1. What personal data is processed, for what purposes and on what legal basis

1.1. Communication with website visitors, clients and partners

When you contact SIA NordBus using the contact information on the website, the contact form, email or phone, the Controller may process the following personal data:

• first name, surname;
• phone number;
• email address;
• company name, if the person is contacting on behalf of a legal entity;
• the content of the message;
• other information the person voluntarily provides during communication.

The purpose of processing is to enable communication, review questions, provide answers, clarify information and, where necessary, evaluate the situation.

If our system for delivering enquiries is briefly unavailable, a copy of your enquiry is kept encrypted on a server run on our behalf for at most 7 days, only so that it can be delivered, and is then deleted.

The legal basis for processing may, depending on the situation, be the Controller's legitimate interest in maintaining communication with clients, partners and website visitors, pre-contractual steps where the communication concerns a service request, or the fulfilment of a legal obligation where applicable.

1.2. Preparing offers, entering into contracts and providing the service

When you submit a transport or other service request, the Controller may process information necessary to evaluate the request, communicate with the customer, prepare an offer, enter into a contract and provide the service, for example:

• first name, surname or the contact person's name;
• personal identification number, if the contract is entered into with an individual and it is required for preparing the contract or identifying the person;
• phone number;
• email address;
• company name, registration number, registered address, VAT number and bank account details, if the request or contract is made on behalf of a legal entity;
• information about the company representative or contact person;
• the desired service;
• the route;
• the trip date and time;
• the return date and time, where applicable;
• the number of passengers;
• pick-up and drop-off locations;
• additional information provided in the request or during communication.

The purpose of processing is to evaluate the request, communicate with the customer, clarify additional information, prepare an individual offer, prepare and enter into a contract, organise and provide the service, and prepare the related transaction documentation.

The legal basis is pre-contractual steps at the data subject's request, the conclusion and performance of the contract, the fulfilment of the Controller's legal obligations, and the Controller's legitimate interest in conducting its business, processing customer requests and protecting its legal interests.

Filling in a request form on the website does not by itself create contractual obligations between the person and SIA NordBus. An offer or partnership becomes binding only when separately confirmed between the parties in writing or in another form acceptable to the parties.

Identity document data is generally not requested or processed when handling client or service requests.

1.3. Processing data of partners and contact persons of legal entities

As part of the Controller's business, personal data of partners who are natural persons or of contact persons of legal entities may be processed, for example:

• first name, surname;
• position;
• employer or represented company name;
• work email;
• phone number.

The purpose is to enable communication, resolve partnership matters, prepare offers, and enter into or perform contracts where applicable.

The legal basis may be pre-contractual steps or contract performance, and the Controller's legitimate interest in maintaining cooperation with clients and partners.

1.4. Handling feedback, submissions and complaints

When a person submits feedback, a submission or a complaint, the Controller may process:

• first name, surname;
• contact details;
• the content of the submission, feedback or complaint;
• information required to prepare a response or evaluate the situation;
• other information the person voluntarily provides in relation to the matter.

The purpose is to review the submission, feedback or complaint, prepare a response, evaluate the situation and protect the Controller's rights or legitimate interests.

The legal basis is the Controller's legitimate interest in reviewing submissions, maintaining communication and protecting its legal interests, and compliance with a statutory obligation where applicable.

1.5. Recruitment and formalising the employment relationship

For recruitment purposes the Controller may process personal data of prospective employees that the person submits when applying for a vacancy or sending a job application, for example:

• first name, surname;
• phone number;
• email address;
• information provided in the CV;
• information about education, work experience and skills;
• information provided in the cover letter or application;
• other information the person voluntarily provides during the recruitment process.

The purpose is to evaluate the candidate's application, communicate with the candidate and run the recruitment process.

The legal basis is steps taken at the data subject's request prior to entering into an employment contract, the Controller's legitimate interest in ensuring a lawful recruitment process, and the data subject's consent where the person agrees to CV retention for longer periods for future recruitment.

If a person is selected for employment following the recruitment process, the Controller may also process additional personal data necessary to formalise the employment relationship, such as personal identification number, declared address, bank account details, identity document data and driving licence data, where required for the role's duties or statutory obligations.

1.6. Website operation, security and usage analytics

When you visit www.nordbus.lv, the Controller may process technical data that in some cases may qualify as personal data, for example:

• IP address;
• device and browser information;
• the time of the website visit;
• the sections of the website visited;
• cookie data;
• other technical information necessary for the operation, security and improvement of the website.

The purpose is to ensure the website's operation, security, technical maintenance, error correction and, where applicable, website usage analysis.

The legal basis is the Controller's legitimate interest in the website's security and operation, and the data subject's consent where analytics or marketing cookies requiring consent are used.

1.7. Video surveillance in vehicles

The Controller may operate video surveillance in vehicles it manages or uses, where necessary for the safety of persons, protection of property, quality assurance of the transport service or investigation of incidents.

Video surveillance data may include a person's image, movement and behaviour inside the vehicle, date, time, vehicle identification information and other data related to the surveillance process. Data is recorded when the person is within the field of view of the surveillance camera installed in the vehicle.

Vehicles in which video surveillance is carried out display informational signs about the surveillance in accordance with statutory requirements.

The purposes of video surveillance may include:

• safety of passengers, employees and other persons;
• protection of the Controller's, employees', passengers' and third parties' property;
• prevention or detection of crimes or other unlawful acts;
• investigation of incidents, complaints or disputes;
• quality control and improvement of the transport service;
• protection of the Controller's legal interests.

The legal basis is the Controller's legitimate interest in protecting personal safety and property, ensuring transport service quality, investigating incidents and defending its legal interests, as well as the protection of the vital interests of the data subject or another natural person in emergency or safety incidents.

