Privacy policy

WESTech, spol. s r.o. has been a part of ELKO Group since 2000. The privacy policy below applies to all companies in ELKO Group.

1. General Provisions

1.1. The purpose of this Privacy policy (hereinafter the “Privacy policy”) is to provide the data subject with information on the purpose, legal basis, scope and conditions of processing, on the safeguards on the part of ELKO Group, and on the data subject’s rights relating to the processing of their personal data. Additional information about the processing of personal data may be included in agreements, non-disclosure notices and other documents, and may also be provided on the ELKO Group website.

1.2. This Privacy policy applies to ELKO and ELKO Group companies.

1.3. ELKO Group is committed to the privacy of data subjects and to the protection of personal data, and respects the rights of data subjects to the lawfulness of the processing of personal data in accordance with the General Data Protection Regulation and applicable national laws, as well as other legislation on data protection and the processing of personal data.

1.4. ELKO Group has taken appropriate technical and organizational measures to protect personal data against unauthorized access, unlawful disclosure, accidental loss, alteration, destruction and other unlawful processing.

1.5. Personal data are obtained directly from the data subject, from services used by the data subject (e.g. in an electronic trading system), and from external sources (e.g. public registers or databases) or from other persons (e.g. a legal person represented by the data subject, or an employee, representative or beneficiary thereof). ELKO Group may record telephone conversations, make video and/or audio recordings, except for e-mail communications, or otherwise document interactions and communication between the data subject and ELKO Group.

2. Terms and abbreviations used in the Privacy policy:

2.1. Processing - any operation or set of operations performed on personal data or groups of personal data, whether or not by automated means, such as obtaining, registering, organizing, structuring, storing, altering or modifying, recovering, accessing, viewing, using, disclosing by transmission, disseminating or otherwise making available, as well as coordinating, combining, restricting, erasing or destroying them.

2.2. Processor - a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

2.3. Controller - ELKO Group, which processes the personal data of the data subject in accordance with the predetermined purposes and methods of personal data processing;

2.4. Data subject - a potential, current or former client of ELKO Group - a natural person, job applicant, visitor, visitor and user of the website (including the e-commerce system), participant in events organised by ELKO Group, employee of legal persons (e.g. customers, business partners, tenants of ELKO Group, etc.), representative, contact person, authorised person, beneficiary, and any other identified or identifiable natural person whose personal data are processed by ELKO Group;

2.5. Electronic trading system - the electronic trading system of ELKO Group used by the respective ELKO Group company ( or other body);

2.6. ELKO - the “ELKO Grupa” joint-stock company, company ID No: 40003129564, with its registered office at Toma Street 4, Riga, LV - 1003, Latvia;

2.7. ELKO Group - the ELKO group of companies and its member companies operating in the European Union and the European Economic Area;

2.8. Elko Group company - a company that is a member of ELKO Group;

2.9. Personal data - any information relating to an identified or identifiable natural person (data subject).

2.10. General Data Protection Regulation - Regulation (EU) 2016/679 of the European Parliament and of the Council on the Protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC.

3. Information about the controller

3.1. Any ELKO Group company may be a controller, processor or joint controller in the processing of the personal data of a data subject.

3.2. The controller is the ELKO Group company that has the personal data of the data subject at its disposal, for example on the basis of a contractual relationship or prior to entering into a contractual relationship, through the submission of a request to the data subject or by visiting the premises of the ELKO Group company or otherwise.

3.3. A list of ELKO Group companies and their contact information, and the addresses of the websites of each company are available on the website:

