1. About us
RB Rail AS, reg. No. 40103845025, legal address: Satekles iela 2B, Rīga, LV-1050, Latvia (hereafter – RB Rail or we/our) task and aim is to implement new railway infrastructure project, which would integrate Baltic countries into the European railway network (hereafter – Project). In order to provide the implementation of Project and coordinate the process, RB Rail is required to process partner’s, independent expert’s, subcontractor’s and other party’s personal data. Meaning that RB Rail function implementation inevitably is associated with personal data collection, structurisation, storage etc. types of personal data processing activities. For example, in order to provide implementation of the Project, public procurement procedures are being organised and, for RB Rail to adequately assess submitted offers, we are required to process personal data which are related to offer submitters and identities of independent experts, their qualification, and contact information etc.
RB Rail informs that according to General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council) (hereinafter – GDPR), RB Rail is a controller in those cases when RB Rail has decided to process personal data – i.e. has determined why and how Your personal data are to be processed. (RB Rail has determined what will be the purpose and the means of personal data processing).
2. Aim of RB Rail privacy policy
The aim of this privacy policy is to inform You in clear and understandable manner about your rights and why RB Rail processes Your personal information, i.e., personal data.
RB Rail explains that personal data are any kind of information that can be used to identify private individual. RB Rail performs any required measure to ensure that Your personal data are safe and their processing are performed according to applicable personal data protection legal acts. RB Rail commits to protect Your personal information from unauthorized access or disclosure, and ensure confidentiality in all processes supervised by RB Rail.
It is important for RB Rail to provide transparency while processing Your personal data, therefore RB Rail hereafter in this privacy policy indicates possible purposes and legal grounds for processing of Your personal data. This privacy policy allows you to learn what kind of Your personal data RB Rail may collect and how RB Rail will use them. Additionally, this privacy policy contains information regarding Your rights and how can you contact RB Rail in order to receive additional information about Your personal data processing and aspects of how You can exercise Your rights.
RB Rail might require updating the privacy policy, however RB Rail homepage www.railbaltica.org/lv will always publish latest privacy policy version, which will be available to everyone.
3. What kind of personal data RB Rail process?
In order to provide RB Rail function implementation, we may require processing Your personal data, for example, Your personal data processing may be conducted for these purposes:
| PURPOSE | PERSONAL DATA CATEGORIES | LEGAL GROUND |
| Communication provision: enquiry, suggestion, complaint and other information collection and processing in order to prepare answers and provide communication with addressee/submitter. Communication may be done through e-mail, mail, phone or in person (largely depends on the method of your communication with RB Rail). | Name, surname, contact information, other personal information included in enquiry, suggestion or complaint. | Data subject`s consent – person actively submits aforementioned information to RB Rail. Legal obligation to which RB Rail is subjected (e.g. response to enquiry of data subject according to requirements set in GDPR). Legitimate interest of RB Rail to provide communication with a person, if there is no relevant legal obligation imposed by legal act. |
| Different document coordination: Mainly, according to laws and regulations, it is necessary to coordinate technical solutions and documents with private individuals during Project implementation. |
Name, surname, contact information, address, data regarding ownership, other personal information related to achievement of certain purpose. | Mainly, Personal data processing is necessary in order for controller (us) to fulfill legal obligations, which are stipulated in laws and regulations related to construction. In certain cases such processing may be justified also with RB Rail legitimate interest. |
| Sanction check: According to International and Republic of Latvia national sanction laws, RB Rail has an obligation to conform and implement international and national sanctions. Additionally it means, that RB Rail needs to conduct background check of its partners to ensure there are no international or national sanctions against certain person. |
Name, surname, birth data, personal identification number and other data which allows to identify certain person. | Personal data processing is necessary in order for controller (us) to fulfill legal obligations, which are stipulated in laws and regulations related sanction implementation and supervision. |
| Record keeping organisation: documentation, inbox and outbox, contract etc. recording and storage. | Documentation, correspondence, contracts which may include personal data, for example, contact information, birth data, name, surname etc. | Depending on documentation type, it can be stored in order to implement RB Rail legitimate interests in court or to conform to legal obligations stipulated in laws and regulations. |
| Seminar, event, hackathon etc.: ensuring of different RB Rail organised or supported events. If the pictures or records are taken during the event, you will be additionally informed. | Depending on event type, application can include certain personal data, for example, name, surname, birth data, contact information, information regarding represented organisation etc. It is possible, that during the event pictures or video recordings may be taken. | Consent of attendee – person actively submits application and agrees to personal data processing. Legitimate interest – informing the public regarding RB Rail operations and RB Rail recognition facilitation. |
