RSU Privacy Policy

Version 3

1. Controller and contact details

1.1. The Personal Data Processing Controller is Rīga Stradiņš University (hereinafter referred to as RSU), uniform registration No. 90000013771, registered office: Riga, Dzirciema iela 16, LV-1007, rsursu[pnkts]lv, tel. +37167409219.

1.2. Contact information of the data protection specialist personu[pnkts]datirsu[pnkts]lv, tel. +37167409144.

2. General provisions

2.1. The purpose of the Privacy Policy is to provide natural persons (hereinafter referred to as Persons) with information on the purpose of personal data processing, legal grounds, scope of processing, person’s rights, personal data processing periods and other information.

2.2. The Privacy Policy is established pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the Regulation).

2.3. The Privacy Policy applies to ensuring personal data protection for:

2.3.1. RSU students, applicants, employees, including potential, former and current, business partners, and third parties receiving or transferring to RSU any information;
2.3.2. persons present on RSU territories or sites where video surveillance is being conducted;
2.3.3. users of the RSU website and persons whose personal data are processed on RSU social networks in connection with promotion or public awareness activities relating to RSU operations;
2.3.4. persons participating in events organised by RSU, for example, RSU annual ball, graduation ceremony, seminar, etc.;
2.3.5. other cases when RSU processes personal data.

2.4. The Privacy Policy applies to the processing of personal data, regardless of the form and/or environment in which personal data are processed (electronically, in paper format, by telephone).

2.5. In individual personal data processing cases, which are not listed in the Privacy Policy, other regulations or personal data processing purposes and legal grounds may be binding, of which Persons shall be informed before the relevant processing of data commences.

3. Legal grounds for personal data processing

2.6. RSU processes personal data based on the following legal grounds:
2.6.1. The consent of the Person (Article 6(1)(a) of the Regulation);
2.6.2. Concluding and ensuring the performance of a contract (Article 6(1)(b) of the Regulation);
2.6.3. In order to comply with the obligations laid down in RSU regulatory enactments (Article 6(1)(c) of the Regulation);
2.6.4. To protect the vital interests of Persons (Article 6(1)(d) of the Regulation);
2.6.5. To perform a task carried out in the public interest or in the exercise of official authority legally conferred on the controller (Article 6(1)(e) of the Regulation);
2.6.6. To pursue the legitimate interests of RSU (Article 6(1)(f) of the Regulation).

4. Purposes of personal data processing

2.7. RSU processes personal data for the following purposes:
2.7.1. Addressing applicants, selecting applicants, and designing students’ personal file. Personal data processing is performed on the basis of law, contract, the consent of the Person and legitimate interest;
2.7.2. Ensuring the study process, including preparation of a study contract, preparation, awarding and accounting of diplomas, preparation, awarding and accounting of certificates, statements, awards, etc. The processing of personal data is carried out on a lawful and contractual basis;
2.7.3. For analysing and supporting study, scientific and administrative management processes. Personal data processing is performed on the basis of law, contract, the consent of the Person and legitimate interest;
2.7.4. Providing library and reading room services. Personal data processing is performed on the basis of law and contract;
2.7.5. Receiving services and preparing contracts, to fulfil the conditions of the concluded contracts and related regulatory enactments, incl. amendment of contracts. Personal data processing is performed on the basis of law and contract;
2.7.6. Establishing and providing employment relationships (including selection of employees). Personal data processing is performed on the basis of law, contract, the consent of the Person and legitimate interest;
2.7.7. Compliance with the requirements of the laws and regulations governing accounting. Personal data processing is performed on the basis of law, contract, and legitimate interest;
2.7.8. Serving and controlling payments, including payment of salaries, retrieval of study debts and recovery. Personal data processing is performed on the basis of law, contract, and legitimate interest;
2.7.9. Ensuring the labour protection requirements of employees and students. Personal data processing is performed on the basis of law, contract, and for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
2.7.10. Reviewing und processing applications, statements and complaints. Personal data processing is performed on the basis of law and legitimate interest;
2.7.11. Managing and controlling the rights of access. Personal data processing is performed on the basis of law, contract, the consent of the Person and legitimate interest;
2.7.12. Organising the process of health insurance for employees and students. Personal data processing is performed on the basis of law, contract, the consent of the Person and legitimate interest;
2.7.13. Maintaining and improving the RSU website (cookies). Personal data processing is performed on the basis of legitimate interest;
2.7.14. Providing information to public administration institutions and subjects of operational activities in the cases and to the extent specified in external regulatory enactments. Personal data processing is performed on the basis of law and legitimate interest;
2.7.15. RSU organisational management, planning and accounting (incl. document management, processes, services, information systems, ensuring the succession of RSU, implementation of public relations and social responsibility). Personal data processing is performed on the basis of law, contract, the consent of the Person and legitimate interest;
2.7.16. Securing RSU infrastructure, services, information, employees, students and visitors, prevention of illegal or other threats, promotion of detection of criminal offenses, incl. ensuring security and property protection (video surveillance, access control systems). Personal data processing is performed on the basis of law, contract, the consent of the Person, vital interests and legitimate interest;
2.7.17. Scientific or academic research. Personal data processing is performed on the basis of law, contract, the consent of the Person;
2.7.18. Preventing the risks to the health of students and staff, and for the provision of RSU study, scientific and administrative activities – processing of special categories or sensitive personal data, if there is a legal basis, and one of the special conditions for processing sensitive personal data specified in Article 9 of the Regulation. Personal data processing is performed on the basis of law, contract, the consent of the Person and legitimate interest;
2.7.19. Providing a whistleblowing system. Personal data processing is performed on the basis of law;
2.7.20. Ensuring control of the prevention of conflicts of interest in the activities of public officials in accordance with the competence defined for RSU. Personal data processing is performed on the basis of law and contract;
2.7.21. Organisation of public procurement and procurement according to the RSU procurement procedure and preparation of contracts. Personal data processing is performed on the basis of law, contract, and legitimate interest;
2.7.22. Other specific purposes of which the Persons are informed prior to the processing of personal data.