4. Purposes of the processing of personal data

4.1. An ELKO Group company processes personal data mainly for the following purposes:
4.1.1. for compliance with legal obligations;
4.1.2. for concluding and signing contracts;
4.1.3. for registering the client in the electronic trading system, ensuring the operation of the electronic trading system, and for improving operation;
4.1.4. for placing orders, delivering goods and fulfilling product warranty obligations;
4.1.5. for preparing invoices and making payments;
4.1.6. for the identification of the client/data subject;
4.1.7. for communication;
4.1.8. for carrying out the business activities of ELKO Group, including administrative, accounting and archiving activities;
4.1.9. for ensuring the proper employee selection process in ELKO Group and for monitoring the legitimate interests of ELKO Group as they relate to the selection of employees;
4.1.10. for exercising the ELKO Group's rights;
4.1.11. for ELKO Group's marketing activities (e.g. provision of information and offers, organisation of events for business partners/employees and their relatives, and reporting on them in the media and on social networks, promotion of the good name and image of ELKO Group); ;
4.1.12. for the monitoring of spaces, warehouses and premises of the respective ELKO Group company by a CCTV system;
4.1.13. for the prevention and detection of crime;
4.1.14. for obtaining and preserving evidence in civil litigation;
4.1.15. for reviewing applications/complaints and other documents;
4.1.16. for other purposes in legally justified cases.

4.2. In each of the cases referred to in paragraph 4.1 of the Privacy policy, ELKO Group processes personal data to the extent permitted by the specific purpose for which the personal data are processed, and in accordance with the procedures provided for and permitted by applicable laws and regulations.

5. Legal basis for the processing of personal data

5.1. ELKO Group processes personal data on the following legal bases:
5.1.1. For the purpose of concluding and signing contracts - the processing of personal data is carried out for the purpose of ensuring the conclusion of contracts, the provision of services/sale of goods, the execution of payments or the resolution of problems arising from a concluded contract, as well as for the purpose of carrying out pre-contractual measures;
5.1.2. For the purpose of compliance with legal obligations - the processing of personal data are necessary to enable ELKO Group to comply with its obligations under the law, for example in relation to requirements regarding administration, accounting and archiving, in anti-money laundering and anti-terrorism directives, and to comply with international sanctions and with requests from law enforcement, supervisory and other authorities, to the extent and in the manner provided for by the law;
5.1.3. For the purpose of exercising or protecting legitimate interests - on this basis, personal data are processed, for example, for the purpose of preventing and detecting crimes related to the protection of property, as well as for the purpose of obtaining and protecting evidence in civil disputes (CCTV monitoring), debt recovery, loss prevention, protection of the rights and interests of ELKO Group, its clients and business partners, and for the purpose of promoting the good name of ELKO Group. On the basis of the legitimate interests of ELKO Group, personal data are also processed during the process of selecting employees at ELKO Group. In such cases, an assessment will be made as to whether the processing of the data subject’s personal data would violate the data subject’s privacy.
5.1.4. Consent - in some cases, ELKO Group requires consent for the processing of personal data. In such cases, the data subject will be informed of the specific purposes of the processing. The data subject has the right to withdraw their consent at any time.
5.1.5. Public interest - in some cases, the processing of data subjects’ personal data may be carried out on the grounds of general public interest. In most cases, these are exceptional cases where the processing of personal data must be carried out in the context of unforeseen threats to the public or to a specific data subject, for example in the context of the spread of the COVID-19 virus.

6. Categories and types of personal data

6.1. The amount and categories of personal data to be processed depend on the purpose of the processing, which may be different in each situation. ELKO Group processes the following categories and types of personal data in particular:
6.1.1. Identification data, such as the personal identification code, date of birth, data from identity documents, including photographs;
6.1.2. Contact information, such as address, phone number, e-mail address;
6.1.3. E-commerce system usage data, such as data about accesses, user names and passwords in the e-commerce system, goods purchased, activities performed in the e-commerce system environment, and user habits;
6.1.4. Financial data, such as information on the execution of payments by customers in relation to goods sold by ELKO Group;
6.1.5. Account details, such as bank account numbers;
6.1.6. Reliability and research data, such as data on the payment discipline of the counterparty, data enabling ELKO Group to conduct customer research on the prevention of money laundering and terrorist financing and to verify compliance with international sanctions, including the purpose of cooperation, as well as whether the business partner, their representative, and/or the actual recipient is a politically exposed person;
6.1.7. Data obtained and/or created during the course of fulfilling obligations imposed by law, such as information that ELKO Group is obliged to provide to institutions such as the tax authorities, courts and law enforcement authorities;
6.1.8. Data about communication and communication devices, such as data contained in messages and e-mails, videos, photographs and/or audio recordings, as well as other types of data about communications and interactions during the data subject’s visit to ELKO Group premises (including the use of an ELKO Group access permit), during organised events or the contacting of the data subject, as well as data relating to the data subject’s visits to the ELKO Group website (including visits to e-commerce systems).
6.1.9. Professional data, such as education and employment data;
6.1.10. Special category personal data,such as data on the suitability of the job applicant for a vacancy.

