Privacy policy

1. Purpose

1.1. The purpose of this Privacy Policy is to inform a natural person—the data subject—about the purposes, scope, protection and duration of personal data processing when their data are collected and processed.

2. Personal data controller

2.1. The personal data controller is SIA “V.V. Mācību centrs” (the Educational Institution), of which Rīgas 1. Tālmācības vidusskola (R1TV) is a structural unit. Registration number: 53603062391; registered address: “Iklāvi”, Iecavas novads, LV-3913; telephone: 20212200; email: info@r1tv.lv.

2.2. R1TV’s email address for matters relating to personal data processing is info@r1tv.lv.

3. General provisions

3.1. This Privacy Policy provides a general description of how the Educational Institution processes and protects personal data.

3.2. In processing personal data, the Educational Institution complies with the Education Law, the General Education Law, Cabinet Regulation No. 288 on the implementation of general basic and general secondary education programmes in extramural and distance-learning forms, Cabinet Regulation No. 177 on the State Examination Information System, Cabinet Regulation No. 276 on the State Education Information System, Cabinet Regulation No. 274 on issuing state-recognised general education documents, Cabinet Regulation No. 528 on mandatory documentation for organising the pedagogical process in general and vocational education institutions and the acquisition of professional qualifications at examination centres, Cabinet Regulation No. 398 on the content and conduct of centralised examinations, the Cabinet regulations on accreditation of educational institutions, examination centres, other institutions specified in the Education Law and educational programmes, and on the assessment of the professional activities of heads of educational institutions, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to personal data processing and on the free movement of such data, repealing Directive 95/46/EC (the General Data Protection Regulation), the Personal Data Processing Law and other applicable legislation.

3.3. Within the framework of applicable legislation, the Educational Institution ensures the confidentiality of personal data and implements appropriate technical and organisational measures to protect them against unauthorised access, unlawful processing or disclosure, and accidental loss, alteration or destruction.

3.4. The Educational Institution may use personal data processors. In such cases, it takes the necessary measures to ensure that processors act in accordance with its instructions and applicable legislation, and requires appropriate security measures.

4. Data categories, purposes and legal basis

4.1. The categories of personal data predominantly, but not exclusively, collected and processed by the Educational Institution are:

Education data

Learners in general education programmes: identifying information about learners, their representatives and education staff, including teachers: name, surname, personal identity number, contact details, the learner’s relatives (parents), the legal representative’s personal identity number, passport details and contact details, service agreement, education data, copies of diplomas, medical certificates (forms u26 and u27), service fees, payment information and other data about learners and education staff required by legislation governing education. These data enable the Institution to implement general education programmes.

Learners in professional development programmes: identifying information about clients, learners, prospective learners and education staff, including teachers: name, surname, personal identity number, contact details, service agreement, service fee, payment information and the education document for the particular course. These data enable the Institution to implement lifelong learning and adult education programmes.

Prospective learners: identifying information—name, surname, personal identity number and contact details—to prepare and conclude an agreement for the provision of educational programmes.

Human resources data

Data about job applicants: education, qualifications, position, workplace, contact details and CV. Data about employees, including teachers: name, surname, position, personal identity number, CV, passport details, contact details, employment agreement, bank details, employee account, relatives, education, courses, language skills, leave, certificates, documents, employment history, termination, work information and health data concerning temporary incapacity for work and mandatory health examinations. These data are processed for personnel management, including recruitment, in accordance with legislation.

Accounting data

Data about employees: name, surname, position, date of birth, personal identity number, passport details, residential and declared address, contact details, employment agreement, employment history, bank account number, remuneration and changes to it, bonuses, supplements, health and accident insurance, leave and holiday pay, temporary incapacity for work, mandatory health examinations, taxes paid, allowances, courses, children’s names, surnames, personal identity numbers and residential addresses. Data about clients, service providers, suppliers, partners and their representatives include representatives’ names, surnames, positions, contact details and agreements. These data are processed to maintain accounts in accordance with legislation.

