AS “SENTOR FARM APTIEKAS” shall ensure that the processing of personal data in its possession is carried out in accordance with the requirements set out in the laws and regulations and the guidelines of good practice of the European Union and the Republic of Latvia.

This Privacy Policy is designed to provide information about aspects of the processing of Customers' personal data.

Content

Terminology

Term	Description
Customer	a natural person whose personal data is held by the Controller because the person: - has purchased, is purchasing or has expressed a wish to purchase goods offered by the Controller; or - has used, is using or has expressed a wish to use the services offered by the Controller; or - has in any other way cooperated, is cooperating or has expressed a wish to cooperate with the Controller.
Controller	AS “SENTOR FARM APTIEKAS”, uniform registration number 55403012521, registered office: Riga, Mūkusalas iela 41b.
Pharmacy	The Controller’s structural unit – a pharmacy that provides pharmaceutical care to patients.
Processor	a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
Personal data	any information relating to an identified or identifiable natural person.
Online pharmacy	The Controller’s structural unit, which, in accordance with the requirements laid down in the laws and regulations, operates an Online pharmacy by providing online ordering and payment facilities via a virtual website www.e-menessaptieka.lv.
Distance agreement	an agreement concluded online in the Online pharmacy, whereby the Customer has expressed a clear and unambiguous wish to purchase from the Controller the goods placed in the Online pharmacy and has made payment for the goods, and the Controller has undertaken to fulfil the Customer’s order.
Processing	any action taken by the Controller in relation to the Customer’s Personal data (including the collection, recording, storage, viewing, use, disclosure, transfer, erasure or destruction of the Customer’s personal data).
Regulation No. 2016/679/EU	Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
Privacy Policy	this Privacy Policy.
Personal data	any information relating or likely to relate to the Customer (e.g. the Customer’s name, addresses, telephone number, email address).
Consent	any confirmation freely and knowingly given by the Customer consenting to the processing of his/her personal data for a specific purpose.
Data State Inspectorate	the authority supervising the application of Regulation No. 2016/679/EU in the Republic of Latvia.

What is the scope of application of the Privacy Policy?

This Privacy Policy is applied to ensure the privacy and protection of personal data of persons (Customers within the scope of this Privacy Policy) who:

have purchased, are purchasing or have expressed a wish to purchase goods offered by the Controller;
have used, are using or have expressed a wish to use the services offered by the Controller (including participation in loyalty programmes, sweepstakes, marketing activities and other similar events);
have in any other way cooperated, are cooperating or have expressed a wish to cooperate with the Controller (including participating in the Controller’s recruitment process);
visited the Controller’s pharmacy, office and other premises;
visited the website and mobile applications maintained by the Controller.

The Privacy Policy does not apply to and does not include information about the processing of personal data attributable to the Controller’s: - employees;

The Controller’s business partners (natural persons), employees/authorised persons employed by the Controller’s business partners who are related to ensuring of the provision of the Controller’s services.

The Privacy Policy applies to data processing regardless of the form and/or medium in which the Customer provides personal data / the Customer’s personal data are received (on the Controller’s website, mobile applications, self-service portal, in paper form or by telephone) and in which electronic information systems of the Controller or in which paper files they are processed.

Additional specific rules may be laid down for specific types of data processing, which shall be communicated to the Customer at the time of providing the relevant personal data to the Controller.

Who processes the Customer’s personal data?

The Customer’s data controller is AS “SENTOR FARM APTIEKAS”, uniform registration number 55403012521, registered office: Mūkusalas iela 41b, Riga.

The Controller shall/may engage Processors – companies that have relevant knowledge and skills necessary for the provision of specific services (e.g. companies maintaining the Controller’s information systems, organisers of marketing activities), and, if necessary, shall also transfer the personal data of Customers to the Processors for the implementation of measures necessary for the provision of its business activities. The mutual legal relationship between the Controller and the Processor shall be governed by a written agreement. Processors may only process Customer’s personal data in accordance with the instructions of the Controller and may not use them for other purposes. These companies have a set of measures to be implemented to ensure adequate protection of Customer privacy and personal data, in accordance with the requirements set out in the laws and regulations and the cooperation agreement with the Controller.

What type of Customer’s personal data does the Controller process, for what purposes and on what basis, and what is their storage period?

