Privacy policy of Waterson Riga, 14th December, 2022.
PRIVACY POLICY In accordance with the GDPR, Article 24
1.1. WATERSON – SIA “Waterson Technologies”.
1.2. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation).
1.3. Personal data – any information relating to an identified or identifiable natural person; an identifiable natural person shall be one which may be identified directly or indirectly, in particular by reference to an identifier, such as the name, surname, identification number, location data, online identifier or one or more of the physical characteristics of that person, factors of genetic, spiritual, economic, cultural or social identity.
1.4. Personal data processing – any activity or set of activities, which are performed on Personal data or on sets of Personal data with or without automated means, such as collecting, recording, organising, structuring, storing, adapting or transforming, recapturing, viewing, using, disclosing, transmitting, disseminating or otherwise making available, comparing or restricting Personal data or Personal data sets, removal, erasure or destruction of Personal data.
1.5. Controller – a natural or legal person who, alone or jointly with others, determines the purposes and means of Personal data processing.
1.6. Processor – a natural or legal person, public authority, agency or other body, which processes Personal data on behalf of the Controller.
1.7. Client – a natural or legal person who uses and orders the services offered by WATERSON.
1.8. Co-operation partner – a natural or legal person providing its services to WATERSON who does not process the Personal data held by WATERSON on behalf of WATERSON.
1.9. Data subject – a natural person identified or identifiable directly or indirectly, including all WATERSON Clients, Co-operation partners and their designated contacts or trustees.
1.10. Data subject’s consent – any freely provided, specific, informed and unequivocal reference to the wishes of the Data subject, by which the Data subject, in the form of a statement or clearly affirmative action, gives consent to the processing of his or her Personal data for a specific purpose.
2.1. This privacy policy (“Privacy Policy”) is the rules of WATERSON designed to provide information to its Clients and Co-operation partners about the processing of Personal data carried out by WATERSON, its legal basis, scope, protection, processing and storage, the sources of Personal data, the recipients of Personal data, and the rights of the Data subject during the acquisition and processing of Personal data.
2.2. The Privacy Policy shall apply to the protection of privacy and Personal data in relation to:
2.2.1. natural persons – Data subjects, namely, WATERSON Clients, Co-operation partners, as well as third parties identified as contacts or authorised persons during the provision of services offered by WATERSON or co-operation;
2.2.2. legal persons, where their name contains Personal data or it is possible to identify a natural person, directly or indirectly, on the basis of the information provided by them.
4.1. GDPR;
4.2. The Civil Law of the Republic of Latvia;
4.3. Commercial Law of the Republic of Latvia;
4.4. The Law on Accounting of the Republic of Latvia;
4.5. The Law of the Republic of Latvia on Taxes and Fees;
4.6. 21.10.2003. regulation No. 585 of the Cabinet of Ministers of the Republic of Latvia “Regulations Regarding the Conduct and Organization of Accounting”.
5.1. The Controller is WATERSON: SIA “WATERSON TECHNOLOGIES”, registration number: 50203398971, registered office: Ojara Vaciesa 7-1, Rīga, LV-1004, e-mail address: info@waterson.lv.
5.2. In matters related to the processing of Personal data by WATERSON, contact the person responsible for the processing of Personal data: Dāvids Štēbelis, info@waterson.lv. Using this contact information, the Data subject may submit a request for the exercise of his or her rights in accordance with the Article 12.5. of the Privacy Policy.
6.1. WATERSON shall process Personal data on the basis of the following legal bases referred to in the Article 6 of the GDPR:
6.1.1. Entering into and executing a contract to enable WATERSON to carry out its commercial activities and to provide its Clients with the services they require, including the establishment of a service, author or co-operation agreement for its conclusion with the Data subject, and to ensure the proper performance of their contractual obligations or their modification after the conclusion of the contract, as well as a proper termination of contractual obligations;
6.1.2. For the fulfilment of legal duties specified in external regulatory enactments, in order for WATERSON, in accordance with the laws and regulations binding on it and in force in the Republic of Latvia and the EU, to fulfil the legal duties specified for it in relation to itself, Data subjects, the State and local government authorities, as well as third parties, such as drawing up and entering into agreements and other documents in compliance with the requirements specified in the law, issuing invoices complying with the requirements specified in the law regarding the services provided, make statutory contributions to the State budget, ensure adequate accounting and financial records and management;
6.1.3. In accordance with the Data subject’s consent, WATERSON can offer data subjects participation in other projects managed and organised by WATERSON as soon as they are available. The Data subject is entitled to withdraw his or her consent at any time and to request the termination of the processing of Personal data provided on the basis of the consent in accordance with the Article 12.2. of the Privacy Policy;
6.1.4. For the fulfilment of legitimate interests of WATERSON, to fulfil the obligations between WATERSON and the Data subject, the legitimate interests arising out of the contract concluded or the law, including:
6.1.4.1. Ensuring and improving the quality of the service requested by the Data subject, namely the Client, and its execution process;
6.1.4.2. Ensuring that the Data subjects are properly equipped with the conditions for the execution of the project and that the filming process is organised effectively;
6.1.4.3. Ensuring compliance with the conditions of the established co-operation with Data subjects, namely the Co-operation Partners, and maintaining co-operation;
6.1.4.4. Ensuring efficient accounting and analysis of services, financial and business services provided and efficient management processes of WATERSON;
6.1.4.5. Eliminating unjustified risks of physical, IT security and copyright infringement and taking preventive measures;
6.1.4.6. Ensuring the protection of the property of WATERSON and of the Client property stored in the archive, namely film materials;
6.1.4.7. Preventing fraud and theft;
6.1.4.8. Avoiding unjustified financial risks;
6.1.4.9. Ensuring the quality control of the operations and internal management of WATERSON;
6.1.4.10. Verifying the identity of the Data subject prior to the conclusion of the contract;
6.1.4.11. Ensuring compliance with the obligations of the concluded contract;
6.1.4.12. Turning to the public administration, operational and judicial authorities for the protection of the legitimate interests of WATERSON.
6.1.5. In pursuing the legitimate interests of WATERSON, prior to the processing of Personal data, the interests of WATERSON are assessed in relation to the rights of the Data subject in such a way that the legitimate interests of a commercial nature of WATERSON do not conflict with the interests and freedoms of the Data subject. Data subject shall at any time be entitled to request that the processing of its Personal data on the basis of legitimate interests be discontinued in accordance with the Article 12.1. of the Privacy Policy.
7.1. WATERSON may hold and process the following categories of Personal data and other information provided by the Data subject, which may be considered as Personal data in cases where the Data subject can be identified directly or indirectly and used for the following purposes:
7.1.1. For the provision of services to the Client, including identification of the Client, acceptance of an order, drafting, conclusion, execution of a service agreement or its modification following the conclusion of the agreement, communication with the Client or its authorised representative at the time of the commencement and provision of the service, hiring of appropriate Co-operation partners, invoicing of the services provided and keeping accounting records, preparation of filming schedules, the recording of persons permitted in the filming area and the effective organisation of the filming process:
7.1.1.1. Client’s name and surname;
7.1.1.2. Client’s personal identification number or date of birth, if the Client does not have a personal identification number;
7.1.1.3. Declared or actual address of the Client’s place of residence;
7.1.1.4. Client’s phone number;
7.1.1.5. Client’s e-mail address;
7.1.1.6. Client’s bank account number;
7.1.1.7. Written signature of the Client on the contracts concluded and on other documents required for the performance of the service signed with the WATERSON or the Co-operation partners of WATERSON;
7.1.1.8. Name of the Client who is a legal person;
7.1.1.9. Registration number of the Client who is a legal person;
7.1.1.10. Legal or correspondence address of the Client who is a legal person;
7.1.1.11. Name and surname of the representative or authorised person of the Client who is a legal person;
7.1.1.12. Position or basis of representation of the person who represents the Client who is a legal person;
7.1.1.13. Telephone number of the representative or authorised person of the Client who is a legal person;
7.1.1.14. E-mail address of the representative or authorised person of the Client who is a legal person;
7.1.1.15. Written signature of the representative or authorised person of the Client who is a legal person on the contracts concluded and on other documents required for the performance of the service signed with the WATERSON or the Co-operation partners of WATERSON;
7.1.2. For the recruitment of appropriate Co-operation partners for the organisation and management of the project, including the drafting, conclusion, execution of a co-operation or service agreement with the Co-operation partner in the interests of WATERSON or its Clients, or modification of the agreement after the conclusion of the agreement, the communication with the Co-operation partner or its authorised representative at the time of receiving of the services, the payment for the services received and keeping of financial records, the submission of information to the State Revenue Service or other State administrative authorities in the cases specified in the external regulatory enactments, the development of a filming schedule, the recording of persons permitted in the filming site and the effective organisation of the filming process:
7.1.2.1. Co-operation partner’s name and surname;
7.1.2.2. Co-operation partner’s personal identification number or date of birth of the Co-operation partner, if the Co-operation partner does not have a personal identification number;
7.1.2.3. Declared or actual address of the Co-operation partner’s place of residence;
7.1.2.4. Co-operation partner’s telephone number;
7.1.2.5. Co-operation partner’s e-mail address;
7.1.2.6. Co-operation partner’s bank account number;
7.1.2.7. Written signature of the Co-operation partner on the contracts concluded and other documents required for the performance of the service signed with WATERSON or its Clients;
7.1.2.8. Name of the Co-operation partner who is a legal person;
7.1.2.9. Registration number of the Co-operation partner who is a legal person;
7.1.2.10. Legal or correspondence address of the Co-operation partner who is a legal person;
7.1.2.11. Name and surname of the representative or authorised person of the Co-operation partner who is a legal person;
7.1.2.12. Position or basis of representation of the representative or authorised person of the Co-operation partner who is a legal person;
7.1.2.13. Telephone number of the representative or authorised person of the Co-operation partner who is a legal person;
7.1.2.14. E-mail address of the representative or authorised person of the Co-operation partner who is a legal person;
7.1.2.15. Written signature of the representative or authorised person of the Co-operation partner who is a legal person on the contracts concluded and on other documents necessary for the performance of the service signed with the WATERSON or its Clients;
7.1.3. After the provision of services or the termination of co-operation, WATERSON may store the Personal data of Talent referred to in Articles 5.1.2.8. and 5.1.1.9. of the Privacy Policy in the WATERSON archives in the framework of agreements concluded with the Client;
7.1.4. After the provision of services or the termination of co-operation, WATERSON may only store or otherwise process personal data which are necessary for the performance of the duties specified in the regulatory enactments, including the fulfilment of the requirements specified in the Law On Accounting, as well as for the protection of the legitimate interest of WATERSON public administration, operational activities and judicial authorities.
8.1. Data subject’s Personal data held by WATERSON shall be collected or received from the following sources on the legal basis for Personal data processing referred to in the Article 4 of the Privacy Policy:
8.1.1. Personal data submitted by the Data subject or its representative directly or remotely, including the Client’s submission of their Personal data or Personal data of Co-operation partners, which have been attracted by the Client for a specific project prior to the establishment of an agreement with WATERSON;
8.1.2. Public registers, databases and publicly available information systems, such as data held by the Enterprise Register of the Republic of Latvia or the European Business Register, data available in the e-register of sanctions of the Ministry of Foreign Affairs of the Republic of Latvia, data available in the public registers and databases of the Republic of Latvia, the European Union and the United Nations;
8.1.3. Personal data of the Data subject issued by the Office of Citizenship and Migration Affairs for judicial purposes;
8.1.4. Video and audio material related to the final product of projects organised by WATERSON;
8.1.5. Information provided by third parties, if receipt of such information is provided by regulatory enactments.
9.1. Personal data shall be processed in good faith, legally and transparently to the Data Subject, using the organisational, financial and technical resources reasonably available to WATERSON.
9.2. Personal data shall be collected for specific, clear and legitimate purposes and shall not be further processed for originally not disclosed purposes or in a manner incompatible with those purposes.
9.3. Personal data shall be stored in such a way as to enable the Data subject to be identified, for a period not exceeding that required for purposes within which Personal data was collected or processed. WATERSON periods for the storage of Personal data are set out in the Article 13 of the Privacy Policy.
9.4. Personal data shall be collected in accordance with the principle of minimisation of Personal data processing, which means that Personal data are adequate, relevant and include only what is necessary for their processing purposes.
9.5. WATERSON provides the accuracy of Personal Data and, if necessary, Personal data are updated according to the current information or permanently deleted.
9.6. Personal data shall be processed in such a way as to ensure adequate security of Personal data, namely protection against unauthorised or illegal processing, accidental loss, destruction or damage of Personal data.
9.7. In order to ensure performance of the contractual obligations with the Data Subject, WATERSON is entitled to attract and authorise other service providers to perform separate activities on behalf of WATERSON. If, in the performance of these tasks, the authorised persons of WATERSON process the Personal data of the Data subject held by WATERSON on its behalf, the performers of that task shall be deemed to be the Processors of Personal Data in possession of WATERSON, and WATERSON shall have the right to transmit to the Processors Personal data required to perform the assigned actions.
9.7.1. In cases, where WATERSON authorise the Processors to perform a particular task, both WATERSON and the Processor shall ensure a proper protection of the processing of Personal data according to the GDPR and shall not use Personal data for purposes other than the fulfilment of the established commitments against the Data subject on behalf of WATERSON.
10.1. Information regarding the Personal data of the Data subject held by the Processors and their sub-contractors WATERSON shall provide upon a request of the Data subject submitted in accordance with Article 12.5. of the Privacy Policy.
11.1. WATERSON protects Personal Data by using modern technology possibilities, taking into account existing privacy risks and the reasonably available organisational, financial and technical resources of WATERSON, including through the following safeguards:
11.1.1. Ensures protection against unauthorized access to Personal data stored in WATERSON internal IT systems, databases and electronic mail by using a local server and internal network and a unique user name and password assigned to each person employed by WATERSON and being representative of WATERSON;
11.1.2. Grants to each person employed by WATERSON and being representative of WATERSON individual rights of access to the internal IT systems and databases of WATERSON and to the documentation and Personal data stored therein only for the performance of direct employment duties;
11.1.3. Uses firewall and antivirus programs;
11.1.4. Regularly carries out appropriate security checks against the existence of intentional attacks on the WATERSON server and network, databases and electronic mail, and of any leakage of Personal data;
11.1.5. Ensures that persons working with Personal data under the management of WATERSON are adequately trained, and have received appropriate and clear instructions on the processing of the Personal data to be carried out, including safety instructions included in the Privacy Policy;
11.1.6. Ensures that any accidental or illegal deletion, corruption, loss, correction, processing, disclosure or leakage of Personal data to third parties is not permitted;
11.1.7. Ensures that all paper-based documents and confidential information are stored in a restricted location, namely in cabinets in the office of WATERSON, accessible only by persons employed by WATERSON and by representatives of WATERSON for the performance of their direct employment duties;
11.1.8. Ensures that all paper-based documents and confidential information, once their processing and storage periods have expired, are destroyed by shredding it with the appropriate equipment and disposed of separately from other office and administrative waste;
11.1.9. Provides limited access to the premises of the WATERSON office only to persons employed by WATERSON and representatives of WATERSON with security code and door key;
11.1.10. Ensures that, during the execution of projects organised by WATERSON, only the participants in the project and the staff of WATERSON are allowed to enter the filming site.
12.1.1. Personal data held by WATERSON shall not be transmitted to third parties unless:
12.1.2. Personal data must be transferred to the third party concerned within the framework of the contract in order to carry out any function necessary for the performance of the contract or as delegated by law;
12.1.3. Data subject has given clear, unambiguous consent for the transfer of Personal data;
12.1.4. Disclosure of Personal data is the responsibility of WATERSON to the persons provided for in the external regulatory enactments, upon a reasoned request, in accordance with the procedures and to the extent specified in the external regulatory enactments.
12.1.5. For the protection of legitimate interests of WATERSON, for example by submitting a claim to the court or other State authorities against a person who infringed the legitimate interests of WATERSON.
12.2. When transferring Personal data to third parties, WATERSON shall evaluate the level of protection of third-party Personal data processing in accordance with regulatory enactments in order to ensure the protection of Data subject’s information as much as possible.
13.1. WATERSON processes the Personal data at its disposal for as long as the following conditions are met:
13.1.1. While the process of performing the service provided by WATERSON is in progress;
13.1.2. As long as the contractual relationship with the Data subject is in force;
13.1.3. As long as Personal data are required for the purpose for which they were received;
13.1.4. For as long as it is necessary to ensure that the legitimate interests of WATERSON or the Data subject are exercised, for example, so that WATERSON or the Data subject are able to object or bring an action before the court, while the defendant is able to defend his or her rights;
13.1.5. As long as either party has a legal obligation to store Personal data, for example, in accordance with the Civil Law, Commercial Law or the Law on Accounting;
13.1.6. Filming schedules prepared by WATERSON and distributed to the Data subjects involved in the filming process shall be provided for the entire time of the filming process and permanently destroyed at the end of the filming process by shredding them;
13.1.7. Personal data in the Talent database created by WATERSON is checked and, if necessary, updated every 5 years or permanently deleted if the Personal data is no longer up to date or the Data subject, namely Talent, has withdrawn its consent for such processing of Personal data;
13.1.8. Video and audio materials stored in the WATERSON archive developed during the provision of services are stored until the Client requests the deletion or destruction of such materials or WATERSON has to issue it to third parties in cases specified by law, such as during an investigation or supervisory procedures.
13.2. When none of the conditions referred to in the Article 11.1. of the Privacy Policy are no longer applicable, Personal data shall be permanently deleted or otherwise permanently destroyed.
13.3. Paper-based documents are stored in a restricted availability location, namely in cabinets in the office of WATERSON, in accordance with the time limits specified by regulatory enactments, but for a maximum of 10 years, as well as in certain cases to ensure the legitimate interests of WATERSON, such as the performance of contractual obligations, the collection of debts, in the event of potential litigation, during the limitation periods set out in the law.
14.1. The Data subject shall have the right to obtain information on what Personal data are at the disposal of WATERSON in relation to the processing of Personal data of the Data subject and to request access to his or her Personal data, correction, update or deletion of it, to limit the processing of Personal data, including the processing of Personal data carried out on the basis of the legitimate interests of WATERSON, as well as to exercise the right to Personal data portability, to the extent that WATERSON can provide it technically. Rights of the Data subject shall be exercised to the extent that this does not conflict with the obligations of WATERSON laid down in regulatory enactments.
14.2. In the case of the processing of Personal data, where the legal basis is solely the consent of the Data subject, the Data subject shall have the right to withdraw the consent given at any time by suspending further processing of Personal data which has been carried out on the basis of the consent given by the Data subject. Withdrawal of consent shall not result in the cessation of the processing carried out on the basis of other legal bases.
14.3. The withdrawal of consent shall not affect processing operations carried out during the period, when the Data subject’s consent was valid.
14.4. The Data subject may withdraw the given consent in the same way and form as it has been given (in writing, electronically, etc.) and, where necessary, provide all information on the consent, its nature, the processing of Personal data resulting therefrom.
14.5. The Data subject may apply for the exercise of his or her rights by submitting to the person responsible for Personal data protection at the WATERSON a filled-out form available at the office of WATERSON or by sending it to the e-mail address: info@waterson.lv.
14.6. Upon receipt of a request for the exercise of the rights of the Data subject, WATERSON shall verify the identity of the Data subject, evaluate the request and comply with so far it is in accordance with regulatory enactments.
14.7. The reply of WATERSON shall be sent to the electronic mail address of the Data subject within 30 days from the time the responsible person for the processing of Personal data at WATERSON received the request from the Data subject or through postal services by signed-for mail. If it is necessary to clarify the information or to carry out more detailed research, the reply may require a longer period than 30 days, depending on the content of the request, but not more than 60 days.
14.8. In cases, where Personal data is processed on the basis of regulatory enactments, contractual obligations, or in order to pursue the legitimate interests of WATERSON, a request for the deletion of Personal data may not be implemented, for which the Data subject is informed within 30 days from the time when the responsible person of WATERSON has received a request for the deletion of Personal data. The answer is provided with clear, unequivocal justification for why the deletion of Personal data cannot be enforced. On the other hand, in the event of a reasoned request for the deletion of Personal data, adequate deletion of Personal data shall be ensured within 30 days of the date of receipt of the request from the Data subject.
14.9. In cases where a breach of the processing or protection of Personal data has been detected or a potential breach has been rectified, WATERSON shall carry out an assessment of the impact of the infringement or potential infringement on the processing of Personal data to WATERSON and/or the Data subject and its Personal data protection, if necessary, informs the Data subject of such violation or potential infringement and the National Data Inspectorate of the Republic of Latvia within 72 hours from the time of the detection of the violation or the moment when WATERSON became aware of a potential violation of the processing of Personal data. The Data subject may submit a request to WATERSON for the provision of information relating to any identified or potential breaches of the processing of Personal data related to the processing and protection of the Data subject’s Personal data in accordance with Article 12.5. of the Privacy Policy.
14.10. Disputes related to the processing of Personal data should be negotiated between the Data subject and WATERSON. If the Data subject considers that the processing of Personal data infringes the rights and interests of the Data subject in accordance with the applicable regulatory enactments, or that a serious infringement of the processing of Personal data of the Data subject, about which WATERSON has not reported to the Data subject or the supervising authority, the Data subject has the right to submit a complaint to the person responsible for Personal data processing at WATERSON, by submitting a completed complaint form on the Personal data processing available at the WATERSON office or website https://www.WATERSON.lv, or by addressing the National Data Inspectorate of the Republic of Latvia, address: Blaumana Street 11/13-11, Riga, LV-1011, Latvia, e-mail address: info@dvi.gov.lv.
15.1. WATERSON is constantly developing its activities and developing the services it provides, as well as maintaining co-operation with the Co-operation partners, meaning that the Privacy Policy can be changed or supplemented at any time.
15.2. The latest version of the Privacy Policy is always available on the website of WATERSON at https://www.waterson.lv. At the same time, the latest version of the Privacy Policy and all previous versions are available to the Data subject by addressing the person responsible for the processing of Personal data at WATERSON.
15.3. Privacy policy has been prepared in the official language of the Republic of Latvia. In the event that a translation into another language is provided for the Privacy Policy, the Latvian text will prevail in the case of a different interpretation of the Privacy Policy.