Privacy policy

The purpose of the privacy policy of SIA “JULIANUS INKASSO LATVIJA” is to provide a natural person, the data subject, with information about the purpose, basis, scope, protection and processing period of personal data, as well as about the rights of the data subject during the obtaining and processing of data, including when transferring data to competent institutions or another data controller.

1. Controller and its contact information

  • The controller of personal data processing is SIA “JULIANUS INKASSO LATVIJA” (hereinafter – the Controller), registration No. 40003717522, legal address: Turaidas iela 3, Rīga, LV-1039, phone: +371 67783131, e-mail: info@julianus.lv, website: https://julianus.lv/;
  • Contact information of the Controller’s data protection officer on matters related to personal data processing: dpo@julianus.lv.

2. Applicable legal acts

  • Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (27 April 2016) (hereinafter – GDPR);
  • Law on the Processing of Personal Data of Natural Persons (promulgated on 4 July 2018).

3. Application of the privacy policy

  • This privacy policy applies to all cases where the Controller processes the personal data of a natural person when providing its services, including debt collection and management services, as well as when processing the personal data of clients, cooperation partners, employees and visitors of the Controller’s website.
  • The Controller is entitled to unilaterally amend this privacy policy. The Controller will inform data subjects of material changes by publishing the current version of the policy on the Controller’s website or in another appropriate manner.
  • The Data State Inspectorate is the Controller’s supervisory authority in the field of personal data processing (www.dvi.gov.lv).

4. Principles of personal data processing

  • When processing personal data, the Controller observes the following principles set out in Article 5 of the GDPR: lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, as well as accountability.

5. Purposes of personal data processing. Categories of personal data processed by the Controller

  • Provision of services:
    • for client identification – the identifying information of the data subject (natural and legal persons) is processed;
    • for the preparation and conclusion of a contract – the data subject’s name, surname, personal identity number/ date of birth, correspondence address, phone number, e-mail address, list of services, bank settlement account number, telephone and electronic communication information, position, representation rights are processed;
    • for the provision/ maintenance of services, support of the data subject via telephone and electronic communication – the data subject’s name, surname, correspondence address, phone number, e-mail address, list of services, telephone and electronic communication information (e-mails), payment administration information, position, representation rights are processed;
    • for settlement administration – the data subject’s (client’s, debtor’s, guarantor’s) name, surname, personal identity number/ date of birth, correspondence address, phone number, e-mail address, obligations, telephone and electronic communication information (e-mails), payment administration information, position, representation rights are processed;
    • for maintaining the debtors’ database – the data subject’s (client’s, debtor’s, guarantor’s) name, surname, personal identity number/ date of birth, correspondence address, phone number, e-mail address, obligations, telephone and electronic communication information (e-mails), payment administration information, position, representation rights are processed;
    • purchase of debt and collection of purchased debts – the data subject’s (client’s, debtor’s, guarantor’s) name, surname, personal identity number/ date of birth, correspondence address, phone number, e-mail address, obligations, telephone and electronic communication information (e-mails), payment administration information, position, representation rights are processed;
    • for the examination and processing of objections/ claims – the client’s name, surname, personal identity number or date of birth, correspondence address or declared place of residence address, phone number, e-mail address, list of received services, obligations, payment administration information, telephone and electronic communication information are processed;
    • for the maintenance and improvement of the operation of the website – the website visitor’s data on the website visit (cookies) are processed.
  • Business planning and analytics:
    • for planning and accounting – the employee’s name, surname, position are processed.
  • Fulfilment of the requirements of regulatory enactments, provision of responses to requests from state institutions, defence of interests in state and municipal institutions, bodies, representation in legal proceedings – the data subject’s (client’s, debtor’s, guarantor’s, heir’s, representative’s, employee’s, job candidate’s or whistleblower’s) name, surname, personal identity number or date of birth are processed, as well as other information at the Controller’s disposal, in order to fulfil the legal obligation attributable to the Controller to provide responses to requests from state institutions, or which is at the Controller’s disposal and which the Controller is entitled to use for the protection of its interests in the manner prescribed by regulatory enactments, including in legal proceedings.
  • Company management carried out by the Controller, accounting, records management, data archiving and the provision of internal processes – the data subject’s name, surname, personal identity number or date of birth, position, phone number, e-mail address, correspondence address or declared place of residence address, bank account number, payment administration information are processed, as well as other information at the Controller’s disposal which it has an obligation/ right to process/ archive in accordance with the provisions of regulatory enactments.
  • The Controller’s employment legal relationships and personnel selection – the employee’s name, surname, personal identity number or date of birth, gender, correspondence address or declared place of residence address, language skills, work experience, education (including courses and certificates), phone number, e-mail address, position, bank account number are processed, as well as other information that the employee or the candidate for the vacancy has provided to the Controller.
  • Conclusion of the Controller’s economic activity contracts and ensuring their performance – the cooperation partner’s name, surname, phone number, e-mail address, position, bank settlement account number, payment administration information are processed.
  • Ensuring the security of the Controller’s clients, employees and cooperation partners, protection of the Controller’s property – audit records of access control devices and alarm equipment, audit records of workstations/ work e-mail/ internet and work phones with data subjects’ data, video surveillance system recordings (image of a person) with the data of clients, employees and cooperation partners are processed.
  • Filming, photographing and audio recording of work events organised by the Controller – the data subject’s images (photo/ video), voice recording are processed.
  • For other specific purposes, of which the data subject is informed at the moment when he or she provides the relevant data to the Controller.

