Privacy Policy
This Privacy Policy (hereinafter, the “Policy”) provides important information about how our Company collects and processes the personal data of its customers and other individuals, how it uses such data, and what measures it takes to protect it. To ensure that you are informed about the processing of personal data, we recommend that you read this Policy carefully and familiarise yourself with the information it contains.
1. Definitions
The following definitions are used in this Policy:
Company or we – SIA “Māksla Ceļot”, Latvia (registration number: 40203017444; registered address: Aleksandra Čaka iela 49-26, Riga, Latvia; Company website: makslacelot.lv). The Company referred to in this Policy is the controller of personal data.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (EEA-relevant text).
Data subject – a natural person from whom the Company obtains personal data and whose personal data it processes.
Employee – a person with whom the Company has entered into an employment contract or another contract of a similar nature and who, pursuant to a decision of the Company’s management, has been authorised to process personal data, or a person whose personal data is processed.
Personal data – any information relating to an identified or identifiable natural person (data subject). A natural person is identifiable if their identity can be determined directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data or online identifier, or to one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
Recipient – a natural or legal person to whom personal data is disclosed.
Disclosure of data – disclosure of personal data by transmitting it or otherwise making it available, excluding publication in the mass media.
Data processing – any operation performed on personal data, including collection, recording, storage, classification, grouping, combining, alteration (amendment or correction), provision, publication, use, logical and/or arithmetic operations, retrieval, dissemination, erasure or any other operation or set of operations.
Automated data processing – data-processing operations carried out by automated or partially automated means.
Processor – a natural or legal person who is not an employee of the controller and has been authorised by the controller to process personal data. The processor and/or the procedure for authorising it may be specified by laws or other legal acts.
Controller – a natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data. Where the purposes of processing personal data are determined by laws or other legal acts, the controller and/or the procedure for authorising it may be specified by those laws or other legal acts.
Special categories of personal data – data revealing a natural person’s racial or ethnic origin, political, religious, philosophical or other beliefs, membership of professional trade unions, health, sex life, as well as information about previous criminal convictions.
Health data – personal data related to the physical or mental health of a natural person, including data concerning the provision of healthcare services that reveal information about that person’s health status.
Consent – a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, through a statement or a clear affirmative action, agree to the processing of their personal data.
Direct marketing – activities intended to offer goods or services to individuals and/or request their opinions on offered goods or services by email, telephone or any other form of direct communication.
Internal administration – activities that ensure the independent operation of the controller, including organisational management, human resources management, management and use of available material and financial resources, and records management.
Other terms used in this Policy have the same meaning as in the GDPR or other applicable legal acts.
2. Principles of data processing
General principles
In performing their duties and processing personal data, the Company’s employees must comply with the GDPR, other laws and this Policy, as well as the requirements of the Company’s internal documents that implement or supplement those requirements.
Personal data may be processed only lawfully, fairly and transparently. The Company must also be able to demonstrate that it actually complies with the data-processing principles set out in this Policy.
Purpose limitation
Personal data may be collected only for specified, explicit and legitimate purposes and must not be processed in a manner incompatible with those purposes. For employee personal data, legitimate purposes include, for example, human resources management and internal administration (assigning and withdrawing work duties, paying remuneration, organising work and other employee-related human resources matters).
Storage and erasure of personal data
Personal data may be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed.
Data quality and proportionality
Personal data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that inaccurate personal data, having regard to the purposes for which it is processed, is erased or rectified without delay.
Personal data must also be adequate, relevant and limited to what is necessary for the purposes of collection and/or processing. Personal data must be processed in a manner that ensures appropriate security through technical and organisational measures, including protection against unauthorised or unlawful processing, accidental loss or damage, and unlawful access to data.
If the Company has doubts about the accuracy of the personal data it processes, it shall suspend processing of that data in order to verify and correct it.
