Virsi Renergy Privacy Statement

SIA “VIRŠI Renergy”

Version: 01

PRIVACY STATEMENT

UPON THE CONCLUSION OF THE ELECTRICITY SUPPLY CONTRACT

1. General Terms and Conditions

1.1. This privacy statement (hereinafter also referred to as the Statement) is developed in

accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of

27 April 2016 on the protection of natural persons with regard to the processing of personal data and

on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection

Regulation), hereinafter – Regulation.

1.2. The purpose of this Statement, according to the conditions of Article 13 and Article 14 of

the Regulation, is to provide information to the personal data subject – identifiable natural persons

(hereinafter – Data Subject or you) on how SIA “VIRŠI Renergy” (hereinafter – VIRŠI or the Controller)

collects, processes, stores, shares, deletes and protects the personal data. The purpose of the

Statement is to protect the interests and freedoms of the Data Subject, at the same time ensuring that

personal data are processed lawfully, in good faith and in a manner that is transparent to the Data

Subject.

1.3. This Statement shall only be applicable to the processing of personal data of natural persons

upon the conclusion of the Electricity Supply Contract , including for the purposes of concluding the

contract and performing the obligations under such contract, as well as when performing other

activities related to such contract.

2. Controllers and contact information

2.1. The Controller of personal data processing specified in this Statement shall be SIA “VIRŠI

Renergy” (unified registration No. 45403058402, registered address: Kalna iela 17, Aizkraukle,

Aizkraukle Rural Territory, Aizkraukle Municipality, LV-5101).

2.2. The contact information of the Controller for communication is as follows:

– postal address: Kalna iela 17, Aizkraukle, Aizkraukle Rural Territory, Aizkraukle Municipality,

LV-5101, Latvia;

– e-mail address: birojs@virsi.lv;

– telephone +371 80 700 070.

2.3. You can contact us regarding all personal data processing and protection issues in the

following ways:

– electronically by writing to the e-mail address: datuaizsardziba@virsi.lv;

– address for postal correspondence: Kalna iela 17, Aizkraukle, Aizkraukle Rural Territory,

Aizkraukle Municipality, LV-5101, Latvia.

Please address your letter to: “VIRŠI” Data Protection Officer.

3. What are personal data?

3.1. Personal data means any information related to an identified or identifiable natural person

(“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in

particular by reference to an identifier such as a name, an identification number, location data, an

online identifier or to one or more factors specific to the physical, physiological, genetic, mental,

economic, cultural, or social identity of the natural person.

4. What personal data concerning you does VIRŠI process and for what purposes, what is

the legal basis and the period of data processing?

4.1. For ensuring the economic operation of VIRŠI, concluding an Electricity Supply Contract

and fulfilling contractual obligations thereunder, as well as for ensuring the legitimate interests of

VIRŠI.

In order to enter into an electricity supply contract (hereinafter – Contract), you provide VIRŠI

your data and the right to process them in accordance with the ways and purposes specified in this

Statement. The submission of your personal data is mandatory. By failing to submit them, you will not

be able to conclude the Contract. The Contract can be concluded by a natural person who has reached

the age of 18. You can conclude the Contract in the following ways:

- by telephone No.: +371 80 700 070;

- on the website of VIRŠI www.virsi.lv.

Data categories

During the telephone conversation, an audio recording may be made of

your voice and the conversation you have regarding the aspects of

conclusion of the Contract, including your name, surname, personal

identity number, address of declared residence, address of the object

where you wish to connect the electricity, technical details of the object

– number of phases, number of amperes, telephone number and e-mail

address, date of commencement of the Contract, VIRŠI customer

and/or loyalty participant number (if you are a VIRŠI customer and/or

loyalty participant).

VIRŠI will receive the technical data of the object of the Contract from

the distribution system operator AS “Sadales tīkls”.

You will be identified via SMART-ID, by you entering the verification

code sent to you.

Your address, telephone number and e-mail address will be used by

VIRŠI to inform you about the prepared offer or the concluded Contract,

prepared invoices or adjusted payments, about the provided services

and other issues related to your Contract.

Before concluding the Contract, VIRŠI will carry out verification in its

internal and external (CREFO) systems to ascertain whether you have

had any outstanding liabilities to VIRŠI group companies and other

service providers (solvency/credit risk assessment) that might form an

obstacle for concluding the Contract. In the event that, following the

above verification, you are found to have a negative

solvency/creditworthiness assessment, the Contract will not be

concluded with you and you will receive information to this effect to the

email address you have provided.

During the fulfilment of the contractual obligations, VIRŠI will process

information about your electricity consumption (inter alia, to the level

of detail of each hour), prepared invoices/adjusted payments, and the

status of settlement thereof. VIRŠI will process and store all information

relevant to the performance of the contractual obligations that you

have provided to VIRŠI during the communication (correspondence,

including on social networks, messages, etc.).

In order to contact you about the services provided by VIRŠI in

connection with your Contract, VIRŠI may use the contact details you

provide, including, in the event of non-payment, sending a warning to

the postal address you have specified.

After the conclusion of the Contract, your personal data are processed

in accordance with the Contract concluded between the parties, as well

as payment information arising from this Contract (if the service is

provided for a fee), including bank account, information about the

credit institution, payments made, received services, e-mail for

receiving invoices and customer number.

In order to assess the validity of complaints received from you, VIRŠI

may use, on the basis of legitimate interests, all your personal data

processed in VIRŠI systems and received from you, such as the content

of VIRŠI applications, requests, complaints, etc.

In certain cases, on the basis of the “know your client” principle

contained in the Law on Prevention of Money Laundering and Terrorism

and Proliferation Financing, VIRŠI or its group company AS “VIRŠI-A”

(unified reg. No. 40003242737, registered address: Kalna iela 17,

Aizkraukle, Aizkraukle Rural Territory, Aizkraukle Municipality, LV-5101,

Latvia) may ask you for additional information such as, but not limited

to, information substantiating the legal origin of your funds, which

organisations you represent, information about your payment

institutions, accounts. In the event that VIRŠI requests you to submit

additional information, but you fail to provide it, this may form an

obstacle for concluding the Contract or may form the grounds for

termination of the already concluded Contract.

To learn more about the processing of personal data when joining the

loyalty programme of the customers of VIRŠI, please see the Privacy

Statements section on the website www.virsi.lv.

Legal basis for data

processing

The legal basis for the processing of personal data necessary for the

performance of the pre-contractual measure to make you an offer and

for the conclusion and fulfilment of the Contract to which you are a

party is Article 6(1)(b) of the Regulation.

In order to enable VIRŠI to assess the existence of obstacles for

concluding the Contract (solvency/creditworthiness assessment)

and/or to defend its infringed lawful interests, the processing of

personal data will take place on the basis of Article 6(1)(f) of the

Regulation, for example, when addressing the court to recover a debt

for services received for which you have not settled the payment(s).

In administering the fulfilment of the Contract, VIRŠI will keep

accounting records reflecting the information about the received

services and settlement of payments in accordance with Article 6(1)(c)

of the Regulation and the provisions of the Accounting Law.

In accordance with Clause 129 of Cabinet Regulation No. 50 of

21 January 2014 “Regulations Regarding the Trade and Use of

Electricity” and in accordance with Article 6(1)(a) of the Regulation,

upon the receipt of your consent, we will obtain information about your

object(s) from the distribution system operator AS “Sadales tīkls”. By

failing to provide us with your personal data and permission for

requesting information from AS “Sadales tīkls”, we will not be able to

prepare an offer for you for the purposes of conclusion of the Contract.