5. Acquisition of personal data, duration of storage and automated decision making

2.8. Personal data may be obtained in the following ways:
2.8.1. Upon the Person’s explicit and unambiguous consent;
2.8.2. Information provided to the RSU by the Persons themselves, by the Persons or their authorised representative contacting or cooperating with RSU, such as concluding a contract, requesting information or submitting an application to address a specific issue or request, visiting RSU facilities, communicating through information channels, including social networks, attending RSU events or activities, where photographs or video recordings may be taken and for which information has been provided in advance;
2.8.3. In order to comply with the requirements laid down in regulatory enactments, to ensure long-term cooperation and credit risk management, RSU may also request data from publicly available registers;
2.8.4. When visiting the RSU website, cookies may be used, about which information is provided during the visit to the website;
2.8.5. From information systems audit trails (access time, activities performed, etc. in the information system).
2.9. RSU stores and processes personal data as long as at least one of the following criteria applies:
2.9.1. As long as the contract concluded with the Person is in force;
2.9.2. As long as RSU or the Person may exercise their legitimate interests in accordance with the procedures laid down in external regulatory enactments (e.g., file an objection or take legal action);
2.9.3. As long as either party has a legal basis or legal obligation to store the data;
2.9.4. As long as the consent of the Person to the relevant processing of personal data is in force.
2.10. Automated decision-making takes place:
2.10.1. Within the framework of the admission process, where the assessments of centralised examinations and entrance examinations laid down in the admission regulations are entered into the system, as well as the number of budget and tuition fee study places determined by the RSU rector’s decree. The admission system calculates the results of competitions using the Gale-Shapley algorithm;
2.10.2. Within the framework of the distribution of scholarships granted from the state budget, where students’ assessments and indicators of scientific activity are entered into the system, as well as the number of scholarships available from the state budget. If the number of available scholarships is less than the number of student applications and the existing assessments and criteria are not sufficient to decide on the award of a scholarship, an electronic draw is carried out.

6. Transfer of personal data to third parties and transfer of personal data outside the European Union or the European Economic Area

2.11. RSU does not disclose personal data to third parties, except:
2.11.1. In the case and to the extent specified in regulatory enactments;
2.11.2. If the explicit and unambiguous consent has been obtained from the Persons;
2.11.3. If the data must be transferred to a third party based on a concluded contract;
2.11.4. To law enforcement institutions in accordance with the procedures specified in regulatory enactments;
2.11.5. To RSU employees processing personal data;
2.11.6. To certified auditors, auditors or other personal data controllers based on a contract.
2.12. The provision of information to the Ministry of Health, the Ministry of Education and Science, the Central Statistical Bureau, the State Audit Office, the State Revenue Service and other State administration institutions shall take place in the cases and to the extent specified in regulatory enactments.
2.13. If RSU transfers personal data to personal data processors or data recipients outside the European Union or the European Economic Area, RSU will ensure that the level of protection of data of personal data processors or data recipients is equivalent to that ensured by RSU.

