1. Personal data processing controller
The personal data processing controller is the State Education Development Agency (hereinafter referred to as SEDA), tax payer reg. No.90001800413, address: Vaļņu iela 1, Riga, LV-1050, telephone: 6784322, e-mail: info@viaa.gov.lv.
2. General provisions
2.1. The purpose of the privacy policy is to provide a natural person which is a data subject, information about the purposes and legal basis of processing of personal data, in what cases the data are disclosed, on data storage periods and the protection of data. More detailed information on the processing of personal data can be specified in contracts and internal SEDA regulations.
2.2. When processing personal data, SEDA shall fully comply with applicable regulations, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the Regulation).
2.3. SEDA shall ensure confidentiality of personal data and has implemented relevant technical and organisational measures for the protection of personal data from unauthorised access, illegal processing or disclosure, accidental loss, change or destruction.
3. Categories of personal data
3.1. SEDA shall process personal data of data subjects only in the minimum necessary amount.
Personal data can be collected from the data subject or from databases and registers (for example, from the BURVIS database of the State Employment Agency), or third parties, for example the project applicant and/or cooperation partner.
The categories of personal data that are collected and processed by SEDA mainly include, but are not limited to:
3.1.1. identification data – for example, name, surname, personal code, date of birth, data from the personal identification document (passport or ID card), photo;
3.1.2. contact information – for example, address, telephone number, e-mail;
3.1.3. professional data – for example, position, job;
3.1.4. data about education and skills – for example, duration of education, education institution, obtained degree, obtained professional qualification, language skills data;
3.1.5. data about work experience – for example, data included in CV and motivation letters, data on employment;
3.1.6. data about the labour employment relationship and wage – for example, data about the employment contract and its amendments, data about sick leave certificates and leaves, data about calculated and paid wages;
3.1.7. social data – for example, data about sex, age group, nationality, employment, data about the status of a low-income, poor person.
3.1.8. special categories of personal data – for example, data about health, type of disability, nationality.
3.1.9. financial data – for example, bank account details, scholarship, remuneration, compensation, other payment data;
3.1.10. data related to participation in programmes and/or projects – for example, data on participation in seminars, activities, summer schools, projects, activities within programmes, photo and video materials, experience stories.
3.1.11. data about visiting the SEDA website, for example, data flows and any other communication information, technical information, including cookies (see Cookie Policy)
3.1.12. data about satisfaction, for example, answers to questions in surveys.
3.1.13. photos, videos, as well as voice recordsmade in SEDA premises organised outside offices.
4. Purposes and legal basis of processing of personal data
Personal data processing purposes
SEDA, when fulfilling functions defined in Regulations of the Cabinet of Ministers No.934 of 18 December 2012 “By-Laws of the State Education Development Agency” https://www.vestnesis.lv/op/2012/203.41, shall process personal data for the following purposes:
1) conclusion and fulfilment of contracts with cooperation partners;
2) conclusion and fulfilment of contracts with data subjects (project implementers, experts and other);
3) registration of participants for activities, information of participants about progress of the activities, justification of costs of activities within projects and programmes;
4) verification of compliance of target groups of projects;
5) administrative evaluation of projects;
6) preparation and submission of payment requests and justifying documents;
7) control of costs of scholarships, support and other financing, verification of eligible costs;
8) organisation of competitions;
9)summarising of information.
SEDA shall process personal data for the following purposes:
10)ensuring circulation of documents at SEDA;
11)protection of legal interests of SEDA and implementation of claim rights;
12) prevention and discovery of criminal offences;
13) analysis of functioning of SEDA websites, development and introduction of improvements;
14) sending of SEDA website news;
15) identification of SEDA customers, informing about news, organisation of customer satisfaction surveys;
16) planning and analytics of remarketing, as well as communication programmes;
17) Publicity (in mass media, social networks and on websites, in the internet environment, etc.)
Legal basis of processing of personal data
SEDA shall ensure that processing of personal data always has a legal basis. Such a legal basis can be:
1) activities before the conclusion of a contract with the data subject (for example, collection of necessary data);
2) conclusion and fulfilment of a contract with the data subject (inclusion of data in the contract, correspondence between the parties, contract fulfilment documents);
3) fulfilment of the legal duty of SEDA (fulfilment of duties defined in the regulatory enactments, for example, verification of compliance of target groups of projects; fulfilment of the accounting function of SEDA, performance of information and publicity measures, information of the society);
4) legitimate interests of the society (staff selection, surveys, improvement of the quality of services, protection of own legal interests);
5) consent of the data subject, which can be requested in several cases.
5. Recipients of personal data
5.1. SEDA may transfer personal data to processors according to the personal data processing contract, as well as to other recipients, if they have a legal basis.
5.2. When transferring personal data to processors, SEDA shall take necessary measures to ensure that such personal data processors process personal data in accordance with SEDA instructions and according to applicable regulatory enactments, incl. the Regulation, and shall request performance of relevant security measures.
5.3. Personal data may be transferred to the following recipients, for example:
1. law enforcement agencies;
2. the State Revenue Service;
3. the State Employment Agency;
4. auditors, providers of legal services, providers of postal services, SEDA cooperation partners, who are involved in the fulfilment of SEDA functions and other cooperation partners, which are processors of personal data;
5. the Ministry of Finance, the Central Finance and Contracting Agency (CFCA) as the cooperating authority of European Union funds, the Ministry of Welfare, the Ministry of Education and Science, as well as other authorities involved in supervision of EU funds;
6. cooperation authorities for the implementation of international programmes and financial instruments;
7. service providers supervising web flows, as well as maintenance of SEDA websites.
6. Geographic territory of processing of personal data
6.1. Personal data are processed in the European Union/European Economic Area (EU/EEA).
7. Storage period
7.1. SEDA shall process and store personal data as long as necessary for the data processing purpose. The storage period may be defined in regulatory enactments on the implementation of projects and programmes, regulatory enactments regulating accounting, in the laws which set out claim limitation periods, etc.). Since purposes of processing may differ different personal data, as well as the actual period of preservation may differ.
8. Rights of the data subject
Data subjects have the following rights to the processing of their personal data, which may be implemented by contacting SEDA:
1) to receive confirmation as to whether or not personal data concerning the customer are being processed, and, where that is the case, to access to the personal data;
2) to access the personal data and to receive information on their processing;
3) to request rectification of personal data, if they are inappropriate, incomplete or incorrect;
4) to request erasure of their personal data;
5) to object processing of their personal data, if the use of personal data is based on legitimate interests of SEDA;
6) to request processing of their personal data;
7) to receive personal data provided by the customer in writing or in any of the more frequently used electronic formats and, when possible, to transfer the following data to other service provider (data portability).
The data subject shall be entitled to submit a complaint against the processing of personal data in the Data State Inspectorate (www.dvi.gov.lv), if he or she believes that the processing of the personal data is in violation of the rights and interests defined in regulatory enactments.
9. Communication on matters of processing of personal data
If you have questions or claims regarding processing of personal data and protection at SEDA, report to SEDA by e-mail: info@viaa.gov.lv or send information to a SEDA data protection officer to e-mail: das@viaa.gov.lv, which will evaluate the information and/or request submit by you and will provide a reply.