6. Legal basis for the processing of personal data of natural persons

  • Purpose of personal data processing – provision of services:
    • The processing of your personal data may be based on the data subject’s consent – the data subject has himself/herself given consent to the collection and processing of data for one or more specific purposes, i.e., for example, for the processing of website visit data (cookies) (legal basis – GDPR Article 6(1)(a));
    • The processing of your personal data is necessary before or after the conclusion of a contract, i.e. client identification, management of client relationships (including remotely, via telephone and electronic communication), ensuring the conclusion of contracts and the performance of existing contracts, as well as ensuring the implementation of related processes, cooperation with clients and ensuring the implementation of related processes, performance of contracts and implementation of the debt recovery process, settlement administration (legal basis – GDPR Article 6(1)(b); Civil Law, Civil Procedure Law, Commercial Law, Insolvency Law, Law on Extrajudicial Recovery of Debts);
    • The processing of your personal data is necessary for the realisation of the Controller’s legitimate interests, i.e. to carry out economic activity, maintain the debtors’ database, implement the debt recovery process, settlement administration, maintenance and improvement of the operation of the website, resolution of disputes with the data subject (legal basis – GDPR Article 6(1)(f), Civil Law, Civil Procedure Law, Commercial Law, Insolvency Law, Law on Extrajudicial Recovery of Debts).
  • Purpose of personal data processing – business planning and analytics:
    • The processing of your personal data is necessary for the realisation of the Controller’s legitimate interests, i.e. when carrying out business development planning and keeping records (legal basis – GDPR Article 6(1)(f)).
  • Purpose of personal data processing – fulfilment of the requirements of regulatory enactments, provision of responses to requests from state institutions, defence of interests in state and municipal institutions, bodies, representation in legal proceedings:
    • The processing of your personal data is necessary for the fulfilment of a legal obligation attributable to the Controller, i.e. when the Controller provides responses to requests from state institutions for the performance of a task delegated to public administration bodies (legal basis – GDPR Article 6(1)(c), national legal acts);
    • The processing of your personal data is necessary for the realisation of the Controller’s legitimate interests, i.e. when implementing the Controller’s defence/ representation in state and municipal institutions, bodies, representation in legal proceedings (legal basis – GDPR Article 6(1)(f), Law on Administrative Liability, Administrative Procedure Law, Civil Law, Civil Procedure Law, Criminal Procedure Law, Commercial Law, Insolvency Law, Law on Extrajudicial Recovery of Debts).
  • Purpose of personal data processing – company management carried out by the Controller, accounting, records management, data archiving and the provision of internal processes:
    • The processing of your personal data as an employee may be based on the data subject’s consent – i.e. by giving the Controller consent in the provision of internal processes, for example, to make birthday dates known to other employees (legal basis – GDPR Article 6(1)(a));
    • The processing of your personal data as an employee/ client/ cooperation partner is necessary for the fulfilment of a legal obligation attributable to the Controller, i.e. ensuring the Controller’s accounting, providing responses to data subjects’ requests (legal basis – GDPR Article 6(1)(c), GDPR Article 12, Labour Law, Accounting Law, Law “On State Social Insurance”);
    • The processing of your personal data as an employee is necessary for the realisation of the Controller’s legitimate interests, i.e. in the realisation of the Controller’s company management and the provision of internal processes, for example, by processing data attributable to your employment legal relationships in the electronic resource management system (Intranet) (legal basis – GDPR Article 6(1)(f)); whereas, as an employee/ client/ cooperation partner, the processing of personal data is necessary, for example, for the purposes of the Controller’s document archiving, including the creation of a digital archive, or for the implementation of the Controller’s records management processes, for example, by administering the flow of incoming and/ or outgoing documentation, or, when checking the quality of work, to rationalise and increase the quality and efficiency of communication – in the telephone call recording system (legal basis – GDPR Article 6(1)(f), Archives Law, Civil Law, Civil Procedure Law, Commercial Law, Insolvency Law, Law on Extrajudicial Recovery of Debts).
