Privacy Policy

This is the Privacy Policy of AS KALCEKS (hereinafter “Kalceks”).

Its purpose is to explain to data subjects how Kalceks processes personal data, to communicate in a transparent manner the procedures and measures for the exercise of data subjects’ rights, and to describe other issues related to the protection of personal data. It is also designed to ensure that data subjects can exercise their statutory rights in a simple, accessible and comprehensible way. As the personal data protection legislation sets a general goal to ensure the privacy of individuals and the only way to ensure the fulfilment of this goal is to make the protection of personal data an integral part of the activities of private and public entities, Kalceks ensures that all personal data are adequately protected and safe. Adequate protection is the use of the necessary technical and organizational means and the processing of personal data in accordance with the regulatory framework.

The Privacy Policy is developed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter “GDPR”), as well as Personal Data Processing Law and other regulatory enactments that regulate the issues of personal data processing.

The terms used in this Privacy Policy and their meaning are the same as in the definitions in Article 4 of the GDPR.

Kalceks encourages all data subjects from time to time to carefully read this Privacy Policy in order to obtain up-to-date information on the personal data processing processes performed by Kalceks, as they may change over time.

For information on the processing of personal data in connection with cookies on the Kalceks website, please see our Cookie Policy.

Controller

The controller of your personal data is akciju sabiedrība “Kalceks”, registration number 40003988264, legal address Krustpils Street 71E, Riga, LV-1057, Latvia.

Kalceks contact information for issues related to personal data processing is: [email protected], as well as Krustpils Street 71E, Riga, LV-1057, Latvia.

Categories of personal data

For the various purposes, Kalceks processes mainly the following categories of personal data:

In order to ensure its internal personnel management processes, Kalceks processes mainly the following categories of personal data of Kalceks employees:

In any case, Kalceks will process your data only if the processing of this personal data has a clear purpose and is based on one (or several) legal grounds.

How Kalceks obtains personal data

Kalceks obtains your personal data mainly in the following ways:

You personally submit personal data for processing, in other cases also by consenting to the processing of such personal data (for example, by visiting Kalceks website, asking questions or otherwise contacting Kalceks using the communication tool provided on the website, or by writing to e-mail addresses managed by Kalceks or Kalceks employees, as well as by using the services provided by Kalceks in any other way, including by visiting Kalceks office);

In the event that you provide us with personal data at your free choice, please take into account the purpose of the relevant personal data submission and consider the amount of personal data required and to be transferred to achieve this purpose. Kalceks requests that personal data be provided only to the extent necessary for the purpose of the respective letter, request or question, and in particular requests not to provide personal identification number, health and other special (confidential) data, financial data, other excessive or irrelevant personal data not applicable to the respective issue.

In certain cases, personal data may be obtained by Kalceks also from other entities, such as other legal or natural persons (for example, by concluding an agreement with a Kalceks partner who identifies you as a contact person), as well as from information contained in various public registers, as well as received from public authorities, including courts and law enforcement institutions. Kalceks may use also publicly available information, which may contain personal data, as well as obtain information from video surveillance recordings;

Purposes of personal data processing

Kalceks processes your personal data mainly for the following purposes:

Processing of personal data in the framework of direct marketing

Kalceks can also process your personal data as part of direct marketing. As part of direct marketing, Kalceks can send you by e-mail:

invitations to participate in various surveys, interviews, etc.;
invitations to various events;
invitations to fill in feedback forms, etc.;
information about news, Kalceks offers, etc.

At the same time, Kalceks calls to take into account that Kalceks will process your personal data in the framework of direct marketing only in two cases:

if your consent has been obtained (i.e. you have signed up to receive direct marketing communications and thereby provided your personal data (e-mail, name, surname) – the so-called “opt-in” principle), or
if you are already Kalceks customer, who has not explicitly objected to the processing of your previously provided personal data (e-mail, name, surname) for receiving direct marketing communications for similar services offered by Kalceks (i.e. Kalceks will use your e-mail address in this case previously obtained from you in the course of business – the so-called “soft opt-in” principle).

Kalceks also calls to take into account that you can opt out of receiving direct marketing messages at any time. This can be done in the following ways:

by selecting the appropriate free option in the relevant message received from Kalceks (“to unsubscribe”)
by writing to: [email protected] or Krustpils Street 71E, Riga, LV-1057, Latvia.

Processing of personal data in personnel selection

Kalceks can process your personal data to ensure the employee selection process and to realize the rights and obligations arising from it. Within the framework of this purpose, Kalceks collects CVs (description of professional life history) and accompanying documents from applicants, communicates with applicants and feedback providers indicated by applicants in order to collect feedback, with the consent of the applicant, saves CVs for other competitions, as well as to be able to defend their interests in legal proceedings, saves data to respond to claims and initiated cases in courts.

