Controller’s website https://www.franiks.lv.

7. Personal data processing process
7.1. by identifying the data subject;
7.2. during commercial activity;
7.3. when concluding commercial contracts and monitoring their performance;
7.4. when selecting employees and establishing and maintaining employment relationships;
7.5. when fulfilling legal requirements;
7.6. when participating in court proceedings;
7.7. when providing information to state and municipal institutions and officials and when receiving information from them.

8. Processing of cookies
8.1. Cookies are small text files that are created and stored on the data subject’s device (computer, tablet or mobile phone) when visiting the Controller’s websites. Cookies “remember” the user’s experience and basic information, thereby making the use of the website more convenient;
8.2. by using cookies, information about user habits and website usage history is processed, problems and shortcomings in the operation of the website are diagnosed, statistics on user habits are collected and full and convenient use of the website is ensured;
8.3. if the data subject does not wish to use cookies, it is possible to opt out of their use in the browser settings; however, in this case, the use of the website may be significantly hindered. Saved cookies can be deleted in the browser settings section by clearing the stored cookies history.

9. Data storage period
9.1. until the data storage period specified in the applicable laws and regulations has expired;
9.2. while the contract concluded with the data subject remains in force;
9.3. while the data subject’s consent is valid;
9.4. as long as it is necessary to exercise and protect the Controller’s legitimate interests;
9.5. while there is a legal obligation to store the data;
9.6. after the expiry of any of the above periods, all data are deleted or anonymised in accordance with the procedures established by the Controller.

10. Sharing and disclosure of personal data
10.1. In order to provide services and fulfil work tasks, the Controller may share data subject’s data, including within the European Union and the European Economic Area (EEA);
10.2. by ensuring special data protection as required by the GDPR, the Controller may transfer data to a third country (outside the EEA) or to international organisations, where this is necessary to guarantee the performance of functions and tasks and the operation of the Controller;
10.3. in order to comply with legal requirements, the Controller may share data subject’s data with state and municipal institutions, law enforcement authorities, courts or other institutions;
10.4. the Controller discloses data only to the extent required by applicable laws and regulations, including the GDPR and the Personal Data Processing Law.

11. Protection of personal data
11.1. The Controller protects data subjects’ data against unauthorised access, accidental loss, disclosure or destruction. To achieve this, the Controller uses modern technological solutions, taking into account existing privacy risks and organisational requirements, including firewalls, intrusion detection and analysis software, as well as SSL-encryption and data anonymisation;
11.2. the Controller carefully assesses all processors and sub-processors who process data subjects’ data on its behalf; the Controller evaluates whether appropriate security measures are used, whether data processing is carried out as delegated by the Controller and in compliance with applicable laws and data protection requirements and standards;
11.3. processors and sub-processors are not entitled to process the Controller’s data for their own purposes;
11.4. the Controller is not responsible for any unauthorised access to data subjects’ data or their loss if such events occur outside the Controller’s responsibility, for example due to the data subject’s own fault or negligence.

12. Profiling
12.1. The Controller may take automated decisions in relation to the data subject and may carry out profiling of personal data. The data subject is informed separately about such actions of the Controller in accordance with applicable laws and regulations. The data subject has the right to object to automated decision-making as laid down in the applicable legislation.

13. Rights of the data subject
In accordance with applicable laws and regulations, the data subject has the following rights regarding the processing of his or her personal data:
13.1. right of access – the data subject has the right to request confirmation from the Controller as to whether the data subject’s personal data are being processed, as well as information on all personal data being processed;
13.2. right to rectification – if the data subject considers that information held about him or her is incorrect or incomplete, the data subject has the right to request its correction;
13.3. right to object to processing based on legitimate interests – the data subject has the right to object to the processing of personal data that is carried out on the basis of the Controller’s legitimate interests, except where laws and regulations require such processing;
13.4. right to erasure – in certain cases the data subject has the right to request the erasure of personal data, except where laws and regulations require a specific retention period;
13.5. right to restriction of processing – in certain cases the data subject has the right to restrict the processing of his or her personal data, except where laws and regulations determine the scope of processing;
13.6. right to data portability – the data subject has the right to receive or transfer his or her personal data to another controller. This right applies only to personal data provided to the Controller with the data subject’s consent, on the basis of a contract or where the processing is carried out by automated means. The data subject may exercise this right to the extent that the Controller does not carry out processing for the fulfilment of legal obligations imposed by applicable laws;
13.7. right to withdraw consent – the data subject has the right to withdraw consent for data processing at any time in the same manner in which it was given or by sending a relevant notice to e-mail: info@franiks.lv. In such a case, data processing based on the previously given consent for the specific purpose will no longer be performed. Withdrawal of consent does not affect processing carried out while the consent was valid. Withdrawal of consent does not stop data processing carried out by the Controller on other legal grounds.
To exercise the above rights, a written request must be submitted to the Controller or the data protection specialist.

14. Other provisions
14.1. The Controller’s websites may contain links to third-party websites which have their own terms of use and rules on personal data protection, for which the Controller is not responsible.

15. Communication
15.1. In case of questions or uncertainties, the data subject may contact the Controller in person at the office: Buļļu iela 45, Rīga, LV-1067;
15.2. the Controller communicates with the data subject using the contact details indicated by the data subject (telephone number, e-mail address, correspondence address).
If the data subject is not satisfied with the response received, he or she has the right to lodge a complaint with the Data State Inspectorate (https://www.dvi.gov.lv/lv/).
The Controller is entitled to regularly improve or supplement this Privacy Policy. The Controller will inform data subjects of any changes by publishing the current version of the Privacy Policy on the website https://www.franiks.lv