| Posts about news: for marketing and publicity purposes there may be posts regarding events, seminars and activities organised or sponsored by RB Rail. Posts are published on RB Rail homepage and/or social networks, for example, Facebook. | Posts prepared by RB Rail may contain pictures, video records, names, surnames etc of event participants and/or visitors. | Legitimate interest – informing the public regarding RB Rail operations and RB Rail recognition facilitation. |
| Contests: for marketing and publicity purposes contests may be organised, results of which are published. | For example, contest participant and/or winner pictures, names, surnames and other information according to contest regulation/rules. | Participant consent when participating in the said contest.Legitimate interest of the RB Rail to review received complaints, if any received regading contests. |
| Commercial announcements in order to inform about our latest news, which are related to our operations. | E-mail, name, surname, data regarding company You represent and Your current position. | Consent – person actively applies for receipt of commercial news. You may at any time unsubscribe from our commercial news at any time, by clicking on the link in the e-mail or writing to us on [email protected]. |
| Video surveillance: RB Rail conducts video surveillance by processing data subject personal data during their time on RB Rail supervised territory or premises in order to prevent and detect crimes against property and preserve evidence. In places, where the video surveillance is being conducted, RB Rail has set up warning signs regarding video surveillance. | Video records. | RB Rail legitimate interests – physical security management, event investigation (including property protection and legal interest protection in court). |
| Procurements: in order to provide RB Rail operations, public procurement is of significant importance because it assists in selection of partners in open, transparent, adequate and indiscriminate way by avoiding conflict of interests, at the same time ensuring efficient use of assets. RB Rail cooperates with product, service and construction work suppliers by conforming to free competition and fair treatment principles. More about our policy here. RB Rail provides electronic access to procurement plans and purchase documents by providing information exchange with suppliers and offer submittal in Electronic procurement system – https://www.eis.gov.lv/EIS/ |
Information about candidates/tendere’s employees (name, surname, work experience, relevant education etc), which proves candidate`s/tenderer’s compliance with procurement suitability requirements. | Fulfilment of legal obligation mentioned in Public procurement law and other laws and regulations related to public procurements. Legitimate interest of RB Rail to ensure performing of different activities related to procurement process, if there is no relevant legal obligation imposed by legal act. |
| For staff management purposes: staff selection process organisation and provision, employment relationship establishment etc. | Please see: Candidate’s Personal Data Privacy Note (https://www.railbaltica.org/about-rail-baltica/candidates-personal-data-privacy-note/) | |
4. To whom Your personal data may be submitted?
Your personal data may be submitted to:
A. Service providers and partners
In order to complete our responsibilities and provide Project implementation and supervision, we may be required to provide information and Your personal data to our partners.
We carefully check all service providers, which process Your personal data on behalf of us. We assess whether partners (personal data processors) use suitable security measures in order to ensure that Your personal data processing would be conducted according to our aims, instructions and applicable laws and regulations. These companies do not have a right to use Your personal data for other purposes except for our defined tasks.
If you require information regarding our partners, please contact RB Rail.
B. Authorities, government, and municipal institutions
In order to abide the law, we may submit Your personal data to authorities (for example, police) as well as to government and municipal institutions by their request. We may also submit your Personal data to authorities (for example, courts) as well as government and municipal institutions in order to protect our legal interests by preparing, submitting and protecting our legal claims.
In addition to aforementioned, we would like to emphasise, that Your personal data are not processed in countries outside European Union or European Economic Area.
5. Which sources do RB Rail obtain personal data from?
There are several ways how RB Rail may obtain Your personal data. The most common are the following:
A. RB Rail may obtain Your personal data directly from You as data subject, for example:
- by receiving and revising Your enquiries, suggestions, applications and complaints;
- with Your consent we collect Your personal data during informative seminars, conferences, discussions, “hackathons” etc.
B. RB Rail may obtain Your personal data from EIS (electronic procurement system), for example:
- by receiving procurement documents submitted in the EIS system by candidate/tenderer.
C. Personal data may be created during different processes, for example:
- personal data are created by performing actions necessary for Project implementation;
- personal data are created when you visit RB Rail premises (during video surveillance);
- personal data are created when you use cookies, when visiting RB Rail AS webpage.
D. Your personal data may be received from our partners, if there is a legitimate purpose and legal grounds, for example:
- in cases, when our partner has indicated You as a contact.
