Individuals associated with our customers, subcontractors and suppliers

According to our standards we only collect personal data necessary for our specified purposes and we encourage our customers, subcontractors or suppliers to only share personal data where it is strictly required for those purposes.

If, as part of the professional services provided to customers or within the framework of cooperation with subcontractors or suppliers, we also need to process the data of individuals with whom we do not have direct communication, we ask our customers, subcontractors and suppliers to provide the relevant data subjects with information about the use of their data. Our customers, subcontractors and suppliers may use the relevant sections of this privacy statement or refer to this privacy statement in their communication with their data subjects if they deem it appropriate.

PwC may process the following personal data:

name, surname, phone number, e-mail and other contact information, as well as position, of the business contact,
personal data of the company's legal or authorized representatives and beneficial owners, as well as data of other individuals associated with the customer, subcontractor or supplier, for example:
- first name, last name, position,
- personal identification number or birth data,
- personal ID document data,
- sources of personal income,
- a person's status as a politically exposed person,
- the amount of the person's income and other information that may be necessary for providing services to customers, cooperating with a subcontractor or receiving goods and services from suppliers.

Legal basis of processing

Purposes of processing

Retention

PwC's legal obligation (subsection c) of Article 6(1) of General Data Protection Regulation):

Anti-Money Laundering and Terrorism and Proliferation Financing Act;
International and national sanctions law of the Republic of Latvia;
Audit Services Law;
requirements and guidelines of PwC supervisory authorities;
Accounting Law.

Personal data may be processed for the following purposes:

to obtain information about the legal and authorized representatives of the customer, subcontractor or supplier - a legal entity - for their identification and checks against sanctions lists;
to obtain information about the ultimate beneficial owners of the customer, subcontractor or supplier - a legal entity - for their identification, due diligence obligations and checking against sanctions lists, as well as for checking independence;
to fulfill the reporting obligations to supervisory authorities;
to process and store information for accounting purposes.

Five years after the termination of business relations or for accounting purposes in accordance with Article 28 of the Accounting Law.

PwC’s legitimate interests (subsection f) of Article 6(1) of General Data Protection Regulation).

Personal data may be processed for the following purposes (description of legitimate interests):

to provide PwC’s services (for example, we will analyze salary data as part of audits of financial statements; we often need to use personal data);
to communicate about implementation of our service agreement;
to communicate about ordering, delivery of goods and/or services and other matters;
to manage relationships with customers, subcontractors or suppliers;
to improve PwC and the quality of its services (for example, we monitor the quality of the services provided to customers, which may include the processing of personal data held in the relevant customer’s file (including the data of subcontractors). We have implemented policies and procedures to monitor the quality of the services provided and manage risks related to contracts concluded with customers);
to carry out security and risk management activities (for example, we have implemented security measures to protect our own and our customers' information (including personal data), which include the detection, investigation and prevention of security threats; personal data may also be processed as part of our security monitoring, for example, by performing automated scans to identify malicious emails);
to make personal data available to PwC employees who provide services and offer new services;
to identify customers with similar needs;
to analyze market trends, prepare relationship maps or evaluate opportunities to offer new services;
to enforce legal claims.

As long as the personal data is necessary for the described purposes, as long as the person works for a specific customer, subcontractor or supplier or as long as there are other legitimate interests of PwC that are considered more important than the interests of the data subject.

In the absence of specific regulatory or contractual requirements or other legal basis, we generally retain documents and other documentary evidence arising from the provision of services or cooperation with a subcontractor or supplier for no longer than 5 years.