Privacy Policy

This privacy policy provides the information required under the EU General Data Protection Regulation (EU) 2016/679 (the ‘Regulation’) on how we process personal data when you use our website.

The data controller, which determines the purposes and means of processing your personal data, is SIA Alwark (registration number 43603039779, address: Apogu iela 5, ‘Atpūta’, Svēte Parish, Jelgava Municipality, Latvia, LV-3008, phone +371 67146732, email [email protected]).

Please read this privacy policy carefully. It applies to individuals who buy goods through our website, contact our company or provide personal data in any other way. The content may change in the future, so please check the current version regularly.

Terms used in this privacy policy have the meaning given to them in the Regulation.

This policy covers the following processing purposes: (i) concluding and performing contracts with individuals; (ii) running the loyalty programme, sending newsletters and other direct marketing; (iii) managing the personal data of job candidates and the candidate database; (iv) handling complaints, requests and orders; (v) communication by email; (vi) use of cookies; (vii) use of social networks; (viii) video surveillance. It also describes your rights as a data subject, the recipients of your data and other processing terms that apply to all of the purposes listed above.

Concluding and performing contracts with individuals

To conclude and perform a contract, we process the data you provide when signing it and the data we receive from you while performing it. This includes information about the goods you buy and payment details. If you do not provide your personal data, we cannot identify you or conclude a contract with you.

The legal basis for this processing is the performance of a contract, or steps taken at your request before entering into a contract. Some processing may also be based on our legal obligations, for example compliance with tax legislation.

We keep your personal data for no longer than 10 years after the contract ends.

Newsletters and other direct marketing

If you are our customer, subscribe to our newsletter on our website or otherwise ask to receive direct marketing, we use the personal data you provide, including your email address and phone number. We use it to send you information about our goods and services, news, promotions, events and other marketing content.

We send direct marketing to your email address without your consent only if you are our customer. In that case, we rely on the rights granted by law.

We process your personal data for direct marketing for 5 years after you give consent or after our relationship ends.

Every email we send gives you the option to unsubscribe. You can also unsubscribe or withdraw your consent by contacting us at the details above.

Recruitment and the candidate database

If you send us your CV, cover letter, references or other documents in response to a vacancy published on our website or on a recruitment portal, we process the data you provide, and the other data described below, for recruitment purposes.

We process your personal data until the selection ends, meaning until we hire a candidate, the candidate’s probation period ends, or we close the selection without hiring. This period should not exceed 4 months. When the selection ends, we delete your data unless you agree to let us keep it for future vacancies. If you agree, we keep your data for [CONFIRM: 6 or 3] years and contact you if a suitable position opens.

We process your data on the basis of your consent to take part in the selection and to further storage. Some processing may be based on our legal rights and obligations. Providing your data is voluntary. Without it, however, we cannot assess your application. If you do not consent to storage after the selection ends, we cannot offer you future positions unless you apply again.

Under data protection law, we may contact your previous employers and ask for their view of your qualifications, professional skills and personal qualities. We will not contact your current employer without your prior consent.

Handling complaints, requests and orders

If you submit a complaint, claim, request or order by email, in writing or by other means, we process the data you provide to handle it.

If your complaint or claim relates to a potential dispute or possible damages, or if an order results in a contractual relationship, we may keep your data for up to 10 years. If the data is not linked to a potential dispute, we delete it sooner, once it is no longer needed for its purpose.

The legal basis is your consent. In some cases, the law may require us to keep a complaint for longer.

Communication by email

Under the Regulation, the content of email correspondence counts as personal data, even when the correspondents are employees of legal entities. The Regulation’s mandatory rules therefore apply to email content and email addresses.

The legal basis for this processing is your consent, expressed when you choose to write to us and share information. It may also be the performance of a contract or a legal obligation.

We process your email address, correspondence and related data proportionately. The people you write to see this data first. In some cases, other employees may read your correspondence, for example for internal administration, to prevent breaches of law or internal rules, or when covering for an absent colleague.

Cookies

A cookie is a small file of letters and numbers that is stored in your browser or on your computer’s hard drive. Different cookies serve different purposes. Cookies help us distinguish you from other users, make the website easier to use and improve it.

Most browsers let you block all cookies, and some let you block cookies from specific parties. Please note that blocking all cookies will affect how the website works, and you will not be able to use all of its services.

Our website uses the following cookies:

Performance (session) cookies. These improve how the website works and collect general, anonymous information about its use.

Analytics cookies (Google Analytics). These let us recognise and count visitors and see how they move around the website. This helps us improve the site, for example by making it easier to find what you are looking for. We process data collected by these cookies on the basis of your consent.

