PRIVACY POLICY

ABORA LLC PRIVACY POLICY

This policy is developed in accordance with the European Union's General Data Protection Regulation (GBER) as well as relevant national legislation. ABORA (hereinafter also "we", "our" or "us") undertakes to protect the privacy of personal data when processing personal data. This Privacy Policy describes in general terms what data is processed, its purposes and how security is ensured. Additional information about the processing of personal data may be included in the employment contracts of our employees, agreements with customers, partners and other documents related to ABORA's operations, including our Data Retention Policy.

Definitions:

Controller: The Controller of Personal Data is ABORA to whom a natural person has submitted his personal data on the basis of a contractual or pre-contractual relationship, or whose services the person (or the legal entity or entity whose beneficial owner is a natural person) intends to use.

Person (ABORA data subjects): the Customer or the Employee or Partner, and other natural persons whose data are processed by ABORA when performing the Services.

Employee: A natural person who, on the basis of an employment contract, performs official duties in the interests of ABORA.

Customer: A natural person or legal entity on behalf of a representative who uses or has expressed an intention to use the ABORA Service.

Partner Natural or legal person on behalf of the representative whose service ABORA uses.

VDAR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46 / EC (General Data Protection Regulation).

ABORA: ABORA Limited Liability Company, reg. No. 40003215743.

Personal Data: Any information that relates directly or indirectly to an identified or identifiable natural person, an ABORA employee (or other natural person whose data is processed in accordance with this Privacy Policy and applicable law).

Processing: Any operation on Personal Data (including their collection, use, input, storage, editing, disclosure, request, transfer, deletion, etc.)

ABORA Service: Any service provided by ABORA that regulates ABORA's business (operations).

General Information

This Privacy Policy applies when ABORA processes personal data:

The person has used, has used or has expressed an intention or interest in using ABORA services. It also applies in cases where the Person is indirectly related to a Service. It also applies to cases where the relationship was established before the entry into force of this Privacy Policy, as well as if the Person provided and / or ABORA obtains Personal Data.

ABORA processes data if at least one of the following conditions is met:

1. It has a legal basis: for concluding and executing an employment contract, accounting of working time, calculating and ensuring the payment of wages, fulfillment of accounting requirements, performance of statutory duties (reporting to the State Revenue Service, State Social Insurance Agency, employee's trade union case), provision of the “Benefit Basket” (organization of mandatory health examinations and insurance, involvement of cooperation partners), recording and control of the performance of work duties, identification of the Client and establishment and performance of contractual relations, performance of legal obligations;
2. This is in ABORA's legitimate interests: selection and employment of personnel, protection of property in the territory / construction sites of ABORA, evaluation of Clients and provision of Services, management of ABORA operational risks, performance of debt recovery and recovery activities, performance of economic and administrative activities, implementation of authorization;
3. The person has given his or her consent: “…. "Consent" means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she consents to the processing of his or her personal data in the form of a statement or explicit affirmative action "Article 4 (11) of the VDAR.

ABORA's core business is the provision of construction services to customers: both legal entities and individuals. We process Customer Personal Data to provide ABORA Services. The exact set of Personal Data to be processed is applicable to:

• (client private person) name, surname, personal identification code, declared place of residence, bank current account, financial and insurance sources for securing transactions, financial flow on performed transactions, name / surname of the client's representative, telephone number and e-mail of the client and client's representative;
• (client legal entity) name, surname, personal identification code, position, telephone number and e-mail of the client's representatives and / or employees;
  personal data of the representatives of their Partners (suppliers and subcontractors). Personal data collected and processed includes the following information: name, surname, personal identification number, contact information, such as telephone number, e-mail address, professional certificates;
• personal data of their employees. The personal data collected and processed includes the following information: identification and passport (ID card) data, name, surname, personal identification code, contact information, address of the declared place of residence, telephone number, bank account, photograph, e-mail address, CV (including but not limited to, data on previous employer and work experience), profession, education, professional certificates;
• Client's data on participation in companies and other forms of legal formations; Customer data on managers and other persons who have a decisive influence, or representatives of companies who use or plan to use ABORA Services, as well as their real beneficiaries; video surveillance data, such as video recordings at ABORA construction sites (where ABORA is the general contractor) and in the ABORA office area.

Special categories of personal data (Article 9 (1) of the GDR - * processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data, biometric data for the unique identification of a natural person, processing of health data or data on the sexual life or sexual orientation of a natural person).

From this data category, we only process the following specific categories of data:

• information regarding the employee's membership in a trade union and health examination.

The processing of these data is possible on the basis of Article 9, second paragraph, points (b) and (h) of the GBER, which allows for the processing of special categories of data if necessary for the exercise of employment obligations and rights assessment, as far as the law allows. acts. For example: in accordance with Articles 10 and 11 of the Labor Law. the employer is obliged to find out whether the employee is a member of a trade union, but with regard to health data, Section 33, Paragraph four of the Labor Law determines the employer's right to obtain information on the employee's health only only insofar as it is essential for concluding an employment contract and performing the intended work , and in accordance with Section 36, Paragraph two of the Labor Law, the employee is sent for a medical examination, the doctor shall indicate only whether the employee is suitable for the intended work.