3. Why we collect data and why we store it
Purposes of data processing
The Company processes the data of individuals who visit the Company’s websites and/or purchase the services offered by the Company for the following purposes:
• processing and administering service purchases (orders);
• identifying the data subject in the Company’s information systems;
• identifying the data subject when they log in to their account on the Company’s website, if the Company provides this option;
• preparing vouchers, confirmations, invoices and other financial documents;
• resolving issues related to the performance, provision and use of services;
• communicating with the data subject if the terms and conditions of the services purchased by them change;
• performing other contractual obligations;
• direct marketing;
• business and statistical analysis, as well as general research that helps improve services and their quality.
Data may also be processed for other purposes, which will be communicated to you when you provide the Company with your personal data.
Processing of personal data when purchasing the Company’s travel services
When travel services are purchased, depending on the type of service (travel destination) and the purposes specified in this Policy, the Company collects and processes the following personal data: first and last name, gender, date of birth or personal identification number, identity document details, address, telephone number, email address, payment card details, personal contact information (telephone number and email address), citizenship, information about special needs, personal data of accompanying travellers (first and last names, dates of birth or personal identification numbers, forms of address and citizenship), and other personal data requested during the purchase of the service.
This data is provided during the performance of the contract and purchase of the service, as well as during consultations by telephone, email or through other persons.
In such cases, the Company processes your personal data on the following legal bases:
• to ensure the proper provision of services and a high quality of service (legitimate interests);
• based on your consent where special-category data (health data) is processed;
• performance of a contract;
• compliance with legal obligations imposed on the Company as a travel organiser.
Processing of personal data when providing other services
When providing gift vouchers, child escort services or other services offered by the Company, the Company may also process other personal data for the purposes set out in this Policy and for the performance of a contract.
The scope of data processed depends on the specific service you wish to receive. The data required to provide the service will be indicated when the service is ordered.
Processing of personal data through mobile devices
When mobile devices are used, data may be collected to determine the type of your mobile device, its settings and geographical coordinates (longitude and latitude).
Processing of personal data when administering and reviewing complaints and/or requests
The Company processes the personal data you provide when submitting a request and/or complaint to the Company through this website, by email, post or telephone.
The Company processes your personal data on the following legal bases:
• to administer requests and/or complaints and ensure the quality of the services provided (legitimate interests);
• based on your consent, expressed through the affirmative action of submitting a request and/or complaint;
• to comply with legal obligations imposed on the Company as a travel organiser.
When reviewing your request and/or complaint, providing information and ensuring service quality, the Company is entitled to record the information you provide in the Company’s internal information system.
When contacting the Company, you are asked to observe at least the following minimum personal data protection requirements:
• do not include personal data such as a personal identification number, date of birth, bank account number, vehicle registration number, information about real estate, health data, other special-category personal data or other sensitive personal data in the subject of a request and/or complaint (in an email, written documents or on the website), or in the names of attached files;
• do not include special-category or other sensitive personal data in the text of a request and/or complaint or during a telephone conversation, such as a personal identification number, bank account number, vehicle registration number, information about real estate, health data or other data that is not directly relevant to the request and/or complaint. Include other people’s personal data only to the extent necessary to review the request and/or complaint.
If the Company needs additional information to review your request and/or complaint, it will use your contact details to get in touch with you.
The Company also draws your attention to the fact that the personal data of individuals who have submitted requests or complaints to the Company may be transferred to UAB “Aviaturas ir partneriai”, which belongs to the Company’s group of companies and helps ensure that complaints are administered smoothly and promptly.
Processing of personal data of the Company’s shareholders
In the course of its activities, the Company processes shareholders’ personal data for the following purposes:
• internal administration;
• fulfilment of legal obligations relating to the registration and processing of shareholder data, accounting for shares and performing other obligations concerning shareholders.
Processing of personal data of other Company governing bodies
In its activities, the Company also processes the personal data of members of the Company’s governing bodies:
• for internal administration purposes;
• to fulfil legal obligations relating to governing bodies (the Company’s management, board, committees, etc.), including their establishment and organisation of activities, submission of information about governing bodies and their members to public registers and registration of such information, application of the law on the financial accounting of undertakings (for example, including information about the board and its members in the annual report), and fulfilment of similar obligations.