Records management data

Name, surname, personal identity number, residential and declared address, position, contact details (telephone and email), correspondence, meeting proceedings and decisions, to maintain records in accordance with legislation.

Data used to report on activities and events and to advertise and promote services

Names, surnames, positions, occupations and contact details (telephone and email) of event visitors and participants, employees and media representatives, and images of people in video recordings or photographs, to inform the public about the Institution’s activities and to advertise its operations and services.

Video surveillance in the controller’s office

Images of employees and visitors showing their appearance, clothing, gait and direction of movement, to prevent, deter and/or detect possible infringements affecting the property, life or health of the controller and employees.

Other data

Data provided by the person themselves; data whose processing is necessary to meet legal requirements in implementing general education and professional development programmes; or data necessary for the legitimate interests of the Educational Institution or a third party.

4.2. Personal data are processed for the following purposes:

• Performing the legally prescribed functions and tasks of an accredited provider of general education and professional development programmes. This includes identifying learners and their legal representatives; preparing and concluding agreements; fulfilling contractual obligations; recording learners’ educational progress, including final examinations; administering payments; handling objections and claims; measuring learner and legal representative satisfaction; providing communication between the Institution, learners and parents or legal representatives through school management systems; keeping documents needed for education in electronic form; and organising and providing education generally.
• Personnel management: recruitment and preparation and management of documents relating to employees and their employment.
• Maintaining the Institution’s accounts.
• Records management, establishing contractual relationships and fulfilling contractual obligations.
• Informing the public about the Institution’s activities and advertising and promoting its services.
• Protecting the legitimate interests of the Institution and third parties where necessary.

4.3. Legal bases for personal data processing:

• Compliance with a legal obligation imposed on the Institution: Article 6(1)(c) GDPR.
• Concluding and performing agreements: Article 6(1)(b) GDPR.
• Performing tasks in the exercise of official authority lawfully vested in the Institution: Article 6(1)(e) GDPR.
• The data subject’s consent: Article 6(1)(a) GDPR.
• Where necessary for the Institution’s legitimate interests arising from its obligations or agreement with the data subject, or from legislation: Article 6(1)(f) GDPR.

An overview of data categories, processing purposes and legal bases is attached to this Privacy Policy as an annex.

5. Special categories of personal data

5.1. The GDPR prohibits processing personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership; genetic data; biometric data used to uniquely identify a natural person; health data; and data concerning a person’s sex life or sexual orientation.

5.2. The GDPR provides exceptions, including where processing is necessary for the controller to fulfil obligations imposed by law or where the data subject has given explicit consent for specified purposes. The Educational Institution processes a limited amount of legally required health data about employees and learners to fulfil its legal obligations, such as temporary incapacity for work, mandatory health examinations and information in a learner’s medical record.

6. Automated decision-making

6.1. The Educational Institution does not carry out automated decision-making, including profiling.

7. Personal data protection

7.1. The Institution protects personal data using modern technology, taking account of existing privacy risks and the organisational, financial and technical resources reasonably available to it. Measures include:

• Encryption during data transmission (SSL encryption).
• Intrusion prevention and detection software.
• Other protective measures appropriate to current technological developments.

8. Data recipients and sources

8.1. Recipients include educational institutions in Latvia and/or abroad, learners and their parents or legal representatives, service providers supporting education (for example, operators of the “E-klase” and “eSKOLA” school management systems), competent national and municipal authorities and their information systems, including the State Examination Information System and the State Education Information System. Data may also be made available to auditors and other persons contracted and authorised by the Institution to perform specific tasks.

8.2. Data are not transferred to third countries. Information published on the Institution’s website (www.r1tv.lv) and its Facebook page and Twitter, Instagram and YouTube accounts may be accessible from abroad, including third countries outside the EU and EEA.