In complying with the obligation prescribed by the Law on the

Prevention of Money Laundering and the Financing of Terrorism and

Proliferation to implement the “know your client” principle, VIRŠI will

rely upon the legitimate interests of VIRŠI as set out in Article 6(1)(f) of

the Regulation.

Period of data

processing

All information submitted and generated during the fulfilment of the

Contract, including the information provided by the credit rating, which

reflects the fulfilment of your obligations assumed by the Contract, shall

be kept for the term of validity of the Contract and be subject to the

limitation period for claims applicable to the relevant legal relationship

(e.g., 3 years for commercial transactions, as one of the parties to the

transaction is an economic operator).

If, in the opinion of VIRŠI, the information reflected in the Contract is

not relevant, VIRŠI reserves the right to delete certain information

earlier. For example, information reflecting your telephone

conversation with VIRŠI may be stored for a shorter period of time,

unless during that telephone conversation, you have expressed a wish

to enter into a Contract and/or to change the terms of the Contract.

Such telephone conversations may be retained VIRŠI for the entire term

of validity of the Contract to secure itself with evidence that you have

agreed to the relevant terms and amendments of the Contract.

When providing the services, VIRŠI must comply with the special laws

and regulations prescribing the obligation of VIRŠI to retain certain data.

For example, the Accounting Law prescribes an obligation to store

information on transactions for five years.

If no Contract is concluded with you but you have agreed that VIRŠI

stores your data, VIRŠI shall store such data for 2 months for ensuring

legitimate interests and shall permanently erase them thereafter.

If a complaint is received or the lawful interests of VIRŠI are infringed,

for example, there is a dispute about the scope of the received services,

the relevant information may be retained until the solution of a dispute

situation, for example, until the moment of coming into force and

enforcement of the court judgment.

5. Who has access to information and whom is it disclosed to?

Personal data recipients may be the authorised employees of VIRŠI according to the scope of

duties specified in their job duties and observing the requirements of prescribed by the regulatory

enactments, as well as the requirements of personal data processing set out in the VIRŠI internal

regulatory enactments.

Personal data may be transferred to VIRŠI processors – outsourced service providers who are

authorised to carry out certain data processing activities on behalf and under the supervision of VIRŠI,

such as customer service providers, credit information bureaus, legal service providers or debt out-of-

court service providers (if you have incurred debt obligations), financial advisors, audit and inspection

service providers, and other advisors, in accordance with the terms of the contract concluded between

the parties.

To the distribution system operator – AS “Sadales tīkls”.

To the postal and courier delivery service providers.

To the banks and other providers of payment and financial services.

To the service providers ensuring information exchange between VIRŠI and financial service

providers.

Personal data may be transferred to the affiliated companies of VIRŠI in compliance with the

requirements specified in regulatory enactments. If you are a participant of the VIRŠI loyalty

programme or become one during the term of validity of the electricity supply contract, information

about the conclusion and fulfilment of the relevant contract will be transferred and included as data

sources, in order to implement the purposes of the loyalty programme of VIRŠI.

Personal data may be transferred to law enforcement authorities, court or other state and local

government authorities, if the relevant authorities are entitled to receive the requested information

(for example, to the State Revenue Service about you as a counterparty, etc.).

It is not intended to transfer personal data to recipients outside the Member States of the

European Union or the European Economic Area.

VIRŠI has a duty to provide information on the personal data processed in the following cases:

1. To law enforcement authorities, court or other state and local government authorities if it

arises from laws and regulations and the relevant authorities are entitled to receive the

requested information.

2. If personal data must be transferred to a third party within the framework of a concluded

contract in order to perform any function necessary for the performance of the contract (for example,

in the case of an electricity insurance contract; implementation of legitimate interests of VIRŠI,

ensuring the provision of legal assistance).

3. According to a clear and unambiguous request of the data subject.

4. For the protection of the legal interests of VIRŠI, for example, when addressing the court or

other state authorities to turn against a person who has infringed the legal interests of VIRŠI.

6. Rights of the data subject with regard to personal data processing

6.1. How will the Data Subject be informed about his/her personal data processing?

The Data Subject shall be informed about the personal data processing specified in this

Statement by using a multi-level approach, including methods such as posting this Statement or a part

thereof on the website of VIRŠI www.virsi.lv; information shall be provided during the telephone

conversation, information shall be available at VIRŠI fuel stations , and in certain cases information will

be provided in the form of notifications or otherwise.

6.2. Right to access personal data and rectify them.

6.2.1. In accordance with the provisions of the Regulation, you have the right to request access

to your personal data at the disposal of VIRŠI and to receive the following information:

– what personal data concerning you are at the disposal of VIRŠI;

– for what purposes VIRŠI processes such personal data;

– categories of recipients of personal data (persons whom personal data are disclosed to or

whom they are intended to be disclosed to, unless the regulatory enactments does not allow VIRŠI to

provide such information in a particular case);

– information on the period for which the personal data will be stored or the criteria used to

determine that period.

In addition, VIRŠI draws your attention to the fact that you can consult your personal data by

authenticating your user profile on the VIRŠI website www.virsi.lv.

6.2.2. If you believe that the information held by VIRŠI is outdated, inaccurate or incorrect, you

have the right to request the rectification of your personal data or to do so yourself in your profile on

the VIRŠI website www.virsi.lv.

6.2.3. You have the right to request the erasure of your personal data, or to object to the

processing thereof, if you consider that data have been processed illegally, or they are no longer

necessary in relation to the purposes for which they have been collected and/or processed (by

implementing the principle of the “right to be forgotten”).

6.2.4. VIRŠI hereby informs you that your personal data cannot be erased, if personal data

processing is necessary in the following cases:

– for VIRŠI to protect your vital interests or the vital interests of another natural person, inter

alia, life and health;

– for VIRŠI or a third party to be able to establish, implement or protect legal (lawful) interests;

– data processing is necessary in accordance with the regulatory enactments binding on VIRŠI.

6.2.5. You have the right to request VIRŠI to restrict the processing of your personal data if any

of the following circumstances exist:

– the accuracy of the personal data is contested by you, for the period while VIRŠI verifies the

accuracy of the personal data;

– the processing is unlawful and you oppose the erasure of the personal data and request the

restriction of their use instead;

– VIRŠI no longer needs the personal data for the purposes of the processing, but they are

required by you for the establishment, exercise or defence of legal claims;

– you have objected to processing – pending the verification of whether the legitimate grounds

of VIRŠI override your legitimate grounds.

6.2.6. Where the processing of your personal data has been restricted under Clause 6.2.5, such

personal data shall only be processed with your consent (with the exception of storage) or for the

establishment, exercise or defence of legal claims or for the protection of the rights of another natural

or legal person or for reasons of important public interests.

6.2.7. You will be informed by VIRŠI before the restriction of processing is lifted.

6.2.8. You have the right to lodge a complaint with the Data State Inspectorate if you believe

that VIRŠI has processed your personal data unlawfully. VIRŠI invites to first contact it by writing to the

e-mail address: datuaizsardziba@virsi.lv in order to promptly find a solution to the situation if your

right to personal data protection has been violated.

6.3. Right to withdraw consent.

If VIRŠI processes personal data on the basis of the Data Subject’s (your) consent, you have the

right to withdraw the consent at any time by sending a withdrawal in accordance with the procedure

specified in Chapter 2 of the Statement. Upon the receipt of withdrawal, VIRŠI will not further process

your data for the purpose for which the consent was withdrawn. Besides, in order to ensure fair

processing on the part of VIRŠI, VIRŠI shall, considering the technological possibilities, offer an

additional opportunity to refuse to receive further information each time you contact us.