Functional cookies. These recognise visitors when they return to the website. They let us show relevant content on social networks and remember information that matters to you. We process data collected by these cookies on the basis of your consent.

Cookie name Category Purpose Expiry
_gat_gtag_UA_9581336_1 Analytics Distinguishes users Session
_gid Analytics Distinguishes users 24 hours
_ga Analytics Distinguishes users 2 years

Managing and deleting cookies

Most browsers accept cookies automatically. Once you know how and why cookies are used, you can decide whether to keep them or switch them off. Most browsers let you manage cookies in their settings. You can set your browser to reject all cookies or to warn you when a cookie is set. For more information, visit http://www.allaboutcookies.org/manage-cookies/.

If you reject cookies, some features may not work. Besides our own cookies, certain third parties may be allowed to set and access cookies on your device through our website. Their own privacy policies govern those cookies.

Social networks

The operator of each social network controls all information you share through it, including posts, ‘Like’ and ‘Follow’ actions and other communication.

We currently have an account on Facebook. Its privacy policy is available at https://www.facebook.com/privacy/explanation.

We recommend that you read third-party privacy notices and contact those providers directly with any questions about how they use your personal data.

Video surveillance

We use video surveillance on our premises (at the entrance) and on our grounds (outdoor storage area) to protect property and people. The legal basis is our legitimate interest. We keep recordings for 14 days.

Recipients of personal data

We may disclose your personal data to:

  • providers of IT, server, email, archiving, marketing, accounting, postal and courier services;
  • notaries, bailiffs, lawyers, consultants, auditors and debt collection companies;
  • law enforcement and supervisory authorities, courts and other dispute resolution bodies;
  • potential or existing acquirers of our business or part of it, and their authorised advisers or representatives.

Our data protection principles

When we collect and use personal data that you provide or that we receive from other sources, we follow these principles:

  • we process your data lawfully, fairly and transparently (lawfulness, fairness and transparency);
  • we collect your data for specified, explicit and legitimate purposes and do not use it in ways incompatible with them (purpose limitation);
  • your data is adequate, relevant and limited to what is necessary for those purposes (data minimisation);
  • your data is accurate and, where necessary, kept up to date (accuracy);
  • we keep your data in a form that identifies you for no longer than the purposes require (storage limitation);
  • we apply technical and organisational measures to keep your data secure, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage (integrity and confidentiality).

Your rights as a data subject

You have the right to access your data and information on how we process it; to request correction of inaccurate data or, depending on the purpose, completion of incomplete data; to request erasure of your data or suspension of its processing (except storage); to request restriction of processing; to data portability; to lodge a complaint with the Data State Inspectorate (Datu valsts inspekcija); and to withdraw consent and object to processing.

To exercise your rights, we must verify your identity. If we cannot verify it, we cannot confirm that the request comes from the data subject and therefore cannot act on it.

We may refuse a request, or charge a reasonable fee, if it is manifestly unfounded or excessive, or in other cases provided by law.

To exercise your rights or ask any other question about how we process your personal data, contact us at [email protected] or write to the company address given at the start of this policy.


Problems in the source to fix before publishing

  1. Retention contradiction (recruitment). The source says it keeps candidate data for 6 years and then deletes it after 3. One number is wrong. I left a [CONFIRM] marker so this cannot go live unnoticed.
  2. Wrong authority name. ‘Valsts datu aizsardzības inspekcija’ does not exist. The Latvian supervisory authority is Datu valsts inspekcija. I used the correct name. Fix the LV original too.
  3. Outdated cookie table. _gat_gtag_UA_... is a Universal Analytics cookie, and Google shut UA down in July 2023. If the site runs GA4, Google Ads or Meta Pixel, the table is both incomplete and inaccurate. Run a cookie scan and rebuild the table.
  4. Loyalty programme. It appears in the list of purposes but has no section of its own. Either add one or remove it from the list.
  5. Social networks. Only Facebook is listed. If Alwark LV uses LinkedIn or YouTube, add them.
  6. No section on international transfers. Google Analytics and Meta transfer data to the US, and GDPR requires you to disclose that.
  7. Weak legal basis. The policy relies on consent for email correspondence and complaints, where legitimate interest or contract would hold up better. I am not a lawyer, so have your DPO or legal counsel make this call.

My view is that this policy is a generic 2018 template that nobody has maintained since. Points 1–3 are visible to any auditor. If the LT and EE versions came from the same template, they probably have the same problems, so check them in the same pass.