8.3. The Institution obtains personal data from data subjects and competent authorities, including their state registers and information systems, such as the State Examination Information System and the State Education Information System.

9. Retention periods

9.1. Personal data are processed for as long as necessary for the relevant purpose and in accordance with applicable legislation.

9.2. Retention periods, or the criteria used to determine them where a period cannot be specified:

• Information required to fulfil a legal obligation is retained for as long as necessary to achieve the processing purpose in accordance with applicable legislation.
• Recruitment information is retained in whole or in part for no longer than six months after the application is received, unless a complaint about recruitment has been received. In that case it is retained for as long as necessary to resolve the dispute.
• Personal data provided by prospective learners are retained for two years from receipt of the application. They are deleted if no service agreement is concluded during that period.

The following criteria are used to determine retention periods:

• Data are retained while the person or Institution may exercise legitimate interests under applicable legislation, for example for audits, dispute resolution or protection of rights.
• Data are retained while either party has a legal obligation to keep them.
• Data are retained while the data subject’s consent remains valid, where no other legal basis applies.

9.3. At the end of the retention period, personal data are deleted, destroyed or transferred to the state archives in accordance with legal requirements.

10. Data subject rights

10.1. A data subject has the following rights:

• To receive the information required by law about the Institution’s processing of their data.
• Subject to legislation, to request access, supplementation, rectification, erasure or restriction of processing; to object to processing; and to request data portability.
• To withdraw consent at any time unless processing rests on another legal basis, such as legislation binding on the Institution. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal.
• To complain to the Data State Inspectorate (www.dvi.gov.lv) if they believe processing infringes their rights and interests under legislation.
• To submit a written request to exercise their rights. The Institution accepts documents by post or email, with emailed documents signed using a secure electronic signature.

11. Website cookies

Cookies are small text files sent to a user’s computer or mobile device during a website visit and stored there when the user opens the site. On subsequent visits they are returned to the originating website or another website that recognises them. Cookies act as a website’s memory, allowing it to recognise the user’s computer on later visits, remember settings and improve convenience.

Cookies can be controlled or deleted. Most browsers can be configured to block their storage. Some settings will then need to be adjusted on every visit, and certain services or functions may not work. Further information in English: aboutcookies.org.

The Institution uses Google Analytics, which creates cookies, to assess website performance and visitor behaviour: visit statistics, visitors’ countries and cities, referral channels such as Google, Facebook and Delfi, and popular sections. Further information in English: Google Analytics terms.

A visitor who does not want information about their activity on the Institution’s site to be collected should activate the Google Analytics Opt-out Browser Add-on. The add-on communicates with Google Analytics JavaScript (ga.js) to indicate that information about the visit should not be sent to Google Analytics.

12. Commercial communications

The Institution sends commercial communications about its services and other messages unrelated to providing those services, such as customer surveys, in accordance with legislation or the client’s consent.

The Institution may also communicate with clients and prospective clients using automated calling equipment.

Consent to commercial communications may be given on www.r1tv.lv, in service application forms, through the Institution’s social network accounts and applications/websites, or to its representatives. Consent remains valid until withdrawn, including after a service agreement ends. Recipients may opt out at any time by emailing info@r1tv.lv, changing device notification settings or using the automated unsubscribe option in the communication, including the unsubscribe link at the end of an email.

The Institution stops sending commercial communications once the recipient’s request has been processed. Processing depends on technical capabilities and may take up to three days.

By expressing an opinion in a survey and leaving contact details (email or telephone), the client agrees that the Institution may contact them using those details about the feedback they provided.

13. Final provisions

This Privacy Policy contains information required by Articles 13, 14 and 15 GDPR.

The Institution may amend or supplement this policy by publishing the current version in the “Privacy Policy” section of its website.

Annex: overview of personal data categories, processing purposes and legal bases.

Approved by decision No. 38 of the board of SIA “V.V. mācību centrs” dated 30 June 2023.