Home › Privacy Policy

Privacy Policy

SIA “HANSABUSS Latvija”

GENERAL RULES

  • SIA “HANSABUSS Latvija”, registration No 40003262339, registered office at 2 Mednieku Street, Tukums, LV-3101, contact phone +371 80700002, e-mail address: info@hansalines.lv Using this contact information or contacting the registered office of SIA “HANSABUSS Latvija”, you can ask questions about the processing of personal data. A request to exercise your rights may be made in accordance with Section 6 “ACCESS TO PERSONAL DATA AND OTHER CUSTOMER RIGHTS” of the Privacy Policy.
  • The purpose of the Privacy Policy of SIA “HANSABUSS Latvija” (hereinafter – Privacy Policy) is to provide the client (hereinafter – Client) with information about the processing of personal data, in particular its purposes, scope, protection and storage of data.
  • The Privacy Policy is applicable to the processes of processing of the Client’s personal data carried out by SIA “HANSABUSS Latvija” (hereinafter – the Company), regardless of the form in which the Company receives the Client’s personal data. The Company is the controller and processor of personal data.
  • The Privacy Policy covers, among other things, video surveillance by the Company in the form of fixed video cameras placed in the cabins of buses, which film only the interior of the bus.
  • Customer for the purposes of the Privacy Policy means a natural person – a passenger or other person who wishes to use, uses or may use public transport services provided by the Company or a person who has concluded or is about to conclude a contract with the Company for the receipt of services.
  • The Privacy Policy has been drafted in accordance with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) and other applicable privacy and data processing legislation.

    THE LEGAL BASIS AND PURPOSE OF THE PROCESSING
  • The Privacy Policy is applicable to the Company’s processing of Customer personal data and the processing of personal data in relation to it on the following legal grounds:
    • the data subject’s consent, whereby the Customer consents to the processing of his/her personal data for a specific purpose (Article 6(1)(a) of the General Data Protection Regulation);
    • the conclusion and performance of a contract where the Customer is a contracting party (Article 6(1)(b) of the GDPR);
    • the Company is subject to a legal obligation based on external laws and regulations (Article 6(1)(c) of the General Data Protection Regulation);
    • the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company (Article 6(1)(e) of the General Data Protection Regulation);
    • legitimate interests for the purposes of the Company’s and the Customers’ obligations or the Company’s interests and obligations under laws and regulations (Article 6(1)(f) of the General Data Protection Regulation).
    • the technical and organisational measure taken by the Company in the public interest to prevent (including mitigate) corruption risks is the deployment of video surveillance equipment in places where the Company’s authorised employees conduct transactions with money (e.g. public transport drivers selling single tickets on certain routes. Video surveillance with audio recording as a physical control measure is recommended in the document of the Office for Preventing and Combating Corruption “Guidelines on the Basic Requirements of the Internal Control System for Preventing the Risk of Corruption and Conflict of Interest in a Public Person Institution” issued on the basis of the Cabinet of Ministers Regulation No 630 of 17 October 2017 “Regulations on the Basic Requirements of the Internal Control System for Preventing the Risk of Corruption and Conflict of Interest in a Public Person Institution”
  • The Company’s purposes for processing personal data in accordance with its legitimate interests are:
    • to carry out the commercial activity of providing passenger transport services;
    • effectively manage the Company’s business management processes, financial and business accounting and analytics, including customer surveys, research and analysis, service usage metrics and statistics, reporting, etc;
    • to perform and administer the tasks and duties assigned by the state and local government, including the granting and administration of fare concessions (granting and monitoring of fare concessions), verification and processing of the Customer’s personal data for the granting and administration of fare concessions;
    • protect property, including buses involved in the operation of the Company’s services;
    • protect vital interests, including life and health;
    • ensure the security of the relationship between the Client and the Employee, e.g. to ensure public order and safety, prevent security threats and ensure the safe provision of public transport services;
    • ensuring that public transport services are operated in accordance with the requirements of laws and regulations, e.g. public order, ticketing rules, rules for the use of public transport, including working order and occupational health and safety requirements;
  • With regard to the processing of data carried out in the process of video surveillance on the Company’s buses, a number of the above-mentioned purposes apply in accordance with the legitimate interests of the Company: to protect the vital interests of a person, including life and health; to prevent unlawful conduct, corruption and other high impact risks; to protect property, including buses involved in the provision of the Company’s services; to ensure security in the relationship between the Customer and the employee; to ensure compliance with the law and order in the provision of public transport services in accordance with the requirements of the regulatory enactments. Consequently, it is possible to define one common purpose of the Company with regard to the processing of personal data in the process of video surveillance: ensuring quality control and quality improvement of the services provided by the Company.