7. Data protection measures

7.1. In order to protect personal data, ELKO Group applies various technical and organizational security measures to protect personal data from unauthorized disclosure, access, loss, deletion and destruction (e.g. data encryption, anti-theft devices, firewalls, security passwords, etc.).

7.2. Personal data are made available to a limited number of ELKO Group employees and relevant processors who need it to carry out their official duties/tasks and who are bound by confidentiality.

8. Transfer/disclosure of personal data

8.1. ELKO Group is entitled to send personal data to persons to whom it is entitled to provide them (for example processors, legal service providers, etc.), or if such an obligation arises from legal regulations or concluded contracts, or if it has obtained the consent of the data subject to do so.

8.2. ELKO Group companies are entitled to send personal data to the following recipients in particular:
8.2.1. another ELKO Group company, as long as the relevant company has established the relevant procedures regarding the processing of personal data in ELKO Group, or in other cases where this is permitted by law;
8.2.2. institutions and authorities such as supervisory authorities, tax authorities, law enforcement authorities, bailiffs, sworn notaries, courts and out-of-court settlement institutions;
8.2.3. credit and financial institutions, insurance providers, third parties involved in the execution of transactions, payments and reporting;
8.2.4. financial and legal advisors, auditors;
8.2.5. providers of information systems and databases;
8.2.6. debt recovery service providers, successors, insolvency administrators;
8.2.7. other persons and contractors related to the provision of ELKO Group services, including CCTV monitoring services, IT services, telecommunications services, archiving services, postal services, etc.

8.3. ELKO Group does not regularly or systematically transfer personal data to third countries (countries outside the European Union and the European Economic Area) however, personal data may be processed by third-country processors (e.g. technical solution developers or service providers). In such cases, ELKO Group ensures, when transferring personal data, that the procedures set out in legislation ensure a level of processing and protection of personal data as set out in the General Data Protection Regulation.

9. Personal data retention period

9.1. ELKO Group does not retain personal data for longer than necessary for the relevant purpose of such processing, or for longer than is provided for by binding legal regulations.

9.2. The personal data retention period depends on the purpose for which the personal data were collected and whether the retention period is set by law.

9.3. ELKO Group is obliged to determine the period of personal data processing taking into account, inter alia, the date of termination of the business relationship, the withdrawal of the data subject’s consent to the processing of their personal data, and the statutory period during which ELKO Group or the data subject may exercise their legitimate interests (e.g. to object, lodge a complaint or bring legal proceedings).

10. Profiling and automated decision-making

10.1. ELKO Group does not carry out profiling or automated decision-making in relation to data subjects.

11. Cookies

11.1. ELKO Group companies use cookies on their websites. The cookies used and information about them is available in the ELKO Group Cookie policy (, which is published on the website of the respective ELKO Group company.

12. CCTV monitoring

12.1. If the relevant ELKO Group company carries out video monitoring by CCTV, then as the controller of the personal data obtained through such monitoring, it is obliged to place information boards about such CCTV monitoring at the entrances to the relevant premises/areas where CCTV monitoring is carried out.

12.2. ELKO Group may use CCTV monitoring for the following purposes in particular:
12.2.1. prevention and detection of crime for property protection;
12.2.2. obtaining and preserving evidence in civil litigation;

12.3. CCTV monitoring is carried out without audio recording. In some cases, an ELKO Group company may also use CCTV monitoring with audio recording, however this must be indicated on the posted information boards

12.4. The following conditions must be met for the purpose of CCTV monitoring:
12.4.1. Video monitoring must be carried out at such an angle of view that it covers only the necessary territory for monitoring purposes;
12.4.2. CCTV monitoring may not be carried out in areas with increased privacy protection (sanitary facilities, showers, changing rooms, kitchens);
12.4.3. The personal data collected during CCTV monitoring will be collected from data subjects located in the area subject to such monitoring;

12.5. Personal data processed in connection with CCTV monitoring (video recordings) carried out by ELKO Group will be stored only for the necessary period of time, with a maximum retention period of 90 (ninety) days from the date of the recording, unless another processing purpose arises (e.g. in connection with a criminal investigation). The retention period for video recordings is usually much shorter than the above-mentioned period.

12.6. Categories of personal data to be processed during CCTV monitoring - visual (video) data - video recordings, photographic fixation, date, place and time of the recording.

12.7. Personal data collected during CCTV monitoring may be sent to the following recipients:
12.7.1. law enforcement/supervisory authorities, in those cases provided for by law and upon reasoned request;
12.7.2. LKO Group companies and their authorised persons involved in the management of the CCTV system or in the implementation of the relevant processing purpose, external service providers, CCTV system providers, security service providers providing security services, insurance service providers during the investigation of insured cases, ELKO Group business partners (e.g. manufacturers of goods, suppliers, purchasers) - as evidence in the event of disputes relating to the correct packaging, receipt, transfer of goods, etc., and other persons where there is a proper legal basis;

12.8. When releasing video recordings, ELKO Group ensures that only the data necessary to achieve the relevant purpose of the personal data processing are released.

13. Rights of the data subject

13.1. In accordance with the General Data Protection Regulation, the data subject has the following rights in relation to the processing of their personal data:
13.1.1. to obtain confirmation from the relevant ELKO Group company that it processes the personal data of the data subject and, if the company processes such data, the data subject has the right of access to such data;

13.2. to request the rectification of the data subject’s personal data if it is incorrect, incomplete or inappropriate (the data subject does not have the right to request the rectification or completion of video footage as this would be considered falsification or misrepresentation of information);
13.2.1. to request the erasure of the data subject's personal data;
13.2.2. to restrict the processing of the data subject's personal data;
13.2.3. to object to the processing of the data subject's personal data insofar as the processing is carried out on the basis of the legitimate interests of an ELKO Group company;
13.2.4. to receive the personal data provided by the data subject to the respective ELKO Group company and processed on the basis of consent or the execution of a contract, in a structured form in a commonly used electronic format and, if possible, to send these personal data to another service provider (the right to data portability);
13.2.5. to withdraw the data subject’s consent to the processing of their personal data.

13.3. The rights of the data subject referred to in paragraph 13.1 of the Privacy policy may be exercised unless ELKO Group has a statutory obligation to process the personal data.

13.4. In order to prevent the unauthorised disclosure of the data subject's personal data to third parties, ELKO Group will exercise the data subject's rights upon written request provided that the data subject has first been identified.

13.5. Requests will be submitted in one of the following ways (the contact details of the relevant ELKO Group company are given on its website):
13.5.1. by signing the request with a valid and secure electronic signature and sending the request to the e-mail address of the relevant ELKO Group company;
13.5.2. by a personal visit to the offices of the relevant ELKO Group company during their opening hours and after verification of the identity of the data subject by an employee of the ELKO Group company to which the relevant application is being submitted;;
13.5.3. by sending a written request to the official address of the relevant ELKO Group company, stating the postal address to which the reply is to be sent. The reply to the request will be sent by registered mail to the postal address indicated in the request.

13.6. The reply to the data subject's request will be made no later than one month following receipt of the request, however this period may be extended by two months where objectively necessary.

13.7. In some cases specified in legislation, ELKO Group is not entitled to provide the data subject with information about the processing of their personal data.

13.8. ELKO Group is entitled to refuse to comply with the conditions set out in a request from the data subject if the data subject unjustifiably refuses to provide their identification data.

13.9. ELKO Group reserves the right not to release personal data, including personal data collected during CCTV monitoring, in cases where such release would:
13.9.1. have an impact on other data subjects, and it would not be technically feasible to release such personal data without infringing the rights of other data subjects;
13.9.2. require additional time, personnel or financial resources because of the size or complexity.

13.10. The data subject may lodge a complaint in relation to the processing of their personal data carried out by an ELKO Group company with the data protection supervisory authