Privacy Notice

1. INTRODUCTION

This Privacy Notice ("Privacy Notice") has been prepared by SIA Latakko, UAB Latakko and OÜ Latakko ("Latakko", "we", or "us") to ensure that you receive the information we are required to provide to you- and which is necessary for you to exercise your rights under the General Data Protection Regulation (the "GDPR").

This Privacy Notice describes how we process personal data about you, the purpose of our processing activities, and the legal basis for our processing activities. This Privacy Notice also describes your rights in connection with our processing of your personal data under applicable data protection legislation.

2. GENERALLY ABOUT PERSONAL DATA

Personal data means any information relating to an identified or identifiable natural person (a "data subject"). Your name, phone number, address and e-mail address are examples of information which generally is regarded as personal data.

3. LATAKKO'S RESPONSIBILITY AS A CONTROLLER

Our processing of your personal data is described in Section 4 below. We will act as a controller when we process this personal data.

4. OUR PROCESSING OF PERSONAL DATA

4.1 Processing activities, purpose and legal basis

The following list includes information about the personal data which we process, the purposes of the processing activities, as well as their legal basis:

• Administrating agreements with customers and other business associates. We process personal data about our customers and other business associates, as well as their representatives and contacts, in order to administer and fulfill the agreements we have entered into with these companies, and maintain our business relationship. Such personal data include the data subjects' name, contact information, financial information, delivery address, occupation, credit score and our communication with the data subject. The legal basis for this processing activity is that we have a legitimate interest in entering into and administrating such agreements, as well as a legitimate interest in maintaining the business relationship we have with these parties and their representatives.
• Recruitment. If you are a job applicant or a potential candidate for any of our positions, we will collect and process your personal data, such as contact details, i.e. your name, email address, postal address and phone number, as well as your job title, your application, CV, test results, diplomas, certifications and statements from references. Our processing is based on our legitimate interest in finding and hiring new personnel.

We may, depending on the circumstances, also process other categories of personal data, and/or the above listed personal data for other purposes. This may for example be the case if you contact us with questions or comments. You may at any time request confirmation and/or information regarding the personal data which we process about you, by contacting us at the contact information set out below.

4.2. The sources we obtain personal data from

We collect the personal data described in Section 4.1 above from the following sources:

• Administrating agreements with customers and other business associates. The personal data we process about the representatives and contact persons of our customers and other business associates are primarily obtained directly from the relevant customers, representatives and contacts. We may also obtain personal data from credit agencies.
• Recruitment. The personal data we process for recruitment purposes is primarily obtained directly from the candidate, as well as from the candidate's references and publicly available sources. We may also obtain the candidate's personal data from head hunters and recruitment agencies.

5. DO WE TRANSFER OR DISCLOSE DATA TO THIRD PARTIES?

We use external service providers to assist with IT services and other administrative services. These service providers will act as processors on our behalf. We have entered into data processing agreements with our processors which inter alia obligates the data processor to implement technical and organizational measures to ensure an appropriate level of security, confidentiality and integrity of the personal data, as well as to only process the relevant personal data in accordance with data protection legislation.

We will not disclose your personal data to any other third parties than the third parties described above, unless we are required to do so under applicable law, or if it is necessary in order to establish, exercise or defend legal claims.

6. DATA RETENTION

We will delete or anonymize personal data when they are no longer necessary in relation to the purposes for which they were collected or otherwise processed (if there are no legal basis for further processing of the personal data). If we process personal data to comply with our legal obligations, we will delete or anonymize the personal data when it is no longer necessary to process the data to comply with the relevant legal obligations.

7. YOUR DATA PROTECTION RIGHTS

You have certain rights under data protection legislation, we need to make you aware of. The rights available to you inter alia depend on our reason for processing your personal data. You have the following rights in connection with our processing of your personal data:

• Access. You may contact us if you want to obtain confirmation with respect to whether or not we are processing your personal data, as well as access to and further information regarding our processing of your personal data. You may also request a copy of the personal data we are processing about you. However, please note that we may be subject to a duty of confidentiality with respect to our investments and due diligence processes. This duty of confidentiality may limit our possibility to give you access to the personal data which is processed in connection with the investments.
• Rectification. You may request us to rectify and/or complete inaccurate or incomplete personal data.
• Erasure. You may request that we erase your personal data. We will respect and comply with your request unless we inter alia are prohibited from deleting your personal data under mandatory retention requirements, or the personal data is necessary for the establishment, exercise or defense of legal claims.
• Restriction of processing. You may also request the restriction of our processing of your personal data in accordance with data protection legislation. If the processing has been restricted, such personal data will, with the exception of storage, only be processed with your consent, for the exercise or defense of legal claims, the protection of the rights of another person, or for reasons of important public interest.
• Right to object. You are entitled to object to certain processing activities, including for example processing of your personal data for marketing purposes. You are furthermore, on grounds relating to your particular situation (for example, a specific need for protection of your identity), entitled to object to processing of personal data based on legitimate interests, which we will comply with, unless there exists compelling legitimate grounds for our processing which override your interest, or if our processing is necessary for the establishment, exercise or defense of legal claims.
• Data Portability. If we process your personal data based on consent or based on our performance of a contract, and the processing is carried out by automated means, you may request us to transfer the personal data to you or another controller, in a structured, commonly used and machine-readable format.

Please contact us at the below listed contact information if you wish to invoke your rights. Please also note that we may request additional information from you, if such information is necessary to confirm your identity.

8. SECURITY

As a controller, Latakko is responsible for the security and confidentiality of the personal data we process. We are furthermore responsible for implementing appropriate technical and organizational measures to ensure an appropriate level of security of processing.

All of our employees are bound by a duty of confidentiality with respect to the personal data which we process. We have furthermore implemented measures, policies and routines to ensure the security of our processing.

9. LODGING COMPLAINTS

You may contact us at any time if you have any questions or complaints regarding our processing of your personal data.

If you wish to find out more about your rights, or if you wish to file a complaint with a data protection authority, you can obtain more information by accessing the relevant website below:

SIA Latakko	The Latvian Data State Inspectorate	https://www.dvi.gov.lv/eng/
UAB Latakko	The Lithuanian State Data Protection Inspectorate	https://vdai.lrv.lt/en/
OÜ Latakko	The Estonian Data Protection Inspectorate	https://www.aki.ee/en/

You may file also file a complaint with a data protection authority in the EU/EEA Member State of your habitual residence, place of work, or the place of the alleged data protection infringement.

10. CHANGES

We may, from time to time, update this Privacy Notice for example due to changes in our processing activities, applicable data protection legislation or other legislation which may affect our processing of personal data. An updated version of this Privacy Notice will be published on our website if any revisions to the Privacy Notice is made.

11. CONTACT INFORMATION

If you have any questions about this Privacy Notice, including how we process personal data, or would like to submit a request to exercise your rights, please contact us at:

SIA Latakko	Latgales street 462 k-1, Riga, LV-1063 legal@latakko.lv
UAB Latakko	Partizanų g. 75C, LT-50308 Kaunas legal@latakko.lv
OÜ Latakko	Harju maakond, Tallinn, Kesklinna linnaosa, Kesk-Ameerika tn 7-1, 10122 legal@latakko.lv