I General Provisions

1. Limited Liability Company “Troja” (hereinafter – the Company) acknowledges that personal data constitute a value belonging to you. When processing personal data, the Company complies with confidentiality requirements, ensures their security, and undertakes to protect them in accordance with this Privacy Policy (hereinafter – the Privacy Policy). The purpose of this Privacy Policy is to provide you with information about the purposes for which the Company obtains personal data, the scope and retention periods of such data, the measures taken for data protection, as well as to inform you about your rights and obligations.

2. When processing personal data, the Company complies with the laws and regulations in force in the Republic of Latvia, Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter – the Regulation), as well as other legal acts governing privacy and personal data processing.

3. The Company’s Privacy Policy applies to any natural person whose personal data are processed by the Company and is applicable regardless of the form in which you or any other natural person have provided personal data: on the Company’s websites, in paper format, electronically via e-mail, or by telephone.

4. The Privacy Policy applies to personal data processing carried out on the Company’s existing websites:
www.troja.lv; www.celazimes.lv; www.supulzirdzins.lv; www.birojamebeles.com; www.skateboard.lv; www.rockinghorse.lv; www.darbagalds.lv; www.supamasisarkliukas.lt; www.rockinghorse.lt; www.trojasmebeles.com; www.šūpuļzirdziņš.lv; www.trojasmebeles.lv; www.trojaspaneli.lv; www.zirdzins.lv; puidustkiikhobune.ee; kiikhobune.ee.

5. The Company’s Cookie Policy is available on the Company’s website under the section “Cookie Policy” (Annex No. 1).

II Identity and Contact Details of the Controller

6. Controller identity and contact details:
Limited Liability Company “Troja”
Registration No.: 40003093873
Address: Bauskas iela 143, Riga, LV–1004, Latvia
Telephone: +371 67609321
E-mail: troja@finieris.lv
Website: https://troja.lv

III Purposes of Processing and Categories of Personal Data

7. The Company processes the following personal data for the following purposes:

Recruitment:

First name, last name, gender, date of birth, contact details, work experience, education (including courses and certificates), language skills, and other information you choose to provide – for the purpose of conducting recruitment procedures and safeguarding the Company’s legal interests in relation to recruitment.

Reservation of goods and services and contractual relations:

First name, last name, gender, date of birth, contact details (telephone, e-mail) – for the purpose of ensuring convenient reservation of goods and services, organising cooperation, concluding sales and delivery transactions, ensuring efficient communication, conducting analytical and market research regarding the use of our websites, products and services, and establishing contractual relationships.

Legitimate interests:

First name, last name and other information – for the purpose of pursuing legitimate interests, such as ensuring internal and external communication, implementing elements of corporate culture, protecting property and vital interests of individuals, including life and health.

Video surveillance and access control:

Video recordings and access control data – for ensuring the safety of persons and premises, protection of property, prevention and detection of criminal offences, and securing evidence in case of disputes.

E-commerce:

Personal data related to the purchase of goods and/or services – first name, last name, delivery address, telephone number, e-mail address, company registration number and/or VAT registration number, legal address, bank account number (if the purchase is made on behalf of a legal entity and/or by a VAT payer), information about ordered goods and/or services and other order details, payment information – for the purpose of fulfilling e-commerce functions, including order processing on the website, resolving issues related to purchase and delivery, and fulfilling other contractual obligations.

Direct marketing:

First name, last name, e-mail address, telephone number – including marketing based on consent, general marketing based on legitimate interests, and individual (one-time) requests regarding the Company’s goods and/or services. When you provide your consent to receive direct marketing services (for example, on the website or in any other manner) and/or submit a request for an individual offer related to the Company’s goods/services, you express your consent to the processing of such personal data.

Communication on social media:

Account data (first name, last name, photographs, such as profile picture and/or tagged location related to the Company’s managed brand), communication data (information regarding interactions within the Company’s managed brand accounts, such as “like”, “follow”, “comment”, “share”, “visit”) – for proper brand management and promotion of its recognition in the public space. The Company administers accounts on the following social networks: Facebook, Instagram, LinkedIn, Twitter, YouTube.

Compliance with legal requirements and prevention of money laundering:

Data of cooperation partners, their officials (members of management and supervisory boards), representatives, shareholders/participants (including their family members and closely related persons) and beneficial owners – first name, last name, identification number, date of birth, position, information about shareholding, information regarding inclusion in sanctions lists and other relevant data – for compliance with legal requirements.

IV Legal Basis for the Processing of Personal Data

8. The legal basis for personal data processing carried out by the Company is as follows:

Recruitment process and safeguarding legal interests:
Processing is necessary for compliance with a legal obligation applicable to the Company (Article 6(1)(c) of the Regulation and applicable labour laws).
Upon receipt of your application, the Company has a legitimate interest in evaluating the information, organising interviews, conducting discussions, and securing evidence demonstrating the lawful conduct of the recruitment process (Article 6(1)(f)).

Establishment of contractual relationships:
Processing is necessary for the performance of a contract or taking steps prior to entering into a contract (Article 6(1)(b)).

Legitimate interests:
Processing is necessary for the purposes of legitimate interests pursued by the Company or a third party (Article 6(1)(f)).

Conclusion and performance of contracts (orders):
Processing is necessary for the conclusion and/or performance of contracts concluded with customers (Article 6(1)(b)).
Where a contract/order is concluded with a legal entity, personal data are processed on the basis of legitimate interest (Article 6(1)(f)).

Consent:
Processing is based on your consent (Article 6(1)(a)).

Sanctions and AML compliance:
Processing is based on Article 6(1)(c) (legal obligation), Article 6(1)(e) (task carried out in the public interest), and Article 9(2)(g) (substantial public interest under Union or Member State law).

V Processing, Protection and Storage of Personal Data

9. The Company applies appropriate technical and organisational security measures to protect personal data. Personal data are stored securely and accessible only to authorised persons.

10. Recipients of personal data include the Company and its authorised persons, the data subject, processors, and law enforcement or supervisory authorities.

11. Retention periods:

• Recruitment data – up to 6 (six) months if employment is not established.
• Data processed to comply with legal obligations – retained as long as required by applicable legislation.
• Video recordings – retained for 2 months.

Retention criteria include:

• Duration during which legitimate interests may be exercised (e.g., dispute resolution, legal claims, limitation periods).
• Period during which a legal obligation to retain data exists.

Once these criteria no longer apply, personal data are deleted or destroyed.

12. You have the right to:

• eceive information regarding the processing of your personal data.
• Submit a written request for the exercise of your rights by post or electronically (with a secure electronic signature).
• Receive your personal data in written form or in a commonly used electronic format.
• Request access, rectification, completion, erasure (“right to be forgotten”), restriction of processing, object to processing (including processing based on legitimate interests), and exercise the right to data portability.

Please note that exercising certain rights (rectification, erasure, restriction or portability) may result in partial or complete suspension of certain services or processes. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

13. The Company will provide a response by post to your indicated address or electronically with a secure electronic signature if requested.

14. If you have justified concerns that your personal data are processed in violation of legal requirements, you have the right to submit a claim to a court.

VI Final Provisions

15. The Company has the right to amend or supplement this Privacy Policy by publishing the updated version on the Company’s website under the section “About Us” → “Privacy Policy”.

16. You are responsible for the accuracy, correctness and completeness of the personal data you provide. If your personal data change, you must promptly inform the Company.

By providing your personal data, you assume full responsibility for the legality of their provision and are liable for any losses incurred by the Company and/or third parties resulting from unlawful processing of such personal data.