For this purpose, Kalceks may need at least the following personal data: applicant’s name, surname, contact information (e-mail, phone number), applicant’s education and previous work experience, persons who can provide feedback and their contact information, feedback about the applicant, as well as other information that could be essential for the performance of the relevant position and for identifying the most suitable applicant.

Kalceks will keep your CV and attached documents submitted for a specific job vacancy until the end of the competition, as well as for at least 6 months after that, in order to protect against possible claims and legal proceedings. On the other hand, if you have submitted your CV and the documents attached to it without addressing it to a specific job vacancy or have given your consent to use the CV and the documents attached to it for later selections, Kalceks will keep your CV and the documents attached to it for 1 year. You always have the right to withdraw your consent to the storage of such data.

If an employment contract is concluded with you, the CV and accompanying documents may be added to your employee’s file, if necessary, and kept for the entire duration of the employment contract.

Legal basis

Kalceks processes personal data mainly on the following legal bases:

Protection of personal data

As a data controller, Kalceks ensures:

the confidentiality of personal data, ensuring that personal data are processed (including accessed) only by those persons who need it for the performance of their official duties. Kalceks’s representatives, who handle information containing personal data in the course of their daily work, are trained in personal data protection measures and are contractually committed to confidentiality.
the appropriate technical and organizational measures for the protection of personal data. Such measures include, as far as possible and considering the state of the art, implementation costs and the nature, scale, context and purposes of the processing, as well as risks of varying probability and severity regarding the rights and freedoms of individuals, the pseudonymisation of personal data, the minimization of personal data, physical and logical data protection measures in the work environment, as well as making backups, etc.
only tested, licensed and updated software.
data security, including the following technical solutions: data encryption (SSL), firewalls, intrusion protection and detection software.
involvement of certified personal data protection specialists in the processing of personal data and implementation of personal data protection measures.

Kalceks also regularly reviews, updates and improves its technical and organizational measures.

Categories of recipients of personal data

Kalceks shall not transfer personal data to third parties unless there is a legal basis for such processing and the purpose of the processing is not predetermined, and if those third parties, taking into account the nature, scale, context and purposes of the processing and the varying degrees of probability and severity risks to the rights and freedoms of natural persons, are unable to provide, in a transparent manner, appropriate technical and organizational measures to ensure and demonstrate that the processing of personal data is in accordance with law and/ or cannot provide reasonable assurance that the security of personal data processing and respect for the rights of data subjects will be ensured.

Personal data may be transferred for various purposes of personal data processing:

to Kalceks’s employees, officials or specially authorized persons who need it for the performance of work or official duties (for example, Kalceks personnel specialists, board members);
to the holder of Kalceks shares;
to local government institutions, courts, law enforcement institutions, state institutions upon a reasoned request of these persons in accordance with the procedures and in the amount specified by law (for example, the State Revenue Service, the police, the prosecutor’s office);
to the processors of personal data by concluding relevant data processing agreements (for example, to the partners of Kalceks that provide various services related to the operation of information systems (cloud computing services, monitoring and operation of systems, security of information systems));
in some cases also to cooperation partners (for example, sworn advocates, auditors, accountants) who are involved in the organization and provision of Kalceks operation.

Transfer of personal data to third countries

Kalceks does not transfer personal data to third parties outside the European Economic Area. At the same time, if there is an exceptional need to transfer personal data outside the European Economic Area, Kalceks applies the mechanisms set out in Chapter V of GDPR.

Duration of retention of personal data

Kalceks takes into account the following principles when determining the retention period of personal data:

the validity of the agreement concluded between Kalceks and the data subject;
the need for the data for the purpose for which they were received;
deadlines specified in external regulatory enactments regarding the possibility for Kalceks or the data subject to realize their legitimate interests (for example, in order to prove the fulfillment of our obligations, we will keep personal data for the general limitation period provided for claims in accordance with regulatory enactments – 10 (ten) years as per Civil Law, 3 (three) years as per Commercial Law and other terms, taking into consideration also the terms for bringing actions specified in the Civil Procedure Law);
legal obligations to store data specified in external regulatory enactments (for example, the Accounting Law stipulates that source documents must be kept until the day when they are necessary to establish the beginning of each economic transaction and trace its progress, but not less than 5 (five) years).

Audit records are kept for at least 18 (eighteen) months from the date of their performance.

Upon termination of the above circumstances, personal data shall be permanently deleted, including backups of such data.

Retention period of personal data in personnel selection:

Documents received for the specific vacancy are kept for 6 (six) months after filling the respective vacancy;
Documents received for an indefinite vacancy are kept for 1 year after receipt.

Automated data processing

In the process of data processing, Kalceks does not perform automated processing of personal data, within the framework of which legally binding decisions are made for you.

Rights of data subjects

Obligation to provide information

Kalceks complies with the requirements of Articles 13 and 14 of the GDPR and proactively provides the information provided for in these Articles to data subjects.

Right of access (Article 15 of the GDPR)

Kalceks ensures that data subjects receive information about the personal data processing process that applies to them. At the request of the data subject, Kalceks shall provide access to the personal data of the data subject in accordance with the procedures specified in regulatory enactments.

Right to rectification of personal data (Article 16 of the GDPR)

Kalceks ensures that inaccurate personal data of the data subject are corrected in accordance with the procedures specified in regulatory enactments, without undue delay. Taking into account the purposes of processing, the data subject has the right, when submitting the application, to request that incomplete personal data be supplemented.

Right to erasure (‘right to be forgotten’) (Article 17 of the GDPR),

Kalceks ensures that, at the request of the data subject, personal data relating to that data subject are deleted in accordance with the requirements of Article 17 of the VDAR. Kalceks shall inform the data subject of the erasure of personal data, unless such information would be disproportionate or impossible.

Right to restriction of processing (Article 18 of the GDPR),

Kalceks ensures that the processing of personal data of the data subject is restricted if the criteria specified in Article 18(1) of the GDPR are met. Where processing is restricted in accordance with paragraph 1, such personal data, with the exception of storage, shall be processed only with the consent of the data subject or for the purpose of establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or Latvia.

Right to receive information on the rectification, erasure or processing of personal data (Article 19 of the GDPR),

Kalceks shall notify each recipient to whom personal data have been disclosed of any rectification or erasure of personal data or restriction of processing carried out in accordance with Articles 16, 17(1) and 18, unless it appears that this is not possible, or if it involves a disproportionate effort. Kalceks shall inform the data subject of those recipients if the data subject so requests.

Right to data portability (Article 20 of the GDPR),

Kalceks ensures the portability of personal data of the data subject in accordance with the criteria of Article 20 of the GDPR. Kalceks ensures the transfer of personal data to another controller, if technically possible.

Right to object (Article 21 of the GDPR),

The data subject has the right to object to the processing of personal data in accordance with the criteria of Article 21 of the GDPR. Upon receipt of an objection to the processing of data from the data subject in accordance with Article 21 of the GDPR, Kalceks shall no longer process the data, unless it is possible to indicate compelling legitimate reasons for processing that are more important than the interests, rights and freedoms of the data subject or where necessary for the establishment, exercise or defence of legal claims defend legitimate claims.

Automated individual decision-making, including profiling (Article 22 of the GDPR),

Kalceks ensures that the data subject has the right not to be the subject of a decision that is based solely on automated processing, including profiling, which has legal effects on the data subject or which similarly has a significant effect on the data subject.

Right to lodge a complaint with a supervisory authority

The compliance of physical data processing measures with the regulatory enactment in Latvia is monitored by the Data State Inspectorate. If you believe that the processing of your personal data is not in accordance with the requirements of regulatory enactments, you have the right to file a complaint with the Data State Inspectorate. The address of the Data State Inspectorate is Elijas Street 17, Riga, LV-1050. Detailed information is available on the website www.dvi.gov.lv, or by calling 67 22 31 31, or by writing to [email protected].

The right to withdraw consent,

If the processing of your personal data is based on your consent, you have the right to withdraw it at any time and we will no longer process your personal data, which we processed on the basis of consent, for the relevant purpose. However, we inform you that the withdrawal of consent cannot affect the processing of such personal data, which is necessary to fulfill the requirements of regulatory enactments or which is based on a contract, our legitimate interests or other grounds for legal data processing established in regulatory enactments.

You can exercise all the above rights by sending a request and contacting Kalceks by e-mail [email protected] or by writing to the legal address: Krustpils Street 71E, Riga, LV-1057. For your convenience, the website www.kalceks.lv has a data subject request form for preparing a request.

Upon receiving your request, Kalceks will evaluate its content and the possibility of your identification, and depending on the relevant situation, you may additionally be asked to identify yourself in order to ensure the security and disclosure of your data to the relevant person. In the case of receiving your request, Kalceks will respond to it within the terms specified in the regulatory acts (usually no later than within one month, if there is no special request that requires a longer time to prepare the response).