The processing of personal data of members of the Company’s governing bodies is mandatory under applicable laws.
Data processing for recruitment purposes
When applying for a vacancy at the Company or contacting the Company regarding a published job advertisement, the Company collects and processes the personal data contained in your letter and curriculum vitae (CV).
The Company processes the data you provide:
• for recruitment purposes;
• based on your consent, which you express by actively providing your personal data.
The Company stores data submitted through this website for recruitment purposes for 12 months.
The Company draws your attention to the fact that providing personal data for recruitment purposes and storing that data does not, in itself, constitute an application for a specific vacancy. If you find an advertisement for a vacancy that interests you on the Company’s website or on job-search websites, we invite you to apply directly using the email address specified in the relevant advertisement.
The Company informs you that, for the purpose of evaluating your application, it may request references from previous employers you have identified and request information about your qualifications, professional skills and business skills. The Company may request information from your current employer only after obtaining your separate consent.
The Company also emphasises that it may receive your personal data from third parties, such as companies operating job-advertising websites and recruitment agencies, if you have provided your data to them, as well as from publicly available sources where you have published your personal data.
4. Marketing offers and newsletters
When using the Company’s services and entering into contracts for the provision of travel services, the data subject may voluntarily agree that the Company will use the personal data they provide for the Company’s marketing purposes. The data subject may indicate such consent by signing the relevant section of the travel services agreement.
The data subject may agree to receive information sent by the Company in the following cases:
• When visiting the Company’s website (makslacelot.lv) and subscribing to the Company’s newsletters.
• When using the Company’s services, completing the Company’s questionnaires after air or bus trips, online or during events organised by the Company, as well as when entering into travel service agreements through our travel consultants. In such cases, the data subject may agree to receive newsletters, informational notices, offers, information about discounts, sales and similar information by ticking the relevant checkbox or otherwise indicating consent.
• If registration and membership in the Company’s club are available, the data subject may, after registering and receiving the Company’s confirmation of club membership, agree to receive newsletters, informational notices, offers, information about discounts, sales and similar information.
• If registration on the Company’s website and becoming a registered user are available, the data subject may, after completing registration and obtaining registered-user status, agree to receive newsletters, informational notices, offers, information about discounts, sales and similar information.
The data subject has the right to opt out of information sent by the Company by clicking the unsubscribe link in a newsletter or another message sent by the Company, thereby declining to receive such offers and news.
If, when completing the Company’s questionnaires after bus or air trips or online, the data subject does not indicate consent to receive news, offers and other information sent by the Company, such information will not be sent to them in the future, as the Company will update the data subject’s information and use the latest data provided by the data subject.
If the data subject is a registered user of the Company’s website and does not wish to receive unwanted information about the Company’s services, they may change the relevant settings at any time by logging into their account on the Company’s website and making the necessary changes under “My Data” → “Information Settings”.
The personal data provided by the data subject and used for direct marketing helps continuously improve and develop the Company’s website and services, and allows the Company to offer customers more suitable offers.
The data subject may also exercise the right to object to the processing of personal data for direct marketing purposes by notifying the Company in writing by post or through electronic communication channels.
5. Personal data retention period
The Company stores personal data for as long as necessary to achieve the purposes for which it is processed, for example, to provide services or review complaints. Data is also stored in accordance with statutory data-retention requirements and periods, including limitation periods applicable to bringing or defending claims. If such claims have been brought, the data may be stored for as long as necessary for the relevant purpose.
To ensure appropriate control over personal data retention periods, the Company applies suitable technical and organisational measures to ensure that data is erased once the retention period has expired.