  • Purpose of personal data processing – the Controller’s employment legal relationships and personnel selection:
    • The processing of your personal data as an employee may be based on the data subject’s consent – i.e. in order to ensure the conduct of the personnel selection competition, for example, to give consent to request a reference from previous workplaces (legal basis – GDPR Article 6(1)(a));
    • The processing of your personal data is necessary before or after the conclusion of an Employment contract, i.e. in order to ensure the conduct of the personnel selection competition, by concluding an Employment contract with the candidate for the vacancy, in order to ensure the performance of the Employment contract and the realisation of the employee’s rights (legal basis – GDPR Article 6(1)(b), Labour Law, Labour Protection Law);
    • The processing of your personal data is necessary for the fulfilment of a legal obligation attributable to the Controller, i.e. ensuring the execution of bailiffs’ orders, ensuring the investigation of accidents at the workplace, labour safety and fire safety briefings, when the employee undergoes mandatory health examinations (legal basis – GDPR Article 6(1)(c), Civil Procedure Law, Labour Protection Law, Labour Law);
    • The processing of your personal data is necessary for the realisation of the Controller’s legitimate interests, i.e. when submitting a curriculum vitae (Curriculum Vitae) to the Controller in the personnel selection process, the Controller has a legitimate interest in ensuring the employee selection process, as well as in evaluating the employee during the course of the employment legal relationship (legal basis – GDPR Article 6(1)(f)).
  • Purpose of personal data processing – conclusion of the Controller’s economic activity contracts and ensuring their performance:
    • The processing of your personal data is necessary before or after the conclusion of a Cooperation contract, i.e. data processing in order to ensure the conclusion and performance of the Cooperation contract (legal basis – GDPR Article 6(1)(b), Civil Law, Commercial Law);
    • The processing of your personal data is necessary for the realisation of the Controller’s legitimate interests, i.e. when concluding a Cooperation contract with the Controller, the Controller has a legitimate interest in processing your data as a contracting party (legal basis – GDPR Article 6(1)(f), Civil Law, Commercial Law).
  • Purpose of personal data processing – ensuring the security of the Controller’s clients, employees and cooperation partners, protection of the Controller’s property:
    • The processing of your personal data as a client, employee and cooperation partner is necessary for the realisation of the Controller’s legitimate interests, i.e. to protect the property of production and third parties located on the production premises and territory, in the office, to take care of the security of persons, to prevent possible offences, to record the fact of the commission of a criminal offence, to identify the possible offender (ensuring the lawfulness of evidence) (legal basis – GDPR Article 6(1)(f));
    • The processing of your personal data as an employee is necessary for the realisation of the Controller’s legitimate interests, i.e. when conducting an audit of equipment, to ensure the protection of confidential information at the Controller’s disposal (legal basis – GDPR Article 6(1)(f), Law on the Processing of Personal Data of Natural Persons).
  • Purpose of personal data processing – filming, photographing and audio recording of work events organised by the Controller:
    • The processing of your personal data may be based on the data subject’s consent – i.e. by giving the Controller consent to carry out your photographing/ video recording/ voice recording and to further use your data for the promotion of the Controller’s image (legal basis – GDPR Article 6(1)(a)).