7. Persons' Rights and obligations and the implementation procedure

2.14. In accordance with regulatory enactments, Persons have the right to request access to their personal data, request to supplement, rectify or erase it, to restrict processing, to request a copy of data, as well as to object to processing of personal data and to submit a complaint to the Data State Inspectorate. RSU provides Persons with the right to data portability.
2.15. Persons may receive information about natural persons and legal persons that have received information about the Person from RSU, unless the disclosure of such information is prohibited by regulatory enactments.
2.16. Persons can submit a request regarding the exercise of their rights:
2.16.1. In writing, in person at the Records Management and Archives Department in Rīga, 16 Dzirciema iela, LV-1007, by presenting a personal identification document;
2.16.2. Via e-mail in a free form to the official electronic address rsursu[pnkts]lv;
2.16.3. Via e-mail, by sending a request for the rights of the data subject (form LK-20), signed with a secure electronic signature, to the RSU e-mail address dokumentirsu[pnkts]lv;
2.16.4. By sending a request to the Unified portal of state and municipal services (www.latvija.lv), incl. by sending a request to the RSU official electronic address.
2.17. RSU ensures compliance with personal data processing and protection requirements in accordance with the applicable legislation and, in the event of objections, performs reasonable actions to resolve an objection. In any case, Persons retain the right to contact a supervisory authority, i. e. the Data State Inspectorate.

8. Other provisions

2.18. RSU has the right to make additions or changes to the Privacy Policy, making it available to Persons at the RSU website https://www.rsu.lv/en/riga-stradins-university-privacy-poli… or at RSU premises in paper form.

Annex 1. Information on personal data processing at RSU

1. Video surveillance in the territory and facilities of RSU

Purpose of data processing – Securing RSU infrastructure, services, information, employees, students and visitors, prevention of illegal or other threats, promotion of detection of criminal offenses, incl. ensuring security and property protection.
Legal basis – Article 6(1)(b), (d), (f) of the Regulation.
Data recipients – Data Subject about himself/herself, RSU authorised employees, law enforcement authorities.
Data storage period – Video surveillance in RSU territory and sites is in real time and recordings are stored for no less than 14 (fourteen) days and no more than 35 (thirty-five) days.

2. Recruitment

Purpose of data processing – Ensuring the procedure of selecting employees.
Legal basis – Article 6(1)(b) of the Regulation.
Data recipients – RSU employees who need it for the performance of their job duties, data processors (if necessary), supervisory authorities (State Labour Inspectorate, etc.), outsourced recruitment companies.
Data storage period – Employee selection information is stored for 4 months after the end of the recruitment process. If legal employment relations are established with the Person, then the selection information is stored together with employment information in accordance with the provisions of regulatory enactments.

3. Publishing contact details of employees on the RSU website

Purpose of data processing – Availability of contact details assigned to an RSU employee for ensuring communication in work matters.
Legal basis – Article 6(1)(f) of the Regulation.
Data recipients – Data Subject about himself/herself, RSU employees, state and local government authorities, third parties.
Data storage period – The contact details assigned to an RSU employee is published on the RSU website for easy communication on work matters. Contact details of employees are maintained on the RSU’s website while the employment relationship is in place. Upon termination of the legal employment relationship, the contact details of the employee are erased from the RSU website. Persons have the right to object to the processing of their personal data based on Article 6(1)(f) of the Regulation.

4. Processing of personal data of students for ensuring the study process

Purpose of data processing – Ensuring the study process, including preparation of a study contract, preparation, awarding and accounting of diplomas, preparation, awarding and accounting of certificates, statements, awards, etc.
Legal basis – Article 6(1)(b), (c) and (e) of the Regulation, Section 46(2) of the Law on Higher Education Institutions, Paragraph 5 of Regulations of the Cabinet of Ministers No.203 of 27 March 2007 “Preparation and Updating of Student’s Personal File”. The circulation of information in the State Education Management System is ensure in accordance with Regulations of the Cabinet of Ministers No.276 of 25 June 2019 “Regulations of the State Education Information Education System”.
Data recipients – Data Subject about himself/herself, RSU authorised employees, state and local government authorities whose rights to receive information are defined in regulatory enactments.
Data storage period – The Student’s personal file is stored for 75 years.