Purpose

Sale of prescription medicines to the Customers

Personal data set (categories)	Legal basis	Description	Duration of storage
Customer identification data: name, surname; personal ID number/identification number; date of birth. Prescription information: date of prescription; information on the prescribing institution/medical practitioner; person’s diagnosis code; medicine prescribed to the person; information about filling a prescription.	Providing medical treatment or healthcare management services. [1] The Customer’s consent or data processing follows from the Customer’s contractual obligations where the cost of the prescription medicine is covered in whole or in part by insurance companies.[2]	In order for the Controller to be able to sell prescription medicines to the Customer, the Controller is required to process the Customer’s personal data in accordance with the provisions of laws and regulations (including the transfer of information on filled e-prescriptions to the National Health Service by electronically registering the data in the National Health Service information system “Unified Health Sector Electronic Information System”). In order for the Controller to ensure that a Customer who has an insurance agreement which includes an obligation of the insurance company to reimburse all or part of the costs of prescription medicines does not have to make payments from personal financial resources, the Controller needs to exchange information with the relevant insurance company.	Special prescriptions for narcotic or psychotropic drugs shall be stored at the Pharmacy for five years, and other special prescriptions for three years. Ordinary prescriptions shall be stored at the Pharmacy for one year. Prescriptions issued in a member state of the European Union, the European Economic Area or the Swiss Confederation shall be stored at the Pharmacy for three years.
Purpose	Conclusion and fulfilment of a distance (delivery) agreement
Personal data set (categories)	Legal basis	Description	Duration of storage
Customer identification data: name, surname. Customer contact information: telephone number, email address, goods (order) delivery address. Customer financial information: information on settlements.	Distance (delivery) agreement. [3]	In order for the Controller to deliver and for the Customer to receive the selected product at the Online pharmacy, the Controller needs to process the Customer’s personal data for the preparation and performance of the Distance (Delivery) Agreement.	As long as at least one of the following criteria applies: - there is a legal obligation to store the data for a certain period of time in accordance with laws and regulations; - it is necessary to pursue the legitimate interests of the Controller; - it is necessary to fulfil the assumed contractual obligations.
Purpose	Receiving information about the Controller’s special offers (marketing)
Personal data set (categories)	Legal basis	Description	Duration of storage
Customer identification data: name, surname. Customer contact information: telephone number, email address, gender, date of birth. Customer’s order/purchase history.	Customer’s consent.[4]	The Controller sends information about the Controller’s news to Customers via electronic means of communication; taking into account the Customer’s purchase history, purchase habits and the Customer’s Online pharmacy browsing history, the Controller prepares and sends individually tailored advertisements and offers.	Until the Customer withdraws its consent to such processing of personal data. The Customer has the right to withdraw his/her consent at any time by sending a notice to aptieka@menessaptieka.lv.


Purpose	Participation in a loyalty programme
Personal data set (categories)	Legal basis	Description	Duration of storage
Customer identification data: name, surname. Customer contact information: telephone number, email address. Information about the Loyalty Card and its use: the Customer’s Loyalty Card number; address of the Pharmacy where the purchases were made; date and time of the purchase; product names; product quantities; product prices; total purchase price (after all discounts granted), the amount of Loyalty Card money added; the amount of discounts granted by the Loyalty Card.	Customer’s consent.[5]	Loyalty programme members are offered various benefits – accumulation of Loyalty Card money, use of Loyalty Card money, sales promotions only for Loyalty Card holders, discounts, etc.	For as long as the Loyalty Card is valid (the Customer is a member of the Loyalty Programme).
Purpose	Participation in lotteries
Personal data set (categories)	Legal basis	Description	Duration of storage
Customer identification data: name, surname. Customer contact information: telephone number, email address.	Customer’s consent.[6] Safeguarding the legitimate interests of the Controller. [7]	The Controller shall process the Customer’s personal data in order to administer loterries if the Customer has expressed a wish to participate in them (including to ensure that lotteries participants’ claims are examined and/or evidence is provided in accordance with the procedure established by laws and regulations). Also, the Controller shall process the Customer’s personal data in order to determine and notify the lotteries winner; to identify the Customer when distributing lotteries prizes; and to include the Customer’s name in the list of lotteries winners.	Lotteries registration data shall be stored for 5 years.[8]
Purpose	Evaluating applications in the recruitment process
Personal data set (categories)	Legal basis	Description	Duration of storage
Customer identification data: name, surname. Customer contact information:	Customer’s consent.[9]	The Controller processes the personal data submitted by the Customer (including the personal data submitted using the option in the “Career” section on the website www.menessaptieka.lv)	The processing of the Customer’s personal data will be carried out until the evaluation and selection of applicants for the vacant position is completed.

