Privacy Policy

1. Purpose and controller of personal data

The purpose of the privacy policy is to provide a natural person – the Data Subject, with information about the purpose, scope, protection and processing term of personal data processing during data acquisition and processing of the Data Subject’s personal data.

The controller of personal data is the Scientific Institute of Food Safety, Animal Health and Environment “BIOR” (hereinafter – BIOR), registration No.: 90009235333, legal address: Lejupes iela 3, Riga, LV-1076.

BIOR’s contact information for matters related to personal data processing is: datuaizsardziba@bior.lv or bior@bior.lv.

2. Purpose of personal data processing

The need to collect and process personal data at BIOR arises when carrying out scientific activities, performing tasks of the state administration defined in regulatory acts, fulfilling customer orders and ensuring BIOR’s economic activity, including:

• acceptance of samples, testing;
• organization of aquaculture consultations;
• compilation of fishing statistical data, research of fishing resources, collection of fishing, biological and economic information data;
• accounting records;
• record keeping;
• organization of seminars and other activities;
• other personal data processing purposes, when the person uses, has used or has expressed a desire to use BIOR services, or is otherwise related to the services provided by BIOR.

3. Categories of personal data

BIOR processes the categories of personal data specified in the BIOR Data Processing Register (DC-RI-P-37).

The BIOR Data Processing Register contains information on Data subjects, categories, purposes of data processing, legal basis for processing, sources of personal data, recipients of personal data, duration of personal data storage.

Personal data is collected both from the Data Subject and from external sources. The categories of personal data that BIOR mostly, but not exclusively, collects and processes are:

• identification data, such as name, surname, personal identification number, date of birth, age, customer number;
• contact information such as address, telephone number, email address;
• professional data, such as education, position, workplace;
• special category personal data, such as diagnosis code, medical history number, hospitalization date, testing sample;hospitalizācijas datums, testēšanas paraugs;
• data related to the testing of the submitted samples, such as name and description, place of sampling, indicator to be determined, method used, results of laboratory examinations;
• data obtained and/or created while performing tasks defined in regulatory acts;
• payment and financial data, such as bank account number, contract amounts;
• data obtained as a result of video surveillance, which characterizes external appearance, clothing, gait, directions of movement;
• Image of BIOR visitors, participants of organized public events;
• data of information systems and websites, such as IP address, cookies (website browsing data), which are data about visiting the www.bior.lv website, such as date, time and amount of internet browsing, location at the time of browsing;
• other personal data not mentioned above, depending on the type of service provided, and information provided by the Data Subject processed by BIOR.

4. Legal basis for personal data processing

BIOR processes personal data only when there is a legal basis to do so. The main legal bases for processing personal data are:

• for the provision of BIOR functions, for the performance of the duties specified in the regulatory acts. Applying this legal basis, BIOR has no discretion regarding the obligations imposed;
• determined for the execution of the contract or the performance of an event at the request of the Data Subject before the conclusion of the contract;
• The data subject has given consent to the processing of his personal data for one or more specific purposes;
• to protect the vital interests of the Data Subject or other natural person, i.e. life and health.

5. Cookies

To improve the quality of the content of the website www.bior.lv, to make it more convenient to use and to adapt it to the needs of users, BIOR uses cookies, which the Data Subject is warned about when visiting the BIOR website for the first time. By using the website, the Data Subject agrees to the use of cookies and confirms that he has familiarized himself with the website’s Cookie Policy and explanations, as well as agrees with the purposes of their use. For more detailed information on the use of cookies, please see the “Cookie Policy” section of the BIOR website.

6. Photography and filming at events organized by BIOR

BIOR organizes various public events (seminars, lectures, etc.), during which photography and filming is done. Information about the organized events can be posted on the BIOR website, social networks. In public places, filming and photography can be carried out without special notice. While on the territory of the event, the Data Subject confirms that he/she is informed and has no objection to the inclusion of audio-visual material about the event. About the fact that photography or filming will take place at the event, BIOR places information on the event poster and places special notices at the event locations.

If a group or team is photographed, BIOR may publish such a photo or video without requiring the Data Subject’s consent, considering that the image does not refer to a specific person, but to the entire group.

BIOR is entitled to publish the images sent by the Data Subject, if no other natural person is visible in them.

BIOR is entitled to transfer photos or video recordings from public events organized by BIOR to third parties in order to reflect BIOR’s ongoing activities to a wider audience.

7. Video surveillance

In order to ensure and promote the security of BIOR, to reduce the risks of endangering public order and security, for the prevention and detection of criminal offenses in connection with the protection of property and vital interests of individuals, incl. life and health protection, video surveillance is carried out in BIOR territory and in public spaces.

Before the video surveillance area, warning signs are installed on the BIOR territory or premises.

Access to video surveillance records is limited to BIOR’s responsible person for specific purposes of personal data processing, or to verify that the video surveillance system is working.

BIOR does not make backup copies of video recordings and does not transfer data to third parties, except in the cases specified in regulatory acts. Video recordings are stored no longer than the time period specified in the regulatory acts, i.e. the video recordings made are stored in BIOR for no longer than 21 days. Entries are deleted automatically in chronological order from the time of entry.

8. Recipients of personal data

BIOR can transfer personal data to ensure the fulfillment of concluded contracts, provided that the contracting party has assured that it will ensure data protection in accordance with regulatory enactments.