7. Acceptance and handling of Data Subject’s submissions

7.1. If the Data Subject has any questions or submissions related to the processing of personal

data performed by VIRŠI, the Data Subject can file a submission to VIRŠI regarding the exercise of

his/her rights through the following communication channels:

7.1.1. by personally identifying him/herself and presenting a personal identification document,

to file a written submission to VIRŠI to the address specified in Chapter 2 of the Statement;

7.1.2. by sending the submission by post to VIRŠI to the address specified in this Statement;

7.1.3. by sending the submission electronically to the e-mail address: datuaizsardziba@virsi.lv,

signing it with a secure electronic signature. In such a case it is presumed that the Data Subject has

identified himself or herself by submitting a request, which is signed with a secure electronic signature;

7.1.4. In other cases, when VIRŠI has no doubts about the identity of the Data Subject, by

coordinating the procedure for issuing information.

VIRŠI will handle the submission of the Data Subject and a reply will be drawn up and sent by

registered mail or in the form an electronic document, thus ensuring that unauthorised persons may

not receive such consignment. Concurrently, VIRŠI shall reserve the right to request additional

information from the Data Subject in the event of doubt, if VIRŠI considers it necessary.

7.2. The Data Subject is obliged to clarify in his or her request as much as possible, the time,

place and other circumstances that could help to fulfil his or her request.

7.3. After the receipt of a written request of the Data Subject regarding exercising his or her

rights, VIRŠI shall:

7.3.1 verify the identity of a person;

7.3.2. assess the request and proceed as follows:

– if VIRŠI can ensure the execution of the request, it shall fulfil it as soon as possible and

the Data Subject as the submitter of the request may receive the information or a copy of the

data referred to in the request;

– if VIRŠI needs additional information to identify the Data Subject requesting the

information or to fulfil the request, VIRŠI may request the Data Subject to provide additional

information (for example, specific date or time, use of services, purchase data, etc., where the

Data Subject is identifiable);

– if the information is erased or the person who requests the information is not the Data

Subject or the person may not be identified, the request may be rejected in accordance with

this Statement and/or the regulatory enactments;

– in the case if VIRŠI receives the request, but the Data Subject has not left his/her contact

information so that VIRŠI can contact him/her during the handling of the request and inform

him/her about the result of handling the request, VIRŠI shall undertake to prepare a written

response within one month, which will be available at the address specified in the Statement

of VIRŠI. The above-mentioned letter will be stored and will be receivable by the Data Subject

at the office of VIRŠI for a maximum of two months from the day of submission of the request.

8. What measures does VIRŠI use to ensure the protection of personal data?

8.1. VIRŠI shall regularly review and improve the personal data protection measures in order to

protect the personal data of natural persons from unauthorised access, accidental loss, disclosure or

destruction. To ensure this, VIRŠI shall use appropriate technical and organisational systems (for

example, each employee is granted an individual right of access to information, and the scope of the

right of access is determined individually).

8.2. VIRŠI shall carefully check all service providers who process the personal data of natural

persons in the name and on behalf of VIRŠI. VIRŠI shall assess whether the cooperation partners

(processors of personal data) ensure appropriate security measures so that the processing of personal

data of natural persons takes place in accordance with the delegation of VIRŠI and the requirements

of regulatory enactments.

8.3. In the event of a personal data security incident, if it may pose a high risk to the Data

Subject’s rights and freedoms, VIRŠI will notify the Data Subject of such by using the contact

information available to it (if possible), or the information will be posted on the website of VIRŠI

www.virsi.lv or on social networks administered by VIRŠI, or otherwise (for example, through the mass

media).

9. Final provisions

9.1. This Statement shall be reviewed and updated from time to time. The current version of the

Statement shall be posted on the website www.virsi.lv, as well as will be available at the places of

performance of commercial activity of VIRŠI.

9.2. This Statement shall enter into force on 4 August 2023.

Riga. The date of the document is the date of the time stamp of its last electronic signature.

This document is signed with a secure electronic signature and contains a time stamp.