Data privacy

Home / About us / Regulatory Documents / Data privacy

PERSONAL DATA PROCESSING POLICY

Approved on 07.06.2018

Terms and abbreviations

IIA – Association “The Institute of Internal Auditors”.
Data subject – an identified or identifiable natural person who can be identified, directly or indirectly, and who uses, has used or has expressed a desire to use any services provided by the IIA or to provide services to the IIA.
An identifiable natural person - a natural person, a natural person who may be identified directly or indirectly, in particular by reference to an identifier, such as the given name, surname, identification number, location data, an online identifier or one or more of the physical, physiological, economic, identify factors specific to that natural person.
Consent of the data subject – written, specific, informed and unambiguous reference to the wishes of the data subject giving his consent to the processing of his or her personal data in the form of a statement or clearly affirmative action consent.
Personal data – any sort of information relating to an identified or identifiable natural person (data subject).
Processing of personal data – any activity or set of activities carried out with or without automated means with or without personal data, such as collection, registration, organisation, structuring, storage, development, viewing, use, transfer, deletion.
Personal data controller – natural or legal person, public authority, agency or another body, determining, alone or jointly with others, the purposes and means of processing personal data.
Personal data processor – natural or legal person, public authority, agency or other body processing personal data on behalf of the controller.
The recipient of personal data – a natural or legal person, public authority, agency or another body to which the personal data are disclosed, whether or not it is a third party. However, public authorities which may receive personal data relating to a specific investigation under the law of the European Union or the Member States shall not be considered as beneficiaries; the processing of that data by those public authorities shall comply with the applicable data protection rules in accordance with the processing purposes.
General Data Protection Regulation – 27.04.2016. of the European Parliament and the Council Regulation(EU) 2016/679 on the protection of individuals with regard to the processing of personal data on the free movement on such data and repealing Directive 95/46/EC.

Data controller

The controller for the processing of personal data is "The Insitute of Internal Auditors", registration number 40008045795, address: Perse Street 9/11, Riga, LV 1011, telephone +371 26116088, email:iai@iai.lv.
The controller only processes personal data using manual methods.
The processing of personal data shall include: the collection, registration, organisation, structuring, storage, adaptation, viewing, use, disclosure, making it available to data recipients to the extent necessary for the achievement of the specific purposes; the limitation of data relating to the data subject; and the erasure or destruction of data, where this is not contrary to the requirement of laws.

What categories of data subjects are subject to the processing of personal data?

Natural personal data processed by the IIA:

Members of the IIA;
IIA customers who use the services provided by the IIA and purchase goods or voluntarily transfer their personal data (e.g. sign for news);
Persons providing services to or for IIA (e.g. lecturers, administrative workers, volunteers other than IIA members and others)

What personal data does the IIA obtain?

identification details: name, surname, personal identification number, membership identification number, username;
contact information: email, phone number, country;
professional data: job title, the employer;
service related data: transactions carried out, applications submitted, requests and complaints, acceptance certificates;
data on complacency and interest, for example, answers to survey questions.

In what way does the IIA obtain personal data?

IIA obtain personal data only by receiving it from the data subject itself in the following ways:

applying to an association;
when designing an order on the IIA website ;
applying for news receipt;
when concluding a contract;
other sources (social networks, articles, publications, news, etc.)

Why does the IIA collect this personal data?

enforcement of law duties;
to executive the objectives and tasks of the association;
to communicate with the data subject, including information about any sort of changes;
to ensure and improve the quality of service provision;
for marketing needs, including sending commercial communications, using cookies and using other forms of communication;
to make surveys and market analyses, including statistics.

Is personal data safe?

The IIA ensures an adequate level of protection for personal data and shall take all necessary technical and organisational measures to prevent unauthorized access, processing or other activity with personal data which poses or may pose a risk to their confidentiality.

Who receives personal data?

The IIA may transfer personal data to other recipients of personal data, for instance:

binding organisations ( e.g. The Institute of Internal Auditors, Inc.);
institutions (e.g., law enforcement authorities);
other legal or natural persons associated with the provisions of services to IIA, including the provision or archiving, accounting, mail, information technology, data processing services

Where will the personal data be processed?

Personal data are based on processing in the European Union/European Economic Area (EU/EEA).
To fall due in the association, personal data (name, surname, e-mail, position code, business code) shall be transferred to the United States - based The Institute of Internal Auditors, Inc.

What are the rights of the data subject with regard to the processing of their personal data?

the right to be informed about their personal data (members of the IIA can view their data on their profiles on the iai.lv home page);
the right to request the rectification of their personal data if they are inadequate, incomplete or incorrect (members of the IIA are responsible for correcting their data in accordance with the IIA regulation);
the right to delete personal data (personal data may be requested to be deleted if the data subject withdraws his consent and there is no legal basis for the processing of personal data or if the personal data has been processed unlawfully);
the right to withdraw consent (if there is no legal basis for the processing of personal data);
the right to restrict the processing of their personal data (where the data subject requires that processing be restricted, with the exception of the exercise of legitimate rights);
the right to data portability;
the right to submit a complaint regarding the processing of personal data to the State Data Inspectorate (www.dvi.gov.lv) if the data subject considers that the processing of personal data infringes its rights and interests in accordance with the applicable laws and regulations.

How long personal data will be stored?

Personal data will only be processed for as long as needed. The period of storage may be based on the legitimate interests of the IIA or the applicable laws and regulations (for example, the rules on accounting, prescription, civil rights, etc.)

What are cookies and do we use them?

A cookie is a small text file that is stored on your computer or another used device (such as a mobile phone) when a person/user visited the website and is stored in a user web browser with a view to storing data. The text file contains information that is used to improve the experience of using the site for visitors to a specific website.
The IIA uses cookies to provide more convenient browsing of the IIA website and to learn more about the behaviour of users of the IIA website, and provide a more convenient and reliable experience of use.
Before the user starts using the IIA website, the IIA must obtain the users consent for the use of cookies. The IIA website contains a pop - up window that informs the user about the use of cookies, and the user is asked to accept the use of cookies by clicking OK. Without approval of session cookies, the user will not be able to make full use of the IIA website. If the user does not agree with the use of cookies but continues to use the IIA website, it shall be considered as the users consent for the use of cookies.
Cookies used by the IIA on its website do not store data that could be identified directly by the data subject. The data collected will not be transferred to third parties. Any personal information that could identify the data subject will not be released.
Multiple types of cookies (permanent and session) are used. They differ with the purpose of use and the length of storage. Time - consuming cookies may be updated and adapted to the needs of improving the quality of service provision, but the general usage objectives are:

User authentication - provides user recognition and safer use of the internet site.
Usage statistics and analysis - provides information on how and how frequently IIA websites are used, what user groups are and what search tools are used. Cookies statistics can also be obtained from websites of the partners;
The user has the option to choose and change the use of cookies. If a user doesnt want to use cookies on his devices, he or she can change the browsers security settings must be made individually for each browser and the setting methods used may vary.

Contact info

All questions concerning the processing of personal data by IIA and IIA personal data processing policy may be asked by letter to iai@iai.lv

Return to the top

Data privacy

Cookies