Kalceks encourages to contact us before submitting a formal complaint so that to find the quickest and most effective solution to the problem.

Disclaimer

Kalceks has the unilateral right to amend and/ or supplement this Privacy Policy. The current version of the Privacy Policy is always published on https://kalceks.lv/kalceks-privatuma-politika/. Kalceks maintains previous versions of the Privacy Policy and these are available on the above site.

Data subject request form (.docx)

No.	Data category	Examples of data belonging to a data category
1.	Identification data	Name, surname, personal identification number, year of birth, gender
2.	Information on position	Job title, position
3.	Contact information	Phone number, e-mail, address
4.	Information that is processed in the event of a visit to the Kalceks website	IP address, network and location data, as well as other information that you agree to process as part of your visit to the Website; for detailed information on the processing of personal data by cookies, please consult the Kalceks Cookie Policy.
5.	Other information	Information you provide to us for the purpose of the relevant letter, request or question, such as any other information contained in your CV and application letter, application or other document.
6.	Information obtained from video surveillance	Digital image, posture, gait, other information shown in the image, time of arrival, time of departure

No.	Data category	Examples of data belonging to a data category
1.	Identification data	Name, surname, personal identification code, date of birth, gender, photo
2.	Contact information	Address, place of residence, telephone number, e-mail
3.	Professional information	Position, role, qualifications, education, experience, other information provided in the CV, content of the job application and training information (eg information in the application letter and CV, language skills and other relevant skills, etc.)
4.	Financial information	Remuneration, allowances, information on dependents, tax and social security contributions
5.	Information related to the employment relationship	Information on compulsory health examinations, occupational diseases, absence (justified and unjustified), trade union membership (before termination of employment), assessment information, fact of possible violation, description, justification, explanations, information provided by third parties about the employee, fact on decision-making, decision-making date, number, essence. Information related to the organization of employee training (type, scope, amount, date, result).
6.	Information obtained from video surveillance	Digital image, posture, gait, other information shown in the image, time of arrival, time of departure
7.	Social networking information	Information on social networks (e.g. likedin.com, facebook.com), including images

No.	Purpose	Explanation
1.	For the provision of services (for the implementation of commercial activities)	Fulfilment of contractual obligations with customers;Provision/ maintenance of services;Improvement of services, development of new services;Service;Reviewing applications;Complaints handling;Direct marketing activities
2.	For ensuring security and interests of Kalceks and third parties	Information securityInformation system security Protection of legal interests
3.	For provision of information	To public administration institutions, courts, law enforcement institutions in accordance with the procedures and to the extent specified in external regulatory enactments
4.	For ensuring personnel management processes and corporate culture of Kalceks	Personnel selectionConclusion and performance of an employment contractAccounting of working timeEnsuring the calculation of wages and the performance of wagesCompliance with accounting requirementsEnsuring social benefits for employeesRecording, evaluating and controlling the performance of work dutiesCorporate culture

No.	Legal basis	Explanation
1.	Conclusion and performance of the agreement	Data processing carried out in order to conclude an agreement between Kalceks and you and to perform this agreement,
2.	Compliance with the provisions of regulatory enactments	Data processing, which is performed in connection with the fulfilment of the obligations specified in various regulatory enactments applicable to Kalceks
3.	Kalceks legitimate interests	Data processing carried out in order to safeguard the legitimate interests of Kalceks as controller, such as:Conducting business and providing servicesIdentifying data subjects (e.g. in case of data request)Eliminating business risks (e.g. various risks related to the actions of third parties or users)Preventing security risks (e.g. various risks related to personal data security risks from third parties)Analysing service delivery with a view to developing and improving it (e.g. making service delivery more efficient and convenient)Preventing fraudulent and other illegal activities and protecting Kalceks from the negative consequences of such activities (for example, preventing criminal offenses)Monitoring the provision of services to prevent technical problems (e.g. ensuring the provision of quality services without technical disruption)Ensuring corporate governance and accountingProtecting your legal interests, including through state, local and judicial authorities, as well as law enforcement agencies (for example, preventing, detecting and limiting illegal expressions by third parties)Informing the public about its activities, including through advertising
4.	Your consent	Processing of data with your consent, which is expressed as active operation, including by contacting us and providing your personal data or performing other active operations. * If the processing of your personal data is based on your consent, you have the right to withdraw it at any time and Kalceks will no longer process your personal data processed on the basis of the consent for that purpose. At the same time, the withdrawal of consent may not affect the processing of personal data which is necessary for the fulfilment of the requirements of regulatory enactments or which is based on a contract, legitimate interests of Kalceks or other grounds specified in regulatory enactments for lawful data processing.