E. Personal data are obtained from public and private registries, for example:
- RB Rail in certain cases can obtain data from public registries or databases, for example, Land Register, Commercial Register, the Natural Persons Register of the Office of Citizenship and Migration Affairs etc.
6. How long are Your personal data stored for?
Personal data are stored until:
- obligations stipulated by laws and regulations are fulfilled (for example, when completing accounting requirement stipulated by law or 10 year procurement document retention term stipulated in Public Procurement Law (Latvia));
- if the processing is conducted based on consent, personal data are processed while consent is valid and not revoked;
- data processing purpose is fulfilled, if the processing is conducted on other legal bases stipulated in the GDPR.
Longer personal data storage time is always allowed to conform to legal obligations imposed by the legal acts binding to RB Rail, for instance, regarding document or information storage minimal duration, or to protect RB Rail legitimate interests, for example, during legal proceedings.
Video surveillance records are stored for no longer than 30 days. Records are instantly deleted chronologically from the moment of record. Certain records can be stored for a longer period of time, if it is necessary for certain purposes, for example, investigation of incidents or crimes.
When there are no more valid purposes to process (incl. retention) personal data, RB Rail will safely delete Your personal data or render them unidentifiable so they could not be connected to You.
7. How will RB Rail protect Your personal data?
RB Rail ensures, regularly revises and improves security measures in order to protect Your personal data from unauthorised access, accidental loss, disclosure, alteration or destruction. In order to implement that, RB Rail uses latest technologies, technical and organisational measures, including, firewalls, antivirus software and encryption.
However, RB Rail recommends You abide general device and internet usage safety rules, as well as Your private data (especially identification document) protection and storage requirements. RB Rail is not responsible for unauthorised access to Your personal data and/or data loss if it occurred because of Your fault or negligence.
In case of Your personal data security incident, if it will cause high risk to Your rights and freedoms, we will inform you immediately, if possible, or information will be published on our website or by any other possible means.
8. Your rights regarding personal data protection
Laws and regulations provide you with several rights on how you can affect processing of Your personal data. In order to implement these rights, please, submit to RB Rail written application: a) in person at RB Rail premises (passport or ID required); or b) sending application with secure electronic signature and time stamp to [email protected].
After receiving application, RB Rail will identify You, that is, ensure, that You are the same person mentioned in application and will respond in 30 days.
As a data subject You are entitled to following rights:
A. Right to access Your personal data
You have a right to request confirmation that RB Rail processes Your personal data. In case of positive answer, You are entitled to request information regarding Your personal data processed.
B. Right to rectify personal data
If you think that Your personal data, which are in RB Rail posession, are incorrect, obsolete or incomplete, You have a right to ask RB Rail to rectify it.
C. Right to revoke consent
Since RB Rail may process Your personal data on basis of your consent, You have a right to revoke Your consent for personal data processing whenever You see fit. In such case RB Rail will cease to process Your personal data for the purpose you gave your consent. Take it into account please, that revocation of consent will not give you right to contest the legality of data processing, which RB Rail has conducted before said revocation.
D. Right to request deletion of personal data
In certain circumstances You are entitled to request RB Rail to delete Your personal data. However, be reminded, that personal data deletion is not possible in cases when personal data processing is stipulated by laws and regulations. When personal data are no longer necessary for certain purpose implementation, RB Rail deletes them or make them unidentifiable by any other means.
E. Right to request personal data processing restriction or object against data processing
In certain circumstances You are entitled to request RB Rail to limit Your personal data processing. However, be reminded, that data processing limitation is not possible in cases when data processing is stipulated by laws and regulations.
F. Right to data portability
In certain circumstances You are entitled to receive Your personal data Yourself or to ask to submit them to other data controller. These rights concern only personal data, which You have submitted to RB Rail based on Your consent or agreement.
G. Right to apply to national Data Protection Authority
We highly value Your privacy and implore you to contact RB Rail, if You have any questions or uncertainties regarding personal data processing. However, if You believe that Your personal data are processed in improper way or You are not satisfied with received answer, You are entitled to turn to national data protection authorities (Latvia – Data State Inspectorate (https://www.dvi.gov.lv/en/contacts-authority); Lithuania – State Data Protection Inspectorate (https://vdai.lrv.lt/en/); Estonia – Data Protection Inspectorate (https://www.aki.ee/en).
9. Who to contact in case You have any questions?
If you have any questions regarding Your personal data processing conducted by RB Rail, please, contact us by using contact details indicated below.
RB Rail contact information:
RB Rail AS
Reg. No. 40103845025
Legal address: Satekles iela 2B, Riga, LV-1050, Latvia
e-mail: [email protected]