BIOR can transfer personal data to third parties, but only when it is necessary to fulfill the obligations specified in the regulatory acts, or if it is permitted by the regulatory acts in the field of personal data protection.

Personal data may be transferred to sample orderers, payers or sample owners if it is not the same person and the sample orderer has specified all persons as recipients of the testing report.

9. Collection of personal data

BIOR can obtain data and information about personal data from other state information systems and institutions, for example fishing logs submitted by the State Environmental Service. BIOR cooperates only with those institutions and organizations that are able to guarantee the requirements for the proper storage and protection of personal data specified in the regulatory acts.

Personal data may be obtained from sample orderers if it is not the same person and the sample orderer has indicated the Data Subject as the payer for the testing report or as the owner of the sample.

10. Transfer of personal data to third countries

Personal data is processed in the European Union and the European Economic Area (hereinafter – EU/EEA).

Personal data may be transferred outside the EU/EEA only if BIOR has a legal basis to do so. BIOR will transfer information only if the receiving party is able to ensure an adequate level of personal data protection and compliance with data processing requirements. Before that, BIOR will take all necessary measures to inform the Data Subject about the need to send such information.

11. Retention period

BIOR will store personal data only for as long as it is necessary to perform its functions, for example, for as long as the Data Subject uses BIOR’s services or until the Data Subject withdraws his consent, if the personal data was processed on this basis. In some cases, the duration of storage is determined by regulatory acts. The period of time for which personal data is stored is determined by the purpose for which this data was collected.

12. Personal data security guarantees

BIOR provides, continuously reviews and improves safeguards to protect personal data from unauthorized access, accidental loss, disclosure or destruction. To ensure this, BIOR applies modern technologies, meets technical and organizational requirements.

BIOR processes personal data lawfully, in good faith and in a manner transparent to the Data Subject.

BIOR collects personal data only for specific, clear and legitimate purposes, and their further processing is not carried out in a manner incompatible with the said purposes.

BIOR employees who process personal data ensure confidentiality of such information. The employee’s obligation to comply with the obligation of confidentiality in relation to the data of the natural person is valid for an indefinite period of time, including also after the termination of employment legal relations.

13. Rights of the data subject during the period of personal data processing

According to the normative regulation of data protection, the Data subject has the right to influence data processing by contacting BIOR’s data protection specialist by writing to the e-mail address: datuaizsardziba@bior.lv. The data subject has the right to:

1. obtain information on whether BIOR has processed any personal information of the Data Subject;
2. access the processed personal information, obtain a free copy of it (except in the case of multiple or excessive requests) and except if the applicable regulatory acts in the field of data protection provide otherwise, including receiving information about:
   • purpose of data processing;
   • for the relevant categories of personal data being processed;
   • recipients or categories of recipients of personal data, in particular recipients located outside the EU/EEA;
   • the intended data storage period;
3. ask to correct the data. The data subject has the right to correct the data if it is inaccurate or incomplete. BIOR is obliged to provide an answer within one month, or to provide an explanation why BIOR may not have the opportunity to correct the data;
4. request data deletion (right to be forgotten). The data subject has the right to request the deletion of personal data or the termination of their processing. BIOR can refuse to delete personal data if the processing of this data is necessary for BIOR to fulfill its obligations set out in regulatory acts. In that case, BIOR is obliged to provide an explanation why the data cannot be deleted;
5. ask to restrict the processing of the Data Subject’s data. In some cases, the Data Subject has the right to request the restriction of data processing, for example, when the Data Subject disputes the accuracy of the personal data or in the case where the data is no longer needed for processing, but the Data Subject needs them, for example, to file a lawsuit. In that case, BIOR will no longer process the relevant personal data;

6. object to data processing, including object to the use of personal data for profiling, i.e. automatic processing of personal data to evaluate or predict a person’s performance at work, economic situation, health, personal preferences, interests, behavior, reliability, location or movement, which may result legal consequences for a person. If such objections are justified, BIOR will no longer process the relevant personal data, except in the cases specified in the General Data Protection Regulation;
7. withdraw your consent, without prejudice to the lawfulness of such processing carried out before the withdrawal of the Data Subject’s consent;
8. request that the personal data related to the Data Subject be provided to the person in a structured, generally accepted and machine-readable format, so that the Data Subject can transfer such personal data to another data controller, or directly transfer such personal data to another data controller, if this is technically possible;
9. exercise the right not to be the subject of a decision based solely on automated processing (without human intervention), including profiling, which creates legal consequences for the Data Subject or significantly affects it in a similar way;
10. submit a complaint to the Data State Inspectorate;
11. receive compensation if the Data Subject has suffered material or moral damage as a result of data protection violations (loss, theft, leakage).

JIf you have questions about the processing of personal data or if you have doubts that personal data is safe, please contact BIOR’s Data Protection Specialist by writing to the e-mail address: datuaizsardziba@bior.lv.

If the Data Subject is not satisfied with the response received, the Data Subject has the right to submit a complaint to the Data State Inspectorate (Blaumania Street 11/13, Riga, LV-1011).

Different rules

BIOR has the right to make changes or additions to this Privacy Policy by publishing the current version of the Privacy Policy in the “Privacy Policy” section of the BIOR website www.bior.lv.