PRIVACY POLICY

SIA "Paul Mason Properties" (hereinafter “company” or “we”) respects your privacy and is committed to protect it through compliance with this privacy policy (hereinafter “Privacy policy”). In this Privacy policy, we will inform you about how we process your personal data. We commit ourselves to be transparent with you by providing clear information about what personal data we process, about the purpose of the processing, the retention period of the personal data as well as the legal basis for the processing and other information that we are required to provide pursuant to applicable legislation.

Topics:
   1. What personal data do we process and why?
      1.1. Video surveillance
      1.2. Recruitment (including internship)
      1.3. Photos and/or videos from store and/or pick up points public events/activities
      1.4. Public relations
      1.5. Agreements with natural persons, including received/issued invoices, gift cards, prizes and other gifts transfer-acceptance acts
      1.6. Business partners’ or potential business partners’ employees’/representatives’ personal data
1.7. Games and/or contests
1.8. ikea.lv account
1.9. IKEA BUSINESS
   2. To whom we disclose the personal data?
   3. Protection of personal data
   4. Your rights 
   5. Changes in our privacy policy
   6. Contacts

1. What personal data do we process and why?
The categories of personal data that we process about you, purposes and legal basis for the processing are the following:

1.1 Video surveillance
Categories of personal data    Legal basis for the processing
Image and other personal data falling into the camera’s field.    Our legitimate interests to ensure the safety of our property, information, employees and third parties, to prevent, control and disclose unlawful acts and to ensure an effective investigation in case of such acts.
 
We process your personal data with the purpose to ensure the safety of our property, information, employees and third parties, to prevent, control and disclose unlawful acts and to ensure an effective investigation in case of such acts.

You have no obligation to provide personal data and we have no aim to identify you unless it is necessary for specific purposes. Nevertheless, due to the nature of video surveillance, we cannot guarantee your ability to perform your tasks or that you will be able to receive our services without being subject to video surveillance.

Video surveillance records shall be stored no longer than for 25 days, unless these records contain information that is necessary as evidence in a civil, administrative or criminal case or for an investigation. In such cases, the records may be stored as long as they are necessary for the aforementioned purposes and will be immediately destroyed when they become unnecessary.

We transfer your personal data to our data processors, e.g. who provide system maintenance services to us etc.

1.2 Recruitment (including internship)
Categories of personal data  Legal basis for the processing
o    Name
o    Surname
o    Contact details
o    Address
o    Employment history
o    Education history (including training courses, certificates)
o    Languages
o    Salary expectations
o    Contacts for references
o    Other skills relevant for the position you are applying for
o    Notes from the interview process (such notes may include our assessment of you as a candidate).
o    Results of tests and/or practical tasks
Your consent – by applying for a job in our company you agree that we process your personal data included in your curriculum vitae (CV) and application letter.
However, if we retain your personal data in order to protect our legal rights, e.g. if you initiate a discrimination process in relation to the recruitment process for a specific position in our company, such processing of personal data is based on legitimate interest to protect our rights.

We process your personal data for the purposes of administrating the recruitment process that includes inter alia a follow-up on your application, and for communicating with you in an appropriate manner (e.g. inviting you to an interview). We will also process your personal data in order to evaluate your application, which includes determining if you are eligible for a certain position, if your education, experience and language skills meet the requirements for this position, whether the salary level is in line with your expectations. During the recruitment process (interviews), we may take notes that may contain personal data. We process such data in order to evaluate your eligibility for the position. During the application process you may also be asked to perform tests and/or practical tasks. The results from the tests and/or practical tasks will be processed in order to evaluate you for the employment in question.


Please note that we will use your application data only when recruiting for the vacancy that you applied for. In case we have an intention of processing your personal data for other purposes than the one for that the data was originally collected, we will notify you of such processing before initiating it and request your consent if necessary. For example, if we process your personal data in connection with the recruitment for a specific position, we may ask for a consent to process your personal data in the future in connection with another position in case we find you a suitable candidate for another role within our company. If you consent to this, we will process your data for the purpose of future recruitments and you will become a part of our “talent bank”.

We also process contacts of reference providers in order to assess references about a candidate during the selection process in case the candidate has indicated reference providers.