telephone number, email address, residence address. Information about the Customer’s education: name of the educational institution, duration of studies, education/profession obtained. Information about the Customer’s professional experience: job title, duration of employment, position, duties performed. Other information provided by the Customer in the CV and cover letter.		in order to ensure the recruitment process, including to assess the Customer’s candidacy for the vacancy for which the Customer has applied; to contact the Customer in order to notify the results of the competition to fill the vacancy and, if the Customer’s candidacy matches the vacancy, to invite the Customer to an interview.	After the end of the competition, the Customer’s personal data will be deleted or destroyed. The processing of the Customer’s personal data may be carried out over a longer period if the Customer provides consent to participate in other recruitment competitions of the Controller (to receive other job offers). The Customer has the right to withdraw his/her consent to such processing of personal data at any time.
Purpose	Improving the use of websites
Personal data set (categories)	Legal basis	Description	Duration of storage
Cookies.	Customer’s consent.10 Safeguarding the legitimate interests of the Controller.11	Cookies are used on the websites www.menessaptieka.lv and www.e-menessapieka.lv. Cookies are small text files that are created and stored on the Customer’s device (computer, tablet, mobile phone, etc.) when visiting the Online pharmacy. Cookies “remember” the Customer’s browsing experience and basic information and thus improve the ease of use of the Controller’s website. Cookies are used to process the Customer’s overall habits as a user and the history of use of the website, to diagnose problems and deficiencies in the functioning of the website, to collect statistics on user habits, as well as to ensure the full and convenient use of the functionality of the website. There are several types of cookies: a) Strictly necessary cookies (which are necessary for the website to function). The use of these cookies does not require the Customer’s consent. b) Functional cookies (allow the website to remember the choices made by the visitor (e.g. user name, language used, etc.), thus improving and personalising the website).	Strictly necessary cookies are stored on the user’s device until the web browser is closed (only during the browsing session, and therefore belong to the category of session cookies). Functional cookies are permanently stored on the user’s device. Performance or analytics cookies (identify only the user’s device, but do not reveal the user’s identity) are stored for 2 years.

1011 Regulation No. 2016/679/EU Article 6 (1) (a). Regulation No. 2016/679/EU Article 6 (1) (f).

		c) Performance or analytics cookies (third party cookies) – collect information about how a visitor uses the Controller’s website; which sections of the website are most frequently visited; and are used to detect errors or receive error notifications. Strictly necessary cookies are processed for the purposes of the legitimate interests of the Controller, while functional and performance or analytics cookies are processed on the basis of the Customer’s consent. If the Customer does not wish to allow the use of cookies, the Customer may do so in the browser settings, however, in this case the use of the website may be significantly disrupted and impeded. It is possible to delete the stored cookies by deleting the stored cookie history in the settings section of the browser of the device.
Purpose	CCTV
Personal data set (categories)	Legal basis	Description	Duration of storage
Image and other personal data in the field of view of CCTV cameras.	Safeguarding the legitimate interests of the Controller.[10]	CCTV is used as a means to ensure the security of property, information, employees and third parties, as well as to prevent, control and detect illegal activities and to carry out effective investigations in the event of such activities.	1 month, except where the information contained in the CCTV recording is needed as evidence in civil, administrative or criminal proceedings or investigations. In these cases, the CCTV recordings may be kept for as long as necessary and destroyed as soon as they are no longer needed.

How does the Controller obtain the Customer’s personal data?

The Controller obtains the Customer’s personal data from:

the Customer (for example, when the Customer visits the Controller’s websites; places an order with the Online pharmacy; applies for participation in sweepstakes), based on the Customer’s consent;
third parties, in cases, according to the procedure and to the extent provided for by laws and regulations (for example, when purchasing prescription medicines in the Controller’s pharmacy, personal data are processed in the information system of the National Health Service information system “Unified Health Sector Electronic Information System”).