7. Data retention period

  • Personal data obtained on the basis of the data subject’s consent, for example, for the provision of internal processes, the provision of personnel selection, the processing of website visit data (cookies), the communication of data to other employees, the carrying out of photographing/ video recording/ voice recording for the promotion of the Controller’s image, are stored until the moment while the data subject’s consent is in force, but no longer than five years;
  • Personal data obtained on the basis of the necessity to conclude a contract with the data subject, for example, an employment contract, are stored until the moment when the contract is concluded; in the event that it is not concluded, all data are deleted, whereas, upon concluding the contract, they are stored while the contract concluded with the data subject is in force. After the contract loses its force, personal data are stored for five years, but in the event that an applicable regulatory enactment sets a different term, in accordance with that term. The personal data of a cooperation partner or client are stored in accordance with the limitation period of a possible claim set out in regulatory enactments, but no longer than three years in the case of a commercial transaction or ten years in accordance with civil-law limitation;
  • Personal data obtained on the basis of the necessity to ensure the debt recovery process, including communication data with the debtor and/ or guarantor, are stored in accordance with the limitation period of a possible claim set out in regulatory enactments, but no longer than three years in the case of a commercial transaction or ten years in accordance with civil-law limitation;
  • Personal data obtained during the personnel selection process are stored no longer than four months. In turn, the employee’s personal data from access/ working time control devices are stored no longer than ten days;
  • Personal data obtained on the basis of the legal obligation attributable to the Controller to process personal data are stored while the Controller’s obligation to store data set out in regulatory enactments is in force;
  • Personal data obtained when carrying out video surveillance in the territory/ in the Office’s common-use premises are stored for fifteen days. In the event that a conflict situation arises, or a law enforcement institution requests the video surveillance recordings, the data are stored until the resolution of the conflict situation, or until the moment of handing over the video surveillance recordings to the law enforcement institutions;
  • Personal data obtained when the client and employee communicate by telephone are stored for three months. In the event that a conflict situation arises, the data are stored until the resolution of the conflict situation. In turn, electronic communication information is stored for two years. Personal data obtained by the Controller when implementing development processes are stored no longer than ten years. In the electronic resource management system (Intranet), the employee’s personal data are stored no longer than five years, whereas workstation audit records are stored no longer than one year.

8. Criteria used to determine the personal data retention period

  • while the data retention period set out in applicable regulatory enactments has not expired;
  • while the contract concluded with the data subject is in force;
  • while the data subject’s consent is in force;
  • while you or the Controller can carry out actions to realise and protect legitimate interests, for example, to protect your rights and/ or bring a claim in court, observance of the limitation period set out in regulatory enactments, etc.;
  • while there is a legal obligation to store the data;
  • upon the expiry of any of the mentioned terms, all data are deleted or anonymised in accordance with the procedure established by the Controller.

9. Sources of obtaining the data subject’s personal data

  • public and state databases;
  • documents and information submitted by data subjects;
  • data of other controllers, processors and sub-processors;
  • the service provision process;
  • the debt recovery process;
  • data of the Controller’s video and/or photo equipment;
  • data of the Controller’s computer network equipment;
  • data of alarm, video surveillance and access control equipment;
  • data of visiting or browsing the Controller’s website https://julianus.lv/.

10. The data subject’s data processing process

  • when identifying the data subject;
  • during the conduct of commercial activity;
  • when concluding the contracts necessary for economic activity and supervising their performance;
  • when selecting employees, establishing and maintaining employment legal relationships;
  • when fulfilling the requirements of regulatory enactments;
  • in the debt recovery process;
  • when participating in legal proceedings;
  • when providing information to state and municipal institutions, bodies and officials and receiving information from them.

11. Processing of the data subject’s cookies
(more detailed information can be found in the Cookie Usage Policy of the Controller’s website)

  • Cookies are small text files that are created and saved on the data subject’s device (computer, tablet or mobile phone) when visiting the Controller’s websites. Cookies “remember” the user’s experience and basic information, thereby making the use of the website more convenient.
  • By using cookies, information about users’ habits and the website usage history is processed, problems and deficiencies in the operation of the website are diagnosed, statistics of users’ habits are collected, as well as the full and convenient use of the website is ensured.
  • If the data subject does not wish to use cookies, their use can be declined in the settings of one’s browser, however, in that case the use of the website may be significantly hindered and complicated. Deletion of saved cookies is possible in the browser settings section of the device by deleting the history of saved cookies.