Other special categories of data are not processed by ABORA.

Basically, ABORA obtains Personal Data directly from the person to whom the data relate. For example, if the Client or Partner enters into an agreement with Abora or a person enters into an employment contract with Abora.

We need personal information in order to provide and receive Services. We will always need certain Personal Data, such as Customer or Partner identification data or contact information, bank current accounts, or employee's name, personal identification code, contact information, bank current account and profession, education, professional certificates.

However, due to their size (volume), the Service's transactions with Customers will require additional information, which ABORA collects from other public sources. For example, data on participation in companies and other forms of legal entities, data on managers and other persons who have a decisive influence, or representatives of companies who use or plan to use ABORA Services, as well as their real beneficiaries.
We request and receive most of the data from the Client or Partner, but we will obtain some data from other sources. We will obtain information about the Person's obligations from public registers and other similar public sources.

Protecting the interests of our services involves a variety of risks and we have a responsibility to manage those risks to ensure the sustainability of our business as well as the protection of the public interest. This means that we monitor the implementation of construction projects and the warranty period of already completed projects, as well as learn from our previous experience to improve the procedures for the evaluation and implementation of new construction projects.

We analyze the data we already have. In addition, we may obtain updated information from registers and other similar public sources.

In order for ABORA to provide the Services, we must comply with many rules. We need to collect specific identifying information. We also have a duty to report to public authorities, such as the State Revenue Service, social security institutions. The data included in our report will depend on the applicable regulatory requirements.

We are constantly improving our Services, so customer data is very important. Ensuring security The provision of services and their payment is threatened by criminal activities. In order to reduce these risks, we process data - we make video recordings, monitor transactions, as well as ensure the security of our IT systems.

Sharing and protecting personal data.

Personal data may be accessed only by those persons to whom it is permitted, as well as personal data may be accessed by third parties attached to ABORA, as well as other persons to whom such access is prescribed or permitted by regulatory enactments. If the Processing of Personal Data on behalf of ABORA is performed by third parties, ABORA shall engage only those third parties who provide sufficient guarantees for the implementation of technical and organizational measures to ensure that the Processing complies with VDAR and applicable legislation and protects the rights of the Customer or Partner. Processing operations performed by processors (third parties) are always governed by the Privacy and Data Processing Agreement or other special conditions agreed between ABORA and such processor.

We may disclose Personal Data to: ABORA cooperation partners, with whom ABORA copies the Services (in each individual construction project implementation); state institutions and other formations that perform the functions specified for them by law; statutory auditors, legal and financial advisers; Personal Data Processors contracted by ABORA, who provide support in the provision of ABORA Services; credit and financial institutions, insurance service providers; public register managers; debt collection companies, credit bureaux and other third parties to whom ABORA may delegate its rights and obligations.

Data transmission outside the EU / EEA is not foreseen in ABORA. However, data may only be transferred outside the EU / EEA if ABORA provides the appropriate safeguards as required by the VDAR and there is a legal basis for such a transfer.

In order to protect Personal Data from unauthorized access, unlawful processing or disclosure, accidental loss, alteration or destruction, we take appropriate measures to comply with applicable law. Such measures include technical measures such as the selection and configuration of appropriate computer systems, the security of the connections concerned, the protection of data and files, and organizational measures such as the restriction of access to such systems, files and facilities.

Rights with regard to the processing of personal data

ABORA wants to ensure that the processing of personal data is fair and transparent, and that all personal rights under applicable law are always enforceable. In particular, the Data Subject has the right to:

• access your Personal Data processed by ABORA. At the request of the Data Subject, ABORA shall:
• confirms, confirms whether the Personal Data related to the Data Subject is processed and provides information on the purposes of the Processing, the categories of Personal Data and the recipients or categories of recipients of the Personal Data to whom the Personal Data has been disclosed;
• inform the Person regarding the Personal Data being processed and the available information regarding their sources;
• provides information on the logic of automated processing of personal data in the case of automated decisions.
  the right to request corrections to inaccurate Personal Data;
• if the Processing of Personal Data is based on consent, the Data Subject has the right to withdraw such consent at any time, without prejudice to the lawfulness of the Processing carried out on the basis of the consent before the withdrawal of the consent;
• the right to receive the Processed Personal Data in a structured, widely used and machine-readable format, as well as the right to send the Personal Data to another Manager in certain circumstances;
• in certain circumstances the Data Subject has the right to request the deletion of Personal Data or the restriction of their Processing;
• the right to object to the processing of Personal Data for certain purposes and in certain circumstances;
  The data subject also has the right to submit a complaint to the supervisory authority - the State Data Inspectorate in Latvia.

Time of storage of personal data

Personal data is stored in accordance with applicable law and for no longer than necessary. The retention period of Personal Data is determined by the ABORA Data Retention Policy and depends on the basis of Personal Data Processing.

Final provisions Legal confirmation and validity

This Privacy Policy is not a legally binding agreement between ABORA and the Customer or between ABORA and its employees for the purpose of establishing an employment relationship; these are our Privacy Guidelines. As we continually improve and develop our Services, we may make changes to our Privacy Policy from time to time. As a result of such amendments, we will not reduce the rights of the Person.