We obtain information about you when you submit your application (your curriculum vitae and application letter). We may collect personal data from a recruitment company, or career portals or databases such as CV Online, or an employment agency, or education provider or organisation that promotes education.

Submitting the application is voluntarily and you can choose what kind of personal data you want to provide and at what extent. In some cases, depending on the position you have applied for, we may ask you for additional information, e.g., about your driver’s license. It is your responsibility to provide only valid and genuine personal information. When evaluating an application, we will process the personal data provided in CV and application letter. If you submit information that is not required for the recruitment process, we will not take it into account.

Please be informed, that in case you choose not to provide your personal data, you cannot participate in the recruitment process.

You can submit an application if you are at least 18 years of age. If you are not yet 18, you should be represented by legal guardians (except special cases when you can submit application starting from 15 years of age).

Your personal data will be stored in paper and in digital format. The retention period of the data is no longer than 3 months after the vacancy that you have applied for is closed. In case you give your consent to participate in the future recruitment processes for a different vacancy, we will store your personal data for no longer than 1 (one) year starting from the moment, when we receive the consent.
 
We transfer your personal data to our data processors, e.g. the ones that provide us IT maintenance services etc.
1.3 Photos and/or videos from store’s and/or pick up point’s public events/activities
Categories of personal data Legal basis for the processing
•    Image (picture or video in digital format)
•    If necessary for specific event: name, surname, e-mail or phone.  
Your consent and/or our legitimate interest to communicate information about our company and its activities.

We process your personal data in order to communicate information about our company and its activities and to give you an opportunity to participate in our events and enjoy the results or the output of such events.

We obtain information about you, when you:
1. participate in events or other activities of our store and/or pick up points (e.g. store or/and pick up point opening, movies and etc.);
2. participate in our contests;
3. take photos with Santa during the Christmas time and get the free photos;
4. take photos for personal IKEA Catalogue with your own cover photo.

Events are open for everyone, but the participation is not a mandatory. You are free to choose whether you participate or not. If you want to avoid the possibility of capturing your image, you are free to not attend the public events organised by us, or to contact us and ask to exclude your image from the communication materials. When you participate in the events, you should be aware that your image could be captured and used to communicate our company's activities.

Your name, surname, phone number or e-mail are only collected when we want to prepare a participant’s list of an event or inform you about the possibility to get/take away the result of our collaboration (e.g. to receive the IKEA Catalogue with your personal cover photo when it is printed and etc.).

Your name, surname, phone number or e-mail will be stored until the end of the event for that they were collected. Personal data regarding IKEA catalogue will be stored for 1 (one) year starting from the event. Your image (picture or video) from events/activities will be stored for 10 (ten) years starting from the actual event date.

We transfer your personal data to our partners who provide us photo or video editing services, printing services, to advertising agencies, Inter IKEA Systems B.V., data processors, e.g. that provide us IT maintenance services etc.
1.4. Public relations
Categories of personal data  Legal basis for the processing
o    Name
o    Surname
o    Company (media)
o    E-mail
o    Phone
o    Address
o    Social media (Messenger, Viber, WhatsApp etc.) account or other communication channel’s (like Skype) account
o    In specific cases (like media trips, events with catering) to ensure your health and safety, we may ask to provide additional data, for example, for your preferences for food.  
We are processing personal data based on your consent or on our legitimate interest of maintaining public relations.

We process your personal data for the purposes of distributing relevant information to the general public or specific groups. If you would like to receive the corporate news of our company, we will collect certain information about you. We use the collected data in order to send you our corporate news like press releases by e-mail, event invitations by e-mail (or printed ones to the indicated address) and communicate on phone, through social media (Messenger, Viber, WhatsApp, etc.) or via other communication channels (like Skype) in urgent cases, in order to provide you important information of our company that is relevant for the society.

We obtain information about you when you provide personal data to us by expressing your wish via e-mail (for example komunikacija@IKEA.lv) to Public Relations or Marketing employees in order to receive company’s news, or agree to receive news when attending our events or communicate directly with our Marketing or Public Relations representatives.