12. Sharing and disclosure of the data subject’s personal data

  • The Controller, in order to provide services and perform work tasks, may share the data subject’s data in the countries of the European Union and the EEA (European Economic Area).
  • The Controller, ensuring special data protection as required by the GDPR regulation, may transfer data to a third country (outside the European Economic Area) or to international organisations with the aim of ensuring the performance of functions and tasks and the work of the Controller. When transferring data to a third country (outside the European Economic Area), the Controller ensures compliance with the requirements of Chapter V of the GDPR, for example, on the basis of a European Commission decision on the adequacy of the level of protection (GDPR Article 45) or on the basis of standard data protection clauses adopted and approved by the European Commission (GDPR Article 46). The data subject may request additional information on specific transfer cases and the applied protection mechanisms by writing to the data protection officer at the e-mail: dpo@julianus.lv.
  • The Controller, in order to fulfil what is set out in regulatory enactments, may share the data subject’s data with state and municipal institutions, law enforcement institutions, the court or other institutions. The Controller will disclose data only to the extent set out by applicable regulatory enactments, including the GDPR and the Law on the Processing of Personal Data of Natural Persons.
  • The Controller may transfer the data subject’s data to the following categories of recipients: cooperation partners and service providers (for example, information technology service providers, accounting software providers) that process data on behalf of and on the instructions of the Controller on the basis of a contract; other debt collection service providers; legal service providers; controllers of payment delay registers; state and municipal institutions, courts and law enforcement institutions in the cases set out in regulatory enactments.

13. Protection of the data subject’s personal data

  • The Controller protects the data subject’s data from unauthorised access, accidental loss, disclosure or destruction. To ensure this, the Controller applies the capabilities of modern technologies, taking into account the existing privacy risks and organisational requirements, including by using firewalls, intrusion detection and analysis software, as well as encryption with the SSL standard and anonymisation. The Controller maintains an access rights management system, according to which personal data are processed only to the extent necessary for the provision of a specific service or another purpose set out in this policy, and uses software solutions that ensure a level of security corresponding to the standard generally accepted in the market.
  • The Controller carefully checks all processors and sub-processors that process the data subject’s data on behalf of the Controller; the Controller evaluates whether appropriate security measures are applied, whether data processing takes place as the Controller has delegated it, whether it takes place in accordance with applicable regulatory enactments and data protection requirements and standards.
  • processors and sub-processors have no right to process the Controller’s data for their own purposes.
  • The Controller assumes no liability for any unauthorised access to the subject’s data or their loss if they are outside the Controller’s competence, for example, due to the fault or negligence of the data subject.

14. Profiling logic

  • The Controller does not make any automated decisions, nor does it carry out profiling of personal data.

15. The data subject’s rights

In accordance with applicable regulatory enactments, the data subject has the following rights in the processing of his or her personal data:

  • right of access – the data subject has the right to request confirmation from the Controller as to whether the data subject’s personal data are being processed, as well as to request the disclosure of information about all processed personal data;
  • right to rectification – if the data subject considers that the information about him or her is incorrect or incomplete, he or she has the right to request that the Controller correct it;
  • erasure – under certain circumstances, the data subject has the right to request the deletion of his or her personal data, except in cases where regulatory enactments set a retention period for these data;
  • data portability – the data subject has the right to receive or transfer his or her personal data onward to another personal data controller. This right covers only those personal data that have been provided to the Controller with the data subject’s consent;
  • withdrawal of consent – the data subject has the right at any time to withdraw the consent given for data processing in the same manner in which it was given, or by sending a corresponding notification to info@julianus.lv, and in that case further data processing based on the previously given consent for the specific purpose will no longer be carried out. The withdrawal of consent does not affect the data processing carried out at the time when the Client’s consent was in force. By withdrawing consent, the data processing that the Controller carries out on the basis of other legal grounds cannot be terminated;
  • response term – the Controller will respond to the request submitted by the data subject within one month from the day of its receipt; if necessary, this term may be extended, informing the data subject thereof;
  • identification – before the disclosure of personal data or information, the Controller carries out identification of the data subject in order to prevent the disclosure of data to an unauthorised person; in certain cases the realisation of the data subject’s rights may be restricted, for example, if the deletion of personal data is incompatible with the Controller’s legal obligation to store data or with the necessity to protect and bring legal claims.

In order to realise the above-mentioned rights, please submit a written application to the Controller or the data protection officer at the e-mail: dpo@julianus.lv.

16. Contact

In the event of questions and uncertainties, the data subject may contact:

  • the Controller: address: Turaidas iela 3, Rīga, LV-1039; e-mail: info@julianus.lv;
  • the Controller’s personal data protection officer: dpo@julianus.lv.

The Controller contacts the data subject using the contact information indicated by the data subject (phone number, e-mail address, correspondence address).

If the data subject is not satisfied with the received response, he or she has the right to submit a complaint to the Data State Inspectorate (www.dvi.gov.lv).

The Controller is entitled to regularly improve or supplement the privacy policy. The Controller will inform the data subject of any changes by publishing the current version of the privacy policy on the website https://julianus.lv/.

17. Record of changes

Revised 21.10.2026