The Controller implements appropriate technical and organisational measures to protect video surveillance data against unauthorised access, disclosure, alteration, loss or unlawful processing. Access is granted only to authorised persons who require it for their duties or for the evaluation of a specific situation.

Video surveillance data may be transferred to state and municipal authorities, including law enforcement, where required by law or necessary for investigating an incident, offence or dispute.

Video surveillance data may also be available to service providers engaged by the Controller, such as video surveillance maintenance or technical service providers, insurance providers and other service providers, where necessary to achieve the specific processing purpose and an appropriate legal basis is in place.

Video surveillance data is retained for no longer than necessary to achieve the specific processing purpose. Typically it is retained for up to 14 days and then deleted, unless longer retention is necessary in a specific case for the Controller's legitimate interests, investigation of an incident, resolution of a dispute or litigation needs.

2. Personal data processing, protection, transfer and retention

The Controller uses appropriate technical and organisational security measures to protect personal data from unauthorised access, unlawful processing or disclosure, and accidental loss, destruction or damage.

Personal data is stored securely and is available only to a limited number of the Controller's employees or engaged service providers who require the information for their duties, contractual obligations or the provision of a specific service.

The Controller may transfer personal data to third parties only where necessary for a specific processing purpose, where required by law or where another legal basis for the transfer exists.

Personal data may be transferred to:

• website maintenance and hosting service providers;
• IT systems maintenance and security service providers;
• email, communication and customer request processing tool providers;
• accounting, legal and administrative service providers;
• partners involved in providing the transport service, where necessary for delivering the specific service;
• video surveillance maintenance or technical service providers, where applicable;
• insurance providers, where necessary for evaluating an incident or insurance case;
• state and municipal authorities, law enforcement, bailiffs or other persons where disclosure is required by law.

To perform its services, run the website, communicate with clients or achieve other processing purposes, the Controller may use personal data processors that provide services to it.

In such cases the Controller takes the necessary steps to ensure that processors handle personal data only in accordance with the Controller's instructions and applicable laws, and apply appropriate technical and organisational security measures.

The Controller uses only processors that provide sufficient guarantees that personal data processing will comply with statutory requirements and safeguard data subjects.

SIA NordBus primarily processes personal data within the European Union and the European Economic Area.

Where the Controller engages service providers whose operations may involve processing outside the EU or EEA, it ensures compliance with the applicable data protection requirements and the use of appropriate safeguards.

Personal data is not used for automated individual decision-making, including profiling, that produces legal effects concerning the person or similarly significantly affects the person.

Personal data is processed only for as long as necessary to achieve the relevant processing purpose, fulfil statutory obligations or protect the Controller's legitimate interests.

The following criteria are used to determine personal data retention periods:

• as long as needed to respond to the person's question or request;
• as long as needed to prepare an offer, enter into a contract, provide the service and prepare related transaction documentation;
• as long as needed to handle a submission, feedback or complaint;
• as long as needed for the recruitment process;
• as long as either party may exercise its legitimate interests, such as handling claims, defending rights, resolving disputes or observing limitation periods;
• as long as a statutory obligation to retain the data exists, for example in accounting, records management, employment law or archiving;
• as long as the data subject's consent is in force, where processing is based on consent.

For example:

• questions and requests submitted via contact forms or email are retained as long as needed to respond and maintain communication;
• offer request and contract preparation information is retained as long as needed to prepare the offer, enter into the contract, provide the service and protect the Controller's legal interests;
• data related to concluded transactions and accounting documents is retained for statutory periods;
• information related to complaints, submissions or incidents may be retained as long as needed to evaluate the situation and protect the Controller's rights;
• recruitment data is retained until the end of the recruitment process and then for up to 6 months, unless the person has consented to longer retention or a different statutory period applies;
• video surveillance data is typically retained for up to 14 days, unless longer retention is necessary in a specific case for the Controller's legitimate interests, investigation of an incident, dispute resolution or litigation needs;
• cookie data is retained according to the relevant cookie's lifetime or the retention period specified in the Cookie Policy.

After the applicable retention period ends, personal data is deleted, anonymised or otherwise processed so that the person can no longer be identified, unless the law requires longer retention.

3. Rights of the data subject

As a data subject you have the following rights:

• receive information about the processing of your personal data;
• request access to your personal data;
• request rectification of inaccurate personal data;
• request erasure of personal data where there is a legal basis;
• request restriction of processing;
• object to processing where it is based on the Controller's legitimate interests;
• request data portability where applicable;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the supervisory authority.

To exercise your rights, you can submit a written request to info@nordbus.lv or by post to Dzirciema iela 121, Riga, LV-1055, Latvia.

To protect your personal data, the Controller may ask you to clarify the request or verify your identity before fulfilling it.

The Controller ensures compliance with personal data processing and protection requirements. If you have reasonable concerns that the Controller is processing your personal data in a way that does not comply with the law, or you have other questions about personal data processing, please contact SIA NordBus first.

If you still believe your rights have been violated, you have the right to contact the supervisory authority:

Data State Inspectorate (Datu valsts inspekcija)
Elijas iela 17, Riga, LV-1050
Email: pasts@dvi.gov.lv
Website: www.dvi.gov.lv

4. Contact for personal data matters

For questions about personal data processing or this Privacy Policy you can contact the Controller:

SIA NordBus
Dzirciema iela 121, Riga, LV-1055, Latvia
Phone: +371 67 464 620
Email: info@nordbus.lv
Website: www.nordbus.lv

5. Amendments to the Privacy Policy

This Privacy Policy is prepared in Latvian.

The Controller is entitled to amend this Privacy Policy by publishing the current version on www.nordbus.lv.