5. Implementation of continuing education and professional improvement measures

Purpose of data processing – Implementation of continuing education and professional improvement programmes at RSU.
Legal basis – Article 6(1)(b) and (c) of the Regulation. Personal data for the implementation of continuing education and professional improvement measures are processed on the basis of the procedure defined in Regulations of the Cabinet of Ministers No. 943 of 18 December 2012 “Procedures for Certification of Medical Practitioners”, Regulations of the Cabinet of Ministers No. 268 of 24 March 2009 “Regulations Regarding Competence of Medical Practitioners and Students who Acquire First or Second level Professional Higher Medical Education Programmes in Medical Treatment and the Amount of Theoretical and practical knowledge of Such Persons”.
Data recipients – Data Subject about himself/herself, RSU authorised employees, data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the performance of the statutory functions and insofar as the retention period is based on the requirements of the RSU Nomenclature of Files.

6. Commercial communications

Purpose of data processing – Commercial communications on RSU and/or third party services and other notifications not directly related to the provision of contracted services, such as surveys of persons.
Legal basis – Article 6(1)(a) of the Regulation.
Data recipients – Data Subject about himself/herself, RSU authorised employees, data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments, third parties, which have legal basis to receive data.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the performance of the statutory functions and insofar as the retention period is based on the requirements of the RSU Nomenclature of Files. The consent given by the person to receive commercial communications is valid until it is withdrawn (also after the termination of the contract, if any has been entered into).

7. Processing of personal data during time for the provision of remote online work and study processes

Purpose of data processing – E-mails assigned to ensure the e-learning environment, work or study process and functionality of related information technology tools provide a wide range of remote functions for work and learning purposes (electronic tests, meetings, case reports, online essays, submission of written or audiovisual materials, circulation of documents, organisation of remote examinations and/or classes).
Legal basis – Article 6(1)(a), (e), (c), (f) of the Regulation.
Data recipients – Data Subject about himself/herself, RSU authorised employees, data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments, third parties, which have legal basis to receive data.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the performance of the statutory functions and insofar as the retention period is based on the requirements of the RSU Nomenclature of Files. Persons have the right to object to the processing of their personal data based on Article 6(1)(e) and (f) of the Regulation. Persons have the right to revoke consent to the processing of their personal data based on Article 6(1)(a) of the Regulation.

8. Sending informative messages in case of information system outages and information technology incidents

Purpose of data processing – Sending informative text messages to RSU employees and students in cases when it is not possible to inform employees and students about RSU information systems outage or information technology incident by sending information to the employee's or student's RSU assigned e-mail address.
Legal basis – Article 6(1)(f) of the Regulation.
Data recipients – Data Subject about himself/herself, RSU authorised employees, data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the performance of the statutory functions and insofar as the retention period is based on the requirements of the RSU Nomenclature of Files. Persons have the right to object to the processing of their personal data based on Article 6(1)(f) of the Regulation.

9. RSU online seminars, conferences and other events

Purpose of data processing – Use of communication platforms such as Zoom, MS Teams (including other MS data exchange and communication products) for RSU’s needs – provision of work, study process and public events (seminars, conferences, etc.).
Legal basis – Article 6(1)(a) and (f) of the Regulation.
Recipients of data – Data Subject about himself/herself, RSU authorised employees, data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments, third parties.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the implementation of the purpose. Before the event, Persons are informed about the content of the event, the legal basis for the processing of personal data, the duration of the storage and the purpose of the use of personal data, etc. Persons have the right to object to the processing of their personal data based on Article 6(1)(f) of the Regulation. Persons have the right to revoke consent to the processing of their personal data based on Article 6(1)(a) of the Regulation.

10. Photography, audio and video recordings of the events organised by RSU for ensuring publicity

Purpose of data processing – Photography, audio and video recording videos of the events organised by RSU and ensuring publicity.
Legal basis – Article 6(1)(a) and (f) of the Regulation.
Data recipients – Data Subject about himself/herself, RSU authorised employees, data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments, third parties.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the implementation of the purpose. Before the event, Persons are informed about the content of the event, the legal basis for the processing of personal data, the duration of the storage and the purpose of the use of personal data, etc. Persons have the right to object to the processing of their personal data based on Article 6(1)(f) of the Regulation. Persons have the right to revoke consent to the processing of their personal data based on Article 6(1)(a) of the Regulation.