    RECIPIENTS OF PERSONAL DATA
  • The Company shall process the Client’s data using modern technological capabilities, taking into account the Company’s reasonably available organisational, financial and technical resources, ensuring confidentiality and adequate protection of personal data and processing them in accordance with the purposes of processing personal data, legal grounds and internal normative documents established by the Company.
  • When processing video surveillance data, the Company, as the data controller, shall ensure that only authorised persons have access to the technical and information resources used to process video surveillance data, and that the processing of video surveillance data is carried out by authorised persons.
  • The Company shall not disclose to third parties the Client’s personal data or any information obtained during the provision of the Services and the Contract, except:
    • where the third party is required to transfer the data in the context of a contract in order to carry out an activity necessary for the performance of the contract (e.g. for a bank to provide a service);
    • subject to the Client’s express and unambiguous consent;
    • in line with their legal obligations
    • to the persons provided for in external normative acts upon their justified request, in the manner and to the extent provided for in external normative acts;
    • in the cases provided for in external regulatory enactments for the protection of the Company’s legitimate interests, for example, by applying to court or other state institutions against a person who has infringed the Company’s legitimate interests.
  • Personal data may be transmitted, transferred or made available to such recipients, including but not limited to:
    • public authorities, such as the national or municipal police, VSIA “Autotransporta direkcija”;
    • outsourced service providers involved in the service delivery process
    • insurance providers to handle insurance claims
    • Sworn bailiffs, sworn notaries, sworn advocates in the performance of their duties;
    • other persons connected with the provision of the Company’s services.
  • The Company shall not transfer or make available Customer Data to recipients outside the European Union or the European Economic Area or to international organisations.

CATEGORIES OF PERSONAL DATA

  • The Company processes the following Customer Personal Data:
    • personal identification data – name, surname, personal identification number, identity document data, e.g. when processing Customer applications;
    • visual identification data of the personalised smartcard – name, smartcard number, photo and additional information according to the type of smartcard, e.g. for the bus driver or controller to verify that the personalised smartcard belongs to the passenger;
    • details of the document certifying the person’s entitlement – name, surname, status, expiry date, e.g. details of the disability certificate in cases where this is a document certifying the right to drive and is checked by the bus driver or controller;
    • contact details of the person – address, telephone number, e-mail address, e.g. in the case of Customer applications and/or complaints, and contractually in the case of a representative of a legal person;
    • CCTV data – video, photo and other data related to the CCTV process (date and time, route), e.g. in case of requests from state or local authorities, in accident and infringement situations, and in the process of video surveillance;
    • Special Category Data – Customer Health Data, including Customer Disability Data, such as data provided by the Customer regarding injuries sustained in a road traffic accident;
    • Customer feedback – e.g. results of Customer surveys, Customer feedback, thanks and complaints.
  • This section of the Privacy Policy lists the main types and examples of categories of personal data processed by the Company.
  • The Customer uses the Company’s website www.hansalines.lv anonymously and the Company may receive non-personally identifiable information about the Customer as a user at the time of interacting with the Company’s website. Non-personally identifiable information may include the browser name, computer type and technical information about the connection method to the Company’s website.