6. Privacy and personal data security
In compliance with the GDPR and other documents governing personal data protection, the Company takes measures to prevent unauthorised access to and unlawful use of data subjects’ personal data. The Company ensures that the data provided by data subjects is protected against unlawful activities, including unauthorised alteration, disclosure or destruction of personal data, identity theft, fraud and other similar unlawful activities.
The Company uses appropriate technical and organisational security measures, as well as suitable information systems and procedures, to protect and ensure the security of the personal data entrusted to it. The Company uses security systems and technical and physical measures to restrict access to personal data and its use on the Company’s servers. Data subjects’ personal data may be accessed only by those Company employees who have been granted appropriate access rights, and only to the extent necessary to perform their work duties.
The Company uses only processors that guarantee the implementation of all necessary technical and organisational measures for personal data protection and comply with those measures.
7. Use of cookies
When you visit our website, we aim to provide you with information and functions tailored to your needs. Cookies are used for this purpose.
Cookies are small text files stored in your internet browser.
More information about the types of cookies we use and how to manage them can be found in the Company’s Cookie Policy on the website [www.makslacelot.lv](http://www.makslacelot.lv/).
8. Transfer of personal data
The Company may use certain service providers acting as personal data processors to help manage your personal data. Such providers may include data centre service providers; companies that analyse internet browsing and online activity and provide related services; software development, supply, maintenance and improvement companies; information technology infrastructure providers; and communications, security, recruitment and call-centre service providers, as well as other service providers. Personal data is disclosed to these providers only to the extent necessary for them to provide the relevant services.
Where there is a sufficient legal basis, for example, where necessary to conclude or perform a contract with you and you have been duly informed of such data transfer, personal data may be transferred to the Company’s business partners or agents.
Please note that certain information about your visits to the website, such as your IP address, cookies, technical information about the browser you use, other browser-related activities and information about website browsing, as well as browsing statistics and analytics data, may for the relevant purposes be transferred or made available to recipients operating both within and outside the European Economic Area (EEA). For example, this may occur when using Google Analytics if the relevant service provider is a company registered in the United States.
Please also note that if you choose to travel outside the EEA, the personal data you provide may be transferred to our partners in the relevant countries who help organise your trip, such as airlines, hotels, the Company’s representatives at the destination and other service providers.
We remind you that the level of personal data protection outside the EEA may be lower than in EEA countries, creating a greater risk of unlawful processing of personal data. Nevertheless, the Company will carefully assess the circumstances in which your personal data will be further processed and the safeguards for its protection after transfer to the recipients mentioned above.
Your personal data will be transferred to such recipients only to the extent necessary to perform the contract concluded with you and provide the services. The Company enters into agreements incorporating the European Commission’s approved Standard Contractual Clauses with key partners in third countries. You can obtain more information about these measures by contacting the Company using the contact details provided in this Policy.
Your personal data may be transferred to other recipients only in the cases and in accordance with the procedures prescribed by law.
9. Rights of the data subject
You have the following rights in relation to your personal data:
• to receive information about your personal data and its processing;
• to request the rectification of incorrect, inaccurate or incomplete personal data;
• to request the erasure of your personal data or restriction of processing if the data is processed in breach of legal requirements or if another legal basis for such a request exists;
• to request the transfer of your personal data to another processor or receive the data in a convenient format, where the data was provided by you and is processed by automated means or on the basis of your consent;
• to object to the processing of your personal data where it is based on legitimate interests, except where there are compelling legitimate grounds for the processing or the processing is necessary for the establishment, exercise or defence of legal claims;
• to withdraw your consent at any time where the processing of personal data is based on your consent.
If you believe that your personal data is being processed unlawfully or that your rights relating to personal data processing are being violated, you have the right to contact the competent personal data protection supervisory authority and lodge a complaint with it.
However, before lodging an official complaint, the Company recommends contacting it by email at info@makslacelot.lv to try to find an appropriate solution to the issue.
To protect personal data against unauthorised disclosure, after receiving your request to exercise data subject rights, the Company will need to verify your identity. For this purpose, the Company may ask you to provide your first and last name, date of birth, email address or telephone number, and may also ask you to visit the Company or one of its offices in person for identity verification.
As part of this verification, the Company may also send a verification message (SMS or email) to your contact details and ask you to complete an authentication step.
If identity verification is unsuccessful, for example, if the data you provide does not match the data held by the Company or you do not complete authentication through the received SMS or email, the Company will consider that you are not the relevant data subject and will reject the request.
After receiving your request and successfully completing the identity verification described above, the Company will inform you of the actions taken in response to your request no later than one month after receipt of the request and completion of the verification procedure.
Taking into account the complexity and number of requests, the Company is entitled to extend the one-month period by a further two months. In such cases, the Company will inform you of the extension and its reasons no later than one month after receiving the request and completing the identity verification procedure.
If you submit a request electronically and the Company can adequately verify your identity, you will normally receive the response electronically, except where this is not possible, for example, because of a substantial volume of information or other factual circumstances and reasons, or where you request another form of response.
In cases provided for by law and where the relevant circumstances apply, the Company may refuse to fulfil your request. In such a case, the Company will inform you of the refusal and state its reasons.
10. Liability
The data subject is obliged to provide the Company with complete and accurate personal data and to inform the Company of any relevant changes to that data.
The Company is not liable for losses incurred by the data subject and/or third parties if the data subject has provided incorrect and/or incomplete data about themselves or has failed to inform the Company properly and in a timely manner of changes to that data.
Submitting false or misleading orders is strictly prohibited. The travel and other service booking facilities offered on the website may be used only to submit legitimate orders or to customise or purchase services for yourself or for other persons on whose behalf the person placing the order is authorised to act.
If a user engages in suspicious or fraudulent activities or maliciously misuses the travel-booking or other ordering services offered on the website, the Company may cancel all or some orders placed on behalf of that user that are associated with the user’s email address or account, and may also close all of that user’s accounts.
In cases of fraud, the Company is entitled to take the necessary legal action. A user who has committed fraudulent acts is liable for the financial losses caused to the Company, including litigation costs and other losses associated with those acts.
When purchasing the Company’s services or otherwise providing the Company with personal data belonging to third parties rather than yourself, such as data about travelling family members or friends, the data subject is obliged to inform those individuals that information about the processing of their personal data is available in this Policy.
By providing personal data of other people, including children, or special-category personal data, the data subject confirms that they are authorised to represent the relevant individuals, for example as a parent or guardian, and that the individuals concerned agree to the submission and processing of their data. The Company reserves the right to contact the relevant person to verify that such consent has been given.
If the personal data requested by the Company is not provided, the Company may be unable to provide certain services or guarantee the quality of the services provided.
The Company is not liable for communication failures that prevent users of the Company’s website or other persons from accessing the website or using the services offered there.
The Company cannot fully guarantee that its website will operate without interruptions, disruptions or errors, or that it will be fully protected against viruses and other malicious components.
The data subject is informed that any material they read, download or otherwise obtain through the Company’s website is obtained at their own discretion and risk. The data subject is responsible for any potential damage caused to themselves or their computer system.
If the data subject is a registered user of the Company’s website, where this option is provided by the Company, the data subject assumes the risk and responsibility for actions taken by third parties on the Company’s website using the data subject’s login credentials and undertakes to fulfil all obligations arising from the use of those credentials.
11. How to contact us
If you have questions about the processing of your personal data, this Policy or the exercise of your rights, please contact us:
SIA “Māksla Ceļot”
Email: info@makslacelot.lv
12. Final provisions
The Company is entitled to update this Policy at any time. The Company will inform website visitors of changes by publishing a new version of the Policy and indicating the date of the latest changes.
Website visitors are informed that by continuing to use the website after changes to the Policy have been published, they confirm that they have familiarised themselves with those changes.
If any provision of this Policy is found to be invalid or unenforceable, this shall not affect the legality or validity of the remaining provisions of the Policy.
This Policy enters into force on the date it is published on the Company’s website.