11. Ensuring online video streaming and video recording of simulations and skill learning for quality of simulation-based education

Purpose of data processing – Ensuring video streaming and video recording of simulations for the provision of the study process.
Legal basis – Article 6(1)(c) and (f) of the Regulation.
Recipients of data – Data Subject about himself/herself, RSU authorised employees, data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments.
Data storage period – In some cases, video and voice recordings are made that are temporarily stored for 64 hours (exception – examinations where time is defined in accordance with the procedures for submitting an examination appeal). In other cases, video and voice recordings may be created to create study material. Long-term storage of such records is provided on the basis of consent of the Person or contract. In the event of withdrawal of consent, training materials are anonymised.

12. Scientific and study research

Purpose of data processing – To develop internationally recognised fundamental and applied research within the framework of academic freedom, generating new knowledge and skills necessary for the sustainable development of society. To ensure the implementation of study and scientific research at RSU.
Legal basis – Article 6(1)(a) of the Regulation.
Data recipients of data – Data Subject about himself/herself, RSU authorised employees, data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the implementation of the purpose. Prior to conducting a study or scientific research, Persons get informed consent containing information on privacy protection and confidentiality, availability of research results, use of data and biological samples, rights of research participants, including the right to refuse to participate or terminate participation at any time, details of personal data to be processed in the research, information on the storage of personal data, including the duration of storage and action in the event of termination of participation in the research, information on the data controller (in student research, the data controller is the student who conducts the study, unless otherwise agreed with the institution from which the data originated, whereas in scientific research the data controller is RSU). Persons have the right to revoke consent to the processing of their personal data based on Article 6(1)(a) of the Regulation.

13. Wall of Honour for employees and students

Purpose of data processing – Honouring employees and students, posting information about employees and students on the Wall of Honour.
Legal basis – Article 6(1)(f) of the Regulation.
Data recipients – Data Subject about himself/herself, RSU employees and students, third parties.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the implementation of the purpose. As part of events honouring employees and students, employees and students may submit their photos and descriptions of their life/professional activity and achievements for publishing on the RSU wall of valour. Persons have the right to object to the processing of their personal data based on Article 6(1)(f) of the Regulation.

14. Whistleblowing

Purpose of data processing – Ensuring a whistleblowing system.
Legal basis – Article 6(1)(c) of the Regulation.
Data recipients – RSU authorised employees, personal data processors (if needed), state and local government authorities whose rights to receive information are defined in regulatory enactments.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the performance of the statutory functions and insofar as the retention period is based on the requirements of the RSU Nomenclature of Files.

15. Prevention of conflict of interest in activities of public officials

Purpose of data processing – Prevention of conflict of interest in the activities of public officials to ensure control in accordance with the authorisations defined for RSU.
Legal basis – Article 6(1)(c) and (e) of the Regulation.
Data recipients – Data Subject about himself/herself, RSU authorised employees, state authorities whose rights to receive information are defined in regulatory enactments.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the performance of the statutory functions and insofar as the retention period is based on the requirements of the RSU Nomenclature of Files.

16. Organisation of public procurement and procurement and preparation of contracts

Purpose of data processing – Organisation of public procurement and procurement and conclusion of contract relationships in accordance with the RSU procurement procedure.
Legal basis – Article 6(1)(b) and (c) of the Regulation.
Data recipients – Data Subject about themselves, RSU authorised employees, state authorities and third parties whose rights to receive information are defined in regulatory enactments.
Data storage period – The personal data of the RSU are processed and stored only for as long as necessary for the performance of the statutory functions and insofar as the retention period is based on the requirements of the RSU Nomenclature of Files.

17. For dormitory services

Purpose of data processing – Provision of dormitory services.
Legal basis – Article 6(1)(a), (b), (d) and (f) of the General Data Protection Regulation, Law on Residential Tenancy, Immigration Law.
Data recipients – Data Subject about himself/herself, RSU authorised employees, state and local government authorities whose rights to receive information are defined in regulatory enactments.
Data storage period – 5 years.