    STORAGE PERIOD OF PERSONAL DATA
  • Customer data shall be stored in accordance with the retention periods set by the Company in accordance with applicable laws and regulations.
  • The retention period of the Customer’s data shall be determined in accordance with the time limits established by laws and regulations for the purposes of ensuring the Company’s legitimate interests or for the performance of contracts.
  • Customer data is kept for as long as the Customer or the Company can pursue its legitimate interests (for example, legal action).
  • Video surveillance data is temporarily stored in a local video archive at the place of acquisition or storage. The duration of the temporary storage of CCTV data shall be up to 3 months for footage from cameras filming bus interiors.
  • If necessary, in order to realise the legitimate interests of the Company (e.g. in cases of traffic accidents, hooligan activities, breaches of security and order rules, etc.), the video surveillance data may be written out for long-term storage on a video storage site. The Company shall extract CCTV data from the local video archive to the video storage site in the following cases:
    • in the event of a request from the National Police or another public authority;
    • where a complaint has been received which the Company has assessed, in relation to the purpose of the CCTV, as sufficient to process such a request;
    • if an event occurs that automatically notifies you of a security incident;
    • if a breach of security or order rules is detected during video checks.
  • Upon expiry of the retention periods or legitimate interests of the Customer’s data as provided for by the laws and regulations, the Customer’s data shall be deleted. Video materials extracted from the local video archive for storage on a video storage site in order to pursue the Company’s legitimate interests shall be stored for up to 1 year, unless a justification for extending the time limit has been established.

ACCESS TO PERSONAL DATA AND OTHER CUSTOMER RIGHTS

  • The Client’s personal data is restricted information and is processed in accordance with the Company’s personal data processing purposes, legal grounds and regulatory enactments.
  • The customer has the right to make a data request in the general procedure, asking for an explanation of what data is being processed about him or her and which data needs to be restricted. Such a request will be complied with if it is legally justified and technically feasible. Other data recipients will also be informed of the data restriction requirements.
  • The Client has the right to receive information about the processing of his personal data, as well as to request the Company to supplement, rectify, delete them, if this is permissible in accordance with laws and regulations or the legitimate interests of the Company, and as far as it will be technically feasible. In the case of data obtained as a result of video surveillance, it is not possible to correct or supplement the data, otherwise it will be considered as falsification or distortion of information.
  • The customer also has the right to withdraw his/her consent to data processing. Withdrawal of consent shall not affect the processing of data carried out at the time when the Customer’s consent was valid. Withdrawal of consent will not interrupt the processing of data carried out on the basis of other legal grounds.
  • The Customer may submit a request to the Company to exercise its rights in the following manner:
    • by sending an official written application to the Company in writing or by submitting it in person at the Company’s registered office in Tukums, Mednieku iela 2, LV-3101, Latvia;
    • by electronic mail, by sending an official written application signed with a secure electronic signature and containing a time stamp to the Company’s electronic mail address info@hansalines.lv.
  • Upon receipt of a request from a Client to exercise its rights, the Company shall verify the identity of the Client, assess the request and comply with it in accordance with laws and regulations, to the extent technically feasible. The Company shall send the reply to the Customer by post or by electronic mail, depending on the method of receiving the reply indicated in the letter.
  • A reply containing personal data or a reply on the exercise of the Client’s rights shall be provided only if the Client has submitted a written formal application and the Client has been identified as follows: for face-to-face identification, the Client arrives at the Company’s registered office in Tukums, Mednieku iela 2, LV-3101, Latvia and informs a representative of the Company that he/she wishes to receive personal data and has arrived for face-to-face identification. The Customer shall present an identity document to the Company’s representative.
  • If the Customer has any complaints or questions in relation to the Privacy Policy or has identified a possible personal data breach, the Customer shall contact the Company through the contact channels indicated in the contact details of the data controller in Section 1 “GENERAL PROVISIONS” of the Privacy Policy.
  • The Company shall respond to any written request from a data subject, including on the exercise of its rights, within one month.
  • The Company shall ensure compliance with the data processing and data protection requirements in accordance with the laws and regulations and, in the event of an objection by the Customer, shall take reasonable steps to resolve the objection. However, if this fails, the Customer shall have the right to address the supervisory authority, the State Data Inspectorate (www.dvi.gov.lv), by submitting a relevant question or complaint.

OTHER RULES

The Company shall have the right to make additions to the Privacy Policy by making the current version available to the Customer. The current Privacy Policy is posted on the Company’s website at www.hansalines.lv.

The Privacy Policy shall enter into force on 2 January 2025.