You have no obligation to provide all personal data, you may provide only that which you prefer to use for communicating with us (for example, you may provide only company’s name and e-mail). If you do not provide the necessary data, you will not receive our news. If you find the information we send irrelevant, you can unsubscribe by expressing your wish via e-mail to company’s Public Relations/Marketing employees. 
Your personal data will be stored until you unsubscribe or otherwise request us to delete your data, until we find out that the recipient is no accessible no more (e.g. receive automatic notification that the contacted person is not working there anymore or that such e-mail address has ceased to exist) or for 5 (five) years from the registration. The list of media participants in an event will be stored for 2 (two) years from the end of this event, while the list of others participating in the event – 1 (one) month from the end of the event. If we have collected additional data, e.g., preferences for food, such data will be stored for no longer than until the end of the event.

The personal data is disclosed to companies that provide services to us, i.e. in some cases we may transfer your personal data to the company’s Public Relations agency to share information on our behalf, to data processors, e.g. who provide us IT maintenance services etc. In case of a global event communication, if we have your consent, we may transfer your personal data to Inter IKEA Holding B.V. etc.

1.5. Agreements with natural persons, including received/issued invoices, gift cards, prizes and other cases of transferring and receiving gifts
1.5.1. Agreements with natural persons
Categories of personal data Legal basis for the processing
o    Name
o    Surname
o    Bank account
o    Date of birth or personal ID number
o    VAT registration number (if registered as VAT payer)
o    Business certificate number
o    Address
o    Contacts – email address and/or phone number. 
We process personal data in order to perform a contract with you or to enter into contract with you, as well as for the compliance with the legal obligations to which we are a subject.
However, if we retain your personal data in order to protect our legal rights, e.g. in legal dispute, such processing of personal data is based on legitimate interest to protect our rights.
   
We process your personal data for the purposes of concluding a contract with you, of performing this contract, monitoring its execution, processing payments under concluded contracts and deal with complaints related with the conclusion, execution and/or termination of a contract.

In addition, we process your personal data in order to ensure a correct execution of our tax obligations, i.e. to ensure that we have the personal data that is necessary for a proper execution of our legal obligations: for calculating taxes and for declaring to tax authorities’ information about the services we have obtained from you and the payments to you.
We process your personal data in order to recover debts and/or other payables if necessary and fulfil our legitimate interest when bringing, presenting and defending legal claims.

We obtain information about you when you submit it to us by concluding a contract and/or providing services (if not contracted) under a business certificate. In addition, we collect personal data about you from the State Revenue Service database in order to check whether you have a business certificate.

You have to provide us your name, surname, date of birth (or personal identification number), VAT registration number (if registered as a VAT payer), address, business certificate number and contacts. If you do not provide the mandatory information, we will not be able to conclude an agreement with you and not be able to buy services provided by you.

Your personal data will be stored for 10 (ten) years starting from the date of termination of a contract. If the contract provides for a warranty period that exceeds the aforementioned storage term, all personal data related to the contract will be retained until this warranty period expires. If the contract is necessary in a legal proceeding that extends beyond the above-mentioned retention period, all personal data relating to the contract concluded will be kept for 1 (one) year after the final decision of the relevant institution has been taken. If you have provided us services, but there was no contract concluded with you, your personal data will be stored for 10 (ten) years starting from the provision of the service and the issuance of the accounting document.

We transfer your personal data to banks, state institutions (mainly tax authorities), auditors, document archiving company, legal, financial advisers, debt collection companies, data processors, e.g. IT maintenance companies etc.

1.5.2. Invoices to/from natural persons
Categories of personal data Legal basis for the processing
o    Name
o    Surname
o    Bank account
o    VAT registration number (if registered as a VAT payer)
o    Business certificate number
o    Address
o    Contacts – email address and/or phone number.
We process your personal data for the compliance with legal obligations to which we are a subject.
However, if we retain your personal data in order to protect our legal rights, e.g. to recover of debts and/or other payables, such processing of personal data is based on the legitimate interest to protect our rights.
   
We process your personal data for the purposes of issuing/receiving invoices properly i.e. according to legal requirements and also in order to ensure that the information which needs to be provided to tax authorities is correct. We process your personal data in order to recover debts and/or other payables if necessary and fulfil our legitimate interest when bringing, presenting and defending legal claims.

We obtain information about you when you submit it to us in order to issue an invoice for the goods and services that you have purchased or when you are provide such invoice.

When we issue an invoice, you have provide your name, surname, VAT registration number (if registered as a VAT payer), address, business certificate number. If you do not provide the mandatory information, we will not be able to issue an invoice.

Your personal data will be stored for 10 (ten) years from the issue/receipt date of the invoice.

We transfer your personal data to banks, state institutions (mainly tax authorities), auditors, document archiving company, legal, financial advisers, debt collection companies, data processors, e.g. IT maintenance companies etc.

1.5.3. Gift card, prize and other gift transfer-acceptance acts
Categories of personal data Legal basis for the processing
o    Name
o    Surname
o    Personal ID number
o    Address
Compliance with legal obligation to which we are subject.

We process your personal data in order to ensure the accounting law requirements, also correct execution of our tax obligations: to calculate the taxes and to declare information about benefits given to you to tax authorities (if needed).

We obtain information about you when giving you an IKEA gift card, prize or other gift free of charge and you sign a transfer-acceptance act.

You have to provide us your name and surname, address, personal ID number. If you do not provide the mandatory information, we will not be able to ensure accounting law requirements, also the correct execution of our tax obligations and therefore can refuse to give you the IKEA gift card, prize or other gift free of charge.

Your personal data will be stored for 10 (ten) years from the issue date of transfer-acceptance act.

We transfer your personal data to state institutions (mainly tax authorities), auditors, data processors, e.g. document archiving company etc.
1.6. Business partners’ or potential business partners’ employees’/representatives’ personal data
Categories of personal data Legal basis for the processing
o    Name
o    Surname
o    E-mail
o    Telephone
o    Position 
Legitimate interests to conclude and execute of agreements with business partners and to build new business relationships with potential business partners.
    
We process your, as a business partner’s employee’s/representative’s, personal data in order to sign agreements, execute them and/or to contact you about various questions about agreement fulfilment.

We process your (as a potential business partner’s employee’s/representative’s) personal data in order to build new business relationships (e.g. when receiving commercial offers in our contests).

We obtain your personal data from you or from our business partner or a potential business partner.

Your (as a business partner’s employee’s/representative’s) personal data will be stored 10 (ten) years from the date of termination of the contract. If the contract provides for a warranty period that exceeds the aforementioned storage term specified above, then all personal data relating to the contract will be retained until this warranty period expires. If the contract is necessary in legal proceedings that extend beyond the above-mentioned retention period, all personal data relating to the contract concluded will be kept for 1 (one) year after the final decision of the relevant institution has been taken.

Your (as a potential business partner’s employee’s/representative’s) personal data will be stored until the end of the contest.

We can disclose your personal data to auditors, state institutions (mainly tax authorities), finance and law consultants, data processors, e.g. document archiving company, IT maintenance companies etc.
1.7. Games and/or contests
Personal data categories  Legal basis for data processing
Depending on the game and/or a contest, there may be one or several of them:
•    Name
•    Surname
•    Social network user name
•    Telephone number
•    E-mail
•    IKEA FAMILY card number
•    Receipt date
•    Receipt number
•    Other contest and/or game-related data (such as a photograph, etc.)

In case of winning: 
•    Name
•    Surname
•    Personal ID number
•    Value of the prize and/or another gift
•    Signature
•    Address
Your consent.
In case of winning, our legal obligation shall be the legal basis for processing data.
In case of a complaint received regarding the game and/or contest, the processing of personal data shall be based on legitimate interest to protect our rights.

We process your personal data for the purpose of organizing, executing and administering games and/ or contests, determining and announcing the winner, presenting prizes and / or other gifts. In case of winning, the data shall be processed in order to ensure accounting law requirements, also correct execution of our tax obligations: to calculate taxes and to declare to tax authorities information on the benefits paid to you (if needed). Having received a complaint regarding a game and / or a contest, personal data shall be processed in order to file, execute or defend legal claims.
Participation in a game and / or a contest is optional, but if you agree to participate, you shall submit your personal data requested in the game and / or the contest. Otherwise, you will not be able to participate in the game and / or the contest. In case of winning, you shall have to specify your full name, personal identification number, address. Should you fail to provide the requested mandatory information, we will not be able to ensure accounting law requirements, also correct execution of our tax obligations, thus we may refuse to present you with a prize or another gift.
We receive information about you when you agree to participate in a game and / or a contest by completing a registration form or when you voluntarily agree to publish your personal data in comments, messages, posts, etc. in social networks. You have the right to withdraw your consent to collecting and processing your personal data at any time without affecting the lawfulness of collection and processing of the data till the withdrawal of the consent. Having withdrawn his consent, a participant in a contest and/or a game shall be removed from the list of participants and shall no longer participate therein. By participating in a contest and / or a game, you also consent to the publication of the receipt number and the date, or the username used in social networks on the contest and / or game website or in social networks in case of winning.
We may also use an automated decision-making programme to manage the registration for a game and / or a contest or to determine the winners of the game and / or the contest. If you do not want to be subject to automatic decision making, you will not be able to participate in the game and / or the contest.
By submitting personal data, you confirm that the personal data are accurate and correct, also that you are at least 18 years old. Having detected inaccuracies, please correct them immediately.
Personal data of game and/or contest participants shall be stored till the day the winner is determined or no longer than 5 working days after the deadline for filing a complaint regarding the game and/ or the contest. Personal data may be stored longer if a complaint has been received regarding a game and / or a contest. In such a case, personal data shall be stored until the complaint has been resolved. In the event of winning, personal data shall be stored for 10 years from the date of signing a deed on transfer - acceptance of a prize or another gift.
We transfer your personal data to public authorities (usually - tax authorities), auditors, couriers, if a prize and / or another gift is delivered to the place of residence, or to data processors, such as a IT maintenance companies. We allow you to upload your content, for example photos, in some games and / or contests. In such a case, information that you provided or published shall become public information.

1.8. ikea.lv account
Categories of personal data Legal basis for the processing
o    Name
o    Surname
o    Mobile phone
o    E-mail
o    Shopping list
o    Planning drawings 
Your consent

We process your personal data in order to allow you to create an ikea.lv account where you can use our interior design tools and furnish your home with IKEA furniture as well as to save your planning drawings and shopping list in your account. Creating this account is completely voluntary.
If you would like create a ikea.lv account, you must provide personal data. If you do not, you will not be able to create an account.
By providing your personal data you confirm that your personal data is accurate and correct and that you are not younger than 18 year old. If you notice any inaccuracies, you should immediately correct your data.
Your account data will be stored for 24 months. Personal data may be disclosed to IKEA group companies as well as to companies that provide us with services, for example IT system maintenance services etc.

1.8. IKEA BUSINESS
Categories of personal data Legal basis for the processing
•    Name
•    Surname
•    Contacts: e-mail and/or phone number 
•    Interaction of newsletter (information if a newsletter was read, when it was read, how many times it has been read (or opened), if it has forwarded, what operating system was used, which email server, including its location)
Legitimate interests mentioned below.
Consent for direct marketing (if the recipient is IKEA BUSINESS client (natural person) or IKEA BUSINESS client’s employee/representative).

To maintain a business relationship, to manage and execute IKEA BUSINESS activities for companies and organisations, to sign agreements, execute it, and/or to contact for various questions about agreement fulfilment with IKEA BUSINESS clients, we have to process IKEA BUSINESS clients’ (which may also be natural persons - entrepreneurs), their employees’/representatives’, personal data.
Also, with IKEA BUSINESS client’s (if she/he is natural person), or IKEA BUSINESS client (if it is company) employees’/representatives’ prior free consent we are providing for IKEA BUSINESS client (if she/he is natural person) or IKEA BUSINESS client (if it is company) employees’/representatives’ information by e-mail about our products, services, offers & promotions for companies and organisations, also to better understand if information we send is relevant we track interaction of newsletter (information if a newsletter was read, when it was read, how many times it has been read (or opened), if it has forwarded, what operating system was used, which email server, including its location). In such case personal data will be stored as long as direct marketing is unsubscribed, but not more than 12 months after the last interaction with the newsletter or phone call.
IKEA BUSINESS clients, their employees/representatives, personal data will be stored 10 years from the date of expiration of contract, if the contract was signed. If the contract provides for a warranty period that exceeds the storage term specified above, then all personal data relating to the contract will be retained until the warranty period expires. If the contract is necessary in a legal proceeding that extends beyond the above mentioned retention period, then all personal data relating to the contract concluded will be kept for one year after the final decision of the relevant institution has been taken. If the contract was not signed IKEA BUSINESS clients’, their employees’/representatives’ personal data will not be stored. 
We can disclose your personal data to auditors, finance and law consultants, the companies which are providing home delivery, furniture assembling and installation services, data processors, e.g. archiving company, company which system we are using for sending newsletters, IT maintenance companies and etc.
2. To whom we disclose personal data?
We disclose your personal data to:
 a) Companies we work with
Personal data is disclosed to companies that provide services to us and are mentioned in each section. These companies are required to adequately safeguard your personal data and to not use this data for any unauthorised purposes, and to ensure that its suppliers do the same.
b) State and local government institutions, other persons performing functions assigned to them by law
We transfer your personal data to state and local government institutions and other persons performing functions assigned to them by law upon their request or in order to meet our legitimate interest in establishing, claiming and defending legal claims.

Protection of personal data
We take the following precautions in relation to the personal data you provide us:
a) Security.
We use a variety of technical and organisational security measures to protect your personal data. Your personal data are stored safely and are only accessible to a limited number of persons;
b) International transfers.
We are always seeking to process your personal data within the European Union/European Economic Area. However, we have service providers and business partners in many parts of the world. In some cases, we might have to transfer your information to one of the companies located outside the European Economic Area. We do our best to keep your information safe in these cases, so we can rely on the European Commission's adequacy decisions. This means that the European Union believes that national laws or arrangements ensure the proper protection of your personal data. If we want to store your information in the United States, we will use the "Privacy Shield", i.e. agreement between the European Union and the US governments. In cases where there is no adequacy decision, we sign a contract that includes standard terms or other approved items, codes of conduct, certificates etc. adopted by the European Union. 
You can obtain more information on personal data protection measures by submitting a separate application to us.

4. Your rights
Your rights are:
   a) the right to access – you have the right obtain a confirmation from us as to whether or not we process your personal data and, when we do, access the personal data. That’s why we inform you in advance about our processing activities via this privacy policy. If you have any questions, or would you like to learn more about what information we process from you, you are always welcome to contact us and we will provide you with further information;
   b) the right to rectification – you have the right to request a correction of any inaccurate personal data;
   c) the right to erase – under some circumstances you have the right to the erasure of your personal data, if you believe there’s no longer any need for us to keep it. Or, if you previously have given your permission, you can just decide to withdraw it. This does not apply if the processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation or for the establishment, exercise or defence of legal claims;
   d) the right to receive yourself or transfer your personal data to another company in certain circumstances (known as the right to data portability). This applies when data processing is based on you consent or on a contract and whenever processing is carried out by automated means;
   e) the right to restrict - in some circumstances you have the right to restrict the processing of your personal data. This means we will continue to store your information, but we’ll temporarily stop any other processing. Why would you want to do this? For example if you’ve asked us to fix incorrect information. In this situation you may want us to stop processing until the information is correct;
   f) the right to object - you have the right to object to our processing. This applies when data processing is based on legitimate interests pursued by us or by a third party. You can do this when you believe that your personal interest outweighs ours;
   g) the right to object - you have the right to object to our processing of your personal data for direct marketing purposes;
   h) the right to withdraw your consent to the processing at any time.
In order to carry out the aforementioned rights please provide written request to us or to the Data protection officer (contacts mentioned below).
You also have the right to complain to the Data state inspectorate (http://www.dvi.gov.lv/en/) if you believe that the processing of personal data by us does not comply with the applicable legislation.

5. Changes in our privacy policy
We keep our Privacy policy under regular review. This privacy policy was updated on 16 of August, 2018.

6. Contact information
If you have any questions about the processing of your personal data, any requests, or if you would like to give us feedback, please contact:
SIA Paul Mason Properties, registration number 50103951541, legal address: Bikeru st. 2, Dreilini, Stopiņu district, LV-2130, LV-2130, Latvia, phone number: +371 63301000, email address: info@IKEA.lv.

Data protection officer:  dpo@IKEA.lv.
You also can contact our Data protection officer by sending a letter to us at the above-mentioned address and addressing it to the Data protection officer.