Is the Customer obliged to provide his/her personal data?

The Customer is not obliged to provide the Controller with his/her personal data, however, if the Customer chooses not to provide the Controller with his/her personal data, it is likely that the Controller will not be able to provide the Customer with the services he/she has chosen, for example, it will not be possible to conclude a distance agreement; to inform the Customer about the Controller’s marketing offers; to purchase prescription medications, including medications that are fully or partially reimbursed from state budget funds.

Who is responsible for keeping the Customer’s personal data up to date?

The Controller shall ensure the accuracy of personal data and their timely updating, rectification or erasure where personal data are incomplete or inaccurate in accordance with the purpose of the processing of personal data.

The Controller relies on the Customer and third parties to provide the Controller with truthful information and accurate personal data, including that after the personal data have been provided to the Controller in cases where the personal data have become outdated, there have been changes to the personal data provided, the personal data shall be updated, where this is consistent with the purpose of the processing of personal data.

To whom does the Controller transfer the Customer’s personal data?

The Controller shall transfer the Customer’s personal data to:

business partners (Processors or individual controllers) related to the provision of services to the Controller; the Controller’s business partners process personal data only in accordance with the Controller’s instructions and cannot use them for other purposes; the Controller carefully evaluates business partners before starting cooperation;
persons specified in external laws and regulations (law enforcement authorities, courts or other state and local government authorities) in order to comply with a legal obligation; the transfer of personal data is carried out if a written request is received and there is a legal basis for such personal data processing; the transfer of personal data is carried out in the manner and to the extent provided for by the relevant law or regulation;
third parties in the cases provided for by laws and regulations for the protection of the legitimate interests of the Controller (for example, for debt collection).

Does the Controller transfer the Customer’s personal data outside the EU/EEA?

The Controller shall not transfer the Customer’s personal data outside the European Union and the European Economic Area.

If the Controller’s business partners – Processors, to whom the Controller has entrusted the processing of the Customer’s personal data on behalf of the Controller, carry out such processing outside the European Union and the European Economic Area, the Controller shall ensure that, with regard to data security and technical requirements, the respective service providers comply with the requirements set out in Regulation No. 2016/679, other laws and regulations of the European Union and the Republic of Latvia, and good practice guidelines.

What are the Customer’s rights regarding the processing of personal data by the Controller?

The Controller shall, within the framework of compliance with the requirements of the laws and regulations governing privacy and the protection of personal data, ensure the Customer’s rights on the basis of a written request from the Customer:

Rights	Description
Access to personal data	The Customer has the right to obtain confirmation from the Controller as to whether or not the Customer’s data are being processed and, if they are being processed, to access and receive the following information about his/her data: - purposes of data processing; - categories of personal data; - recipients of personal data; - duration of storage of personal data or the criteria for determining the duration of storage.
Rectification of personal data	The Customer has the right to request the Controller to rectify his/her data if the Customer has established that the information held by the Controller about the Customer is incorrect or incomplete.
Erasure of personal data	The Customer has the right to request the erasure of his/her data and the Controller will comply with this request without delay if at least one of the following conditions exists: - the data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; - the Customer withdraws his/her consent to the processing of the data, and if there is no other lawful basis for the processing; - where the processing is based on the legitimate interests of the Controller or of a third party and there is no overriding legitimate ground for the processing; - the Customer objects to the processing of his/her data for direct marketing purposes; - if the data have been processed unlawfully; - to ensure compliance with a legal obligation imposed on the Controller by laws, regulations or administrative provisions; - if the Customer data were collected in connection with the provision of information society services.
Restrict processing of personal data	The Customer shall have the right to request that the Controller restrict the processing of the Customer’s personal data held by the Controller.
Object to processing of personal data	The Customer has the right to object to the processing of the Customer’s personal data based on the legitimate interests of the Controller.

The request of the Customer as a data subject (hereinafter referred to as the request) shall be in writing or in a form that may be deemed to be in writing in accordance with laws and regulations, such as an electronic document signed with a secure electronic signature.

How long will it take for the Controller to process the Customer’s request?

