SIA SONORA CARGO PARK

PRIVACY POLICY

01.06.2025.

1. INFORMATION ABOUT THE CONTROLLER

The controller of personal data processing is SIA SONORA CARGO PARK (unified registration No. 50203327451; legal address: Čuibes iela 1, Riga, LV-1063), hereinafter referred to as the Lessor.

2. PURPOSE OF THE DOCUMENT

This Lessor's privacy policy, hereinafter referred to as the Policy, describes the basic principles and protection of personal data processing by the Lessor. More detailed information on personal data processing may be additionally described in agreements concluded between the Lessor and the Customer.

3. TERMS AND ABBREVIATIONS

Processor - a natural or legal person who processes the Customer's personal data on behalf of the controller.

Processing - any operation or set of operations which is performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

IT - information technology.

Client - a natural person who intends to enter into a contract with the Lessor.

System - a personal data processing system, a structured set of personal data fixed in any form, which is accessible in accordance with relevant personal identification criteria.

GDPR - General Data Protection Regulation - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

4. GENERAL INFORMATION

4.1. The Lessor, within the framework of applicable laws and regulations, ensures the confidentiality of personal data and implements appropriate technical and organizational measures to protect personal data against unauthorized access, unlawful processing or disclosure, accidental loss, alteration or destruction.

4.2. The Lessor may use Processors with whom data processing agreements have been concluded to process personal data. In such cases, the Lessor shall take the necessary measures to ensure that such Processors process personal data in accordance with the Lessor's instructions and in accordance with applicable laws and regulations and shall require the implementation of appropriate security measures.

4.3. The Lessor obtains personal data in order to provide its services to the Clients and to fulfill binding legal obligations, as well as to exercise legitimate interests. In the above cases, the acquisition of personal data is necessary for the Lessor to be able to provide its services to the Client, therefore, if the Client refuses to provide the necessary data, such failure to provide data may jeopardize the commencement of these services or further performance of the contract. Personal data may also be obtained with the Client's consent in order to offer the Client advantageous transaction conditions or offers.

5. CATEGORIES OF PERSONAL DATA TO BE PROCESSED

5.1. Categories of personal data collected and Processed by the Lessor:
5.1.1. identification data - name, surname;
5.1.2. contact information - phone number, e-mail address.

6. PURPOSES AND LEGAL BASIS OF PERSONAL DATA PROCESSING

6.1. The Lessor processes personal data in accordance with the following legal bases of the GDPR:
6.1.1. conclusion and execution of the contract - in order to conclude the contract upon receipt of the Client's application and ensure its execution;
6.1.2. execution of regulatory enactments - in order to fulfill the obligations set forth in binding external regulatory enactments;
6.1.3. Client's consent;
6.1.4. legitimate interests - in order to fulfill the Lessor's legal obligations arising from the existing obligations between the Client and the Lessor under a mutually concluded contract or law.

6.2. The Lessor processes personal data in accordance with the following processing purposes, which are based on legal bases arising from the GDPR and specific regulatory enactments:
6.2.1. Identification of Clients;
6.2.2. risk management, such as prevention and detection of fraud, consideration of complaints and suggestions, incident management and fulfillment of obligations set out in the Law on the Prevention of Money Laundering and Financing of Terrorism and Proliferation, and the Law on International and National Sanctions of the Republic of Latvia.

6.3. Work organization, including ensuring security in the premises, preventing or detecting criminal offenses related to the protection of property and the protection of vital interests of persons, ensuring security for information systems and computer networks, maintaining IT systems, organizing incoming and outgoing records.

7. WAYS OF OBTAINING PERSONAL DATA

7.1. The Lessor collects or may obtain personal data in any of the following ways:
7.1.1. from the Customer in the process of concluding the contract;
7.1.2. from applications, communication emails, telephone conversations;
7.1.3. from law enforcement authorities;
7.1.4. On the Lessor's website, using cookies;
7.1.5. in another way, subject to the person s legal basis for data processing.

8. PERSONAL DATA PROTECTION

8.1. The Lessor ensures, constantly reviews and improves security measures to protect the Customer's personal data from unauthorized access, accidental loss, disclosure or destruction. To ensure this, the Lessor uses modern technologies, technical and organizational requirements, including using firewalls, intrusion detection, analysis software and data encryption.

8.2. Before concluding cooperation agreements and during their validity, the Lessor carefully checks all service providers that process the Customer's personal data on behalf of and on behalf of the Lessor, as well as assesses whether cooperation partners (personal data Processors) apply appropriate security measures so that the processing of the Customer's personal data takes place in accordance with the requirements of security regulatory acts specified by the Lessor. Within the framework of the cooperation agreement, personal data processors are not allowed to process the personal data of the Lessor's Clients for other purposes than those specified in the cooperation agreements, except for cases where they are determined by regulatory enactments.

8.3. The Lessor shall not be liable for any unauthorized access to personal data and/or loss of personal data, if this does not depend on the Lessor, nor shall it be liable for inappropriate processing that occurred due to the fault and/or negligence of the Client, for example, the Client transfers inaccurate data to the Lessor for further communication.

9. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

9.1. The Lessor, in compliance with the requirements of applicable regulatory enactments, has the right to transfer the Client's personal data:
9.1.1. to law enforcement authorities, such as the police, court or other state and municipal authorities, if this results from regulatory enactments or a justified request for information by the relevant authority.
9.1.2. Lessor's IT infrastructure technicians and System maintainers, for example, IT solution developers as Processors of personal data.

10. GEOGRAPHICAL TERRITORY OF PROCESSING

10.1. Personal data processing, in compliance with the requirements of regulatory enactments, takes place in Latvia.

10.2. Personal data transfer and processing outside Latvia may occur if there is a legal basis for this and appropriate security measures have been taken to ensure that personal data protection is ensured in accordance with the level of personal data protection in Latvia and outside it.

11. DATA STORAGE PERIOD

11.1. Personal data will be processed only for as long as necessary to achieve the specific purpose of data processing. The storage period is justified as long as at least one of the following circumstances exists:
11.1.1. personal data necessary for the performance of contractual obligations will be stored until the contract is fulfilled and until other storage periods are met;
11.1.2. personal data that must be stored to meet the requirements of regulatory enactments will be stored for the periods specified in the relevant regulatory enactments, for example, accounting supporting documents must be stored for no less than five years;
11.1.3. data to prove the fulfillment of obligations will be stored, taking into account the limitation period of the claim in accordance with the limitation periods of claims specified in regulatory enactments.

11.2. The Lessor deletes or makes anonymous unnecessary or inappropriate personal data. The Customer may refuse to process his/her personal data to the extent specified in regulatory enactments by notifying the Lessor thereof in a written application, to the extent that the processing of personal data is not related to the Lessor's obligations and rights in accordance with regulatory enactments.

12. RIGHTS AND OBLIGATIONS OF THE CUSTOMER

12.1. The Lessor ensures the following rights of the Customers:
12.1.1. The Lessor provides the Customer with the opportunity to access their personal data, which are processed about them, by contacting the Lessor with a written application;
12.1.2. The Lessor ensures that upon receiving a reasoned written request from the Customer for data correction, it corrects inaccurate data and/or completes incomplete personal data, taking into account the purposes of the processing;
12.1.3. based on consent, the Lessor provides the Customer with the opportunity to withdraw their consent to the processing of their personal data on the Lessor's portal, as well as to contact the Lessor with a written request; upon receipt thereof, the Lessor evaluates and, if the request is justified, terminates the processing of the Customer's personal data;
12.1.4. The Lessor ensures the deletion of the Customer's personal data at the Customer's request in the form of a written application, to the extent that it does not conflict with the fulfillment of obligations specified in regulatory enactments. The Lessor shall evaluate each case separately and provide the Customer with a justified and reasoned response;
12.1.5. The Customer has the right to file complaints regarding the use of personal data with the State Data Inspectorate if the Customer believes that the Lessor violates his rights and interests in the processing of personal data in accordance with applicable laws and regulations.

12.2. Customer obligations:
12.2.1. to provide the Lessor with accurate personal data about himself so that the Lessor can properly and diligently provide services to the Customer and maintain further communication;
12.2.2. to update his personal data at least once a year or within a reasonable period of time to contact the Lessor immediately if there have been changes in the Customer's personal data;
12.2.3. to familiarize yourself with this Policy before starting cooperation, as well as to introduce it to any person related to the provision of the Lessor's services and whose interests may thus be affected by the processing of their personal data.

13. CONTACT INFORMATION

13.1. The Customer has the opportunity to contact the Lessor regarding questions regarding the withdrawal of consent, requests, exercise of the rights of data subjects and complaints regarding the use of personal data.
13.2. The Customer can write an e-mail to scp@sonora.lv or write to the address Čuibes iela 1, Riga, LV-1063.
13.3. Contact information of the Data Protection Officer: scp@sonora.lv or by writing to the address Čuibes iela 1, Riga, LV-1063, indicating - Data Protection Officer.

14. POLICY VALIDITY AND AMENDMENTS

14.1. The Lessor has the right to unilaterally amend this Policy at any time in accordance with applicable laws and regulations.
14.2. This Policy is available to Customers on the Lessor’s website https://sonoracargopark.lv/