Privacy policy

Information about the controller

Our name is the Association "Latvian Motor Insurers' Bureau", registration number: 40008084453, legal address: Toma Street 4, Riga, LV-1003, 2nd floor, room 240 (entrance from Mazā Krasta Street)

You can contact us by phone: +371 67114300 or by writing to the following e-mail address: ltab@ltab.lv

Contact information for communication regarding personal data protection issues

If you have any questions regarding this notice or the processing of your personal data, you can contact us using the communication channels specified in the previous paragraph (paragraph 1) or by contacting our personal data protection officer at the following e-mail address: das@ltab.lv

General description of our personal data processing

This notice describes how we process the personal data of our customers/collaboration partners, their contact persons, website visitors and other persons whose data may come into our possession within the framework of our activities (provision of services, performance of functions specified in the statutes and regulatory enactments).

We assume that you have read this notice and accepted its terms before using our website and our services, or becoming our business partner. This is the current version of the notice. We reserve the right to make amendments and update this notice as necessary.

The purpose of this notice is to provide you with a general overview of our personal data processing activities and purposes, however, please note that other documents (e.g. LTAB In the Cookie Policy, which is available at www.ltab.lv website and other documents), additional information may be provided regarding the processing of your personal data.

We inform you that the personal data processing provisions contained in this notice apply only to the processing of personal data of natural persons.

In addition to these terms, you can also read the following additional personal data processing notices:

– Cookie Policy (available at: www.ltab.lv/data-usage-policy).

We are aware that personal data is your value and will process it in compliance with confidentiality requirements and taking care of the security of your personal data in our possession.

For what purposes do we process your personal data and what is the legal basis for processing personal data?

We will process your personal data only for predefined legitimate purposes, including:

1. For the initiation and provision of services, as well as for the fulfillment and ensuring of obligations specified in the contract (including the cooperation contract) –
   For this purpose, we would need to identify you, ensure the clarification of your insurance history data, clarify the circumstances of the road traffic accident (hereinafter – RTA), ensure appropriate payment calculation and ensure the payment process, contact you on issues related to the provision of the service and/or the execution of the contract (including for sending invoices), in certain cases also ensure the recovery of unpaid payments, use chatbots to facilitate communication with us and the completion of the agreed notification.
   For this purpose and for the sub-purposes indicated above, we may need at least the following personal data: name, surname, personal identification number, address of the client/collaboration partner, their contact persons; insurance history data; name, surname, personal identification number, address of the persons involved in/victimized by the RTA, place and circumstances of the RTA incident, if necessary, health data of the person injured in the RTA and data on the criminal record of the person responsible; bank account number; telephone number, e-mail address.
   The main legal bases used to achieve these purposes are:
   1. consent of the data subject (Article 6(1)(a) and Article 9(2)(a) of the General Data Protection Regulation[1]) regarding the receipt of certain services, the use of chatbots and the processing of special categories of data (health data); conclusion and performance of a contract with the data subject (Article 6(1)(b) of the General Data Protection Regulation); fulfillment of a legal obligation (Article 6(1)(c) of the General Data Protection Regulation); legitimate interests of the controller or a third party (Article 6(1)(f) of the General Data Protection Regulation), for example, identifying you and/or your contact person, ensuring communication with you; substantial interests of society based on the legal acts of the Republic of Latvia or the European Union (Article 9(2)(g) of the General Data Protection Regulation) – regarding the processing of special categories of data (health data);
   1. Article 10 of the General Data Protection Regulation – regarding the processing of personal data on criminal convictions and offences.
2. Fulfillment of the requirements set out in regulatory enactments regarding the provision of services and the performance of functions set out in regulatory enactments or fulfillment of the requirements set out in other regulatory enactments. Within the framework of this purpose, we would need to fulfill the requirements of the Law on Compulsory Third Party Liability Insurance of Land Vehicle Owners (hereinafter referred to as the OCTA Law), the Insurance Contract Law, the Road Traffic Law, the Insurance and Reinsurance Law and the subordinate Cabinet regulations regarding LTAB provision of services and performance of functions specified in regulatory enactments, processing of personal data, their transfer/accumulation and retention LTAB maintained in information systems/registers, as well as the requirements of the Accounting Law, the Archives Law and other regulatory enactments. Also, in the cases and in the manner specified in regulatory enactments, we should provide the specified information about you, insurance joint-stock companies, state institutions and law enforcement institutions (for example, the state police, court, bailiffs, supervisory institutions/institutions - for the performance of functions specified in the law), insolvency administrators, medical institutions for the purpose of achieving medical treatment goals, VSAA, NVD, SIVA, Vaivari Technical Assistive Devices Center, reinsurance companies; insurance companies/insurer offices of the Green Card System member states for the settlement of claims; foreign information centers. For this purpose, we may need to process the following personal data: name, surname, personal identification number of the client/person involved/injured in the RTA, legal/legal representatives of the persons involved/injured in the RTA; telephone number, address, e-mail address; The place and circumstances of the RTA incident; insurance history data; health data, criminal record data. The main legal bases used to achieve these purposes are:
   1. compliance with a legal obligation (Article 6(XNUMX)(c) of the General Data Protection Regulation);
   1. Legitimate interests of the controller or a third party (Article 6(XNUMX)(f) of the General Data Protection Regulation);
   1. performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e) of the General Data Protection Regulation);
   1. essential interests of society, based on the legal acts of the Republic of Latvia or the European Union (Article 9, paragraph XNUMX, point g of the General Data Protection Regulation) – regarding the processing of special categories of data (health data);
   1. Article 10 of the General Data Protection Regulation – regarding the processing of personal data on criminal convictions and offences.
3. Prevention of security, threats to property interests and ensuring other significant legitimate interests of us or third parties. Within the framework of this purpose, we would need to ensure the protection/security of our territory, building, premises and other property, record telephone conversations and face-to-face conversations to provide evidence to protect our interests, use personal data processors to provide various functions, ensure data retention, if necessary, provide information to law enforcement authorities and use the rights granted in regulatory enactments to ensure our legitimate interests. For this purpose, we may need to process the following personal data of yours: data on visiting the premises, voice recording, name, surname and other data as necessary. The main legal bases used to achieve these purposes are:
   1. Legitimate interests of the controller (Article 6(XNUMX)(f) of the General Data Protection Regulation).
4. To ensure the proper provision of services. Within the framework of this purpose, we would need to maintain and improve technical systems and IT infrastructure, use technical and organizational solutions that may also use your personal data (for example, by using cookies), with the aim of ensuring the proper provision of services. The main legal bases used to achieve these purposes are:
   1. Legitimate interests of the controller (Article 6(XNUMX)(f) of the General Data Protection Regulation).

[1] REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 2016 April 27 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

How do we obtain your personal data?

We may obtain your personal data in any of the following ways:

1. from you, if you submit any submissions, applications, emails, or calls to us;
2. from you if you sign up for our services online;
3. from you by authorizing the website www.ltab.lv;
4. on the website www.ltab.lv, using cookies;
5. in the process of concluding a mutual contract, obtaining data from you;
6. from insurance joint-stock companies;
7. from third party submissions, applications, contracts, if they have indicated you as a contact person, representative, RTAs participant/injured person, beneficiary;
8. from information systems and databases of state institutions/institutions and health services (PMLP, CSDD, SSIA, Criminal Register, National Health Service, National Rehabilitation Centre "Vaivari", etc.);
9. from Green Card system member states' claims settlement insurance companies/insurers' offices; foreign information centers.

Why do you need to provide us with your personal data?

Primarily, we collect your information to fulfill the requirements set forth in the regulatory enactments – the MTPL Law, the Insurance Contract Law, the Road Traffic Law, the Insurance and Reinsurance Law and the subordinate Cabinet Regulations. LTAB functions and binding legal obligations to fulfill the contractual obligations undertaken to implement LTAB/legitimate interests of society and data subjects. In these cases, obtaining certain information is necessary for us to achieve the relevant purposes, therefore, failure to provide such information may jeopardise LTAB provision of services/performance of functions/initiation of a business relationship or performance of a contract. If the data is not necessarily required, but its submission could help improve the service or offer you advantageous contract conditions and/or offers, we will indicate when collecting the data that the provision of the data is voluntary.

Who could access your personal data?

We take appropriate measures to process your personal data in accordance with applicable law and to ensure that your personal data is not accessed by third parties who do not have an appropriate legal basis for processing your personal data.

Your personal data could be accessed, as needed:

1. our employees or directly authorized persons who need it to perform their work duties;
2. to the extent necessary for the performance of obligations specified in regulatory enactments/insurance contracts of insurance joint-stock companies and reinsurance joint-stock companies;
3. personal data processors in accordance with the services they provide and only to the extent necessary, for example, auditors, archivists, legal consultants, database developers/technical maintainers, other persons who are related to the provision of controller services/performance of functions prescribed by law;
4. third parties, carefully assessing whether there is an appropriate legal basis for such data transfer, for example, state institutions/institutions/health services and supervisory authorities in cases and in accordance with the procedure specified in legal acts, for example, law enforcement agencies, the State Border Guard, tax authorities, the State Anti-Corruption Agency, the FCMC, sworn bailiffs, insolvency administrators, courts; debt collectors (assignees);
5. Claims settlement offices of insurance companies/insurers of the Green Card system member states; foreign information centres. Detailed information on the offices of the Green Card system member states can be obtained here: https://www.cobx.org/article/4130/green-card-system-final#members ;
6. LTAB Members, OCTA Guarantee Fund Council.

Which cooperation partners in the processing of personal data or personal data processors do we choose?

We take appropriate measures to ensure that your personal data is processed, protected and transferred to data processors in accordance with applicable law. We carefully select personal data processors and, when transferring data, assess its necessity and the amount of data to be transferred. Data transfer to processors is carried out in compliance with the requirements of personal data confidentiality and secure processing.

At this time, we may cooperate with the following categories of personal data processors:

1. Insurance joint-stock companies that are members of the OCTA system;
2. outsourced accountants, auditors, legal consultants, archivist;
3. IT infrastructure, database owners/developers/technical maintainers;
4. other persons who are associated with LTAB ensuring operation.

Personal data processors may change from time to time, which we will also make changes to this document.

LTAB also performs the activities of a personal data processor on behalf of Insurance Joint Stock Companies, which are members of the OCTA system.

Is your personal data sent to countries outside the European Union (EU) or the European Economic Area (EEA)?

Your data is usually processed within the European Union (EU) and European Economic Area (EEA) countries, however, in some cases personal data may be transferred and processed in countries outside the EU and EEA, for example, to ensure the protection of the interests of third parties injured in a road traffic accident in Latvia and in the member states of the Green Card system.

The transfer and processing of personal data outside the EU/EEA may take place either on the basis of a decision by the European Commission on the adequacy of the level of protection in specific countries, or in other cases:

• in accordance with the consent of the data subject;
• if the transfer is necessary in the public interest or for the establishment, exercise or defence of legal claims;
• if the transfer is necessary for the performance of a contract between the data subject and the controller.

If you would like to receive additional information about the transfer and processing of personal data outside the EU or EEA, you can submit a separate request to us in accordance with paragraph 2 of this notice.

Is your personal data used for automated decision-making?

In some cases, we may process your personal data so that, taking into account personal aspects related to you, insurers or we can assess risks or adapt the provision of insurance services offered by various insurers to your needs, for example, to improve your experience using the services, including by adapting the display of services on the device you use, and to prepare offers suitable for you.

The main legal bases used to achieve these purposes are:

• consent of the data subject (Article 6(XNUMX)(a) of the General Data Protection Regulation);
• conclusion and performance of a contract with the data subject (Article 6(XNUMX)(b) of the General Data Protection Regulation);
• legitimate interests of the controller or a third party (Article 6(XNUMX)(f) of the General Data Protection Regulation).

How long will we store your personal data?

Your personal data is stored for as long as its storage is necessary for the relevant purposes of personal data processing, as well as in accordance with the requirements of applicable law.

When assessing the duration of personal data storage, we take into account applicable regulatory requirements, aspects of contractual obligations, your instructions (e.g. in the case of consent), as well as our legitimate interests. If your personal data is no longer necessary for the specified purposes, we will delete or destroy it.

What are your rights as a data subject regarding the processing of your personal data?

Personal data update

If there have been any changes to the personal data you have provided to us, such as changes to your personal identification number, identification document details, contact address, telephone number or email address, please contact us and provide us with the current data so that we can achieve the relevant personal data processing purposes.

Your right to access and correct your personal data

In accordance with the provisions of the General Data Protection Regulation, you have the right to request access to your personal data held by us, to request its correction, deletion, restriction of processing, to object to the processing of your data, as well as the right to data portability in the cases and in the manner specified in the General Data Protection Regulation.

The company respects your right to access and control your personal data, therefore, in the event of receiving your request, we will respond to it within the time limits set by regulatory enactments (usually no later than one month, unless there is a special request that requires longer time to prepare a response), and if possible, we will correct or delete your personal data accordingly.

You can obtain information about your personal data held by us or exercise your other rights as a data subject in any of the following ways:

1. by submitting a relevant application in person (by prior appointment) and identifying yourself at our office at the address: Toma Street 4, Riga, LV-1003, every working day from 9 a.m. to 17 p.m.;
2. by submitting a relevant application by sending it to us by mail to the following address: Toma Street 4, Riga, LV-1003.
3. by submitting a relevant application by sending it to our e-mail: ltab@ltab.lv, it is recommended to sign it with a secure electronic signature.

Upon receiving your application, we will evaluate its content and your ability to be identified, and depending on the relevant situation, we reserve the right to ask you to additionally identify yourself to ensure the security and disclosure of your data to the relevant person.

Withdrawal of Consent

If the processing of your personal data is based on your consent, you have the right to withdraw it at any time and we will no longer process your personal data that we processed on the basis of consent for the relevant purpose. However, we inform you that the withdrawal of consent cannot affect the processing of personal data that is necessary to comply with regulatory requirements or that is based on a contract, our legitimate interests or other grounds for lawful data processing set out in regulatory enactments.

You can also object to the processing of your personal data if the processing of your personal data is based on legitimate interests or is used for marketing purposes (for example, sending commercial communications or participating in sweepstakes).

Where can you file a complaint regarding issues related to the processing of personal data?

If you have any questions or objections regarding our processing of your personal data, we encourage you to contact us first.

If you nevertheless believe that we have not been able to resolve the issue that has arisen between us and you believe that we are nevertheless violating your rights to personal data protection, you have the right to submit a complaint to the Data State Inspectorate. You can find sample applications to the Data State Inspectorate and other related information on the Data State Inspectorate website (http://www.dvi.gov.lv/lv/datu-aizsardziba/privatpersonam/iesniegumu-paraugi/).