The Controller shall respond to the Customer’s request without undue delay, but no later than within one month of receipt of the Customer’s request. If necessary, taking into account the scope of the Customer’s request, the Controller shall have the right to extend the deadline for the execution of the request by two months. In this case, the Controller will inform the Customer of the reasons for the extension and the reasons for the delay within one month of receipt of the request.

How will the Controller provide information in response to the Customer’s request?

The Controller will respond to the Customer’s request as far as possible taking into account the method of receipt of the response indicated by the Customer.

What to do if the Customer believes that the Controller has violated the Customer’s rights while processing personal data?

The Controller shall ensure the processing of the Customers’ personal data in accordance with the requirements of Regulation No. 2016/679/EU, other laws and regulations of the European Union and the Republic of Latvia and the Privacy Policy. In the event that the Customer believes that the Controller has infringed the Customer’s right to the protection of personal data while processing the Customer’s personal data, the Customer has the right to submit a complaint to the Controller, the Data State Inspectorate or, in accordance with the laws and regulations, to file a claim with the court for the protection of his/her interests as set out in the laws and regulations.

How is the security of Customers’ personal data ensured?

The Controller guarantees non-disclosure and security of the Customers’ personal data by using modern technologies, taking into account the existing privacy risks and the Controller’s reasonably available organisational, financial and technical resources, including by ensuring physical and environmental security of the Customers’ personal data; restricting the right of access to the Customers’ personal data (access to the Customers’ personal data is limited to the Controller’s authorised employees who need them to perform their work duties); encrypting the Customers’ personal data; protecting the computer network, personal devices; backing up the data, and other security measures, thereby also ensuring the protection of Customer’s personal data against unlawful access, use or disclosure.

The Processors engaged by the Controller for the processing of the Customers’ personal data shall be carefully evaluated and informed about the set of measures to be taken to ensure the processing, confidentiality and protection of the Customers’ personal data in accordance with the requirements of laws and regulations before the commencement of cooperation. The Processors shall ensure compliance with the requirements for the processing and protection of Customer’s personal data in accordance with the requirements set out in the laws and regulations and the cooperation agreement concluded with the Controller.

Contact information

For issues related to the processing of the Customers’ personal data (including to provide feedback or raise objections to the processing of personal data), you may contact the Controller or the Controller’s Data Protection Officer:

AS “SENTOR FARM APTIEKAS”, registered office: Riga, Mūkusalas iela 41b; telephone: 67617805, email address: aptieka@menessaptieka.lv;
email address of the Data Protection Officer: dpo@repharm.lv.

How does the Controller provide up-to-date information about the processing of the Customers’ personal data?

In order to ensure that the Customer always has up-to-date information about the processing of the Customer’s personal data, the Controller shall ensure that this Privacy Policy is regularly reviewed and updated in accordance with the requirements of laws and regulations. The Controller encourages the Customers to consult the current version of the Privacy Policy on the Controller’s website from time to time.

[1] Regulation No. 2016/679/EU Article 9 (2) (h); Cabinet Regulation No. 175 of 8 March 2005 “Regulations for Manufacture and Storage of Prescription Forms, as well as Writing out and Storage of Prescriptions”, Cabinet Regulation No. 134 of 11 March 2014 “Regulations regarding the Unified Health Sector Electronic Information System”.

[2] Regulation No. 2016/679/EU Article 6 (1) (a) and (b); Article 9 (2) (a).

[3] Regulation No. 2016/679/EU Article 6 (1) (b).

[4] Regulation No. 2016/679/EU Article 6 (1) (a); Article 9 (2) (a).

[5] Regulation No. 2016/679/EU Article 6 (1) (a); Article 9 (2) (a).

[6] Regulation No. 2016/679/EU Article 6 (1) (a).

[7] Regulation No. 2016/679/EU Article 6 (1) (f).

[8] Paragraph 5 of the Cabinet Regulation No. 16 of 2 January 2007 “Procedures for Supervision and Control of the Compliance with the Law on Lotteries of Goods and Services”.

[9] Regulation No. 2016/679/EU Article 6 (1) (a).

[10] Regulation No. 2016/679/EU Article 6 (1) (f).

(Approved by Order No. 210520 of the Chairman of the Management Board of AS “SENTOR FARM APTIEKAS” of 21 May 2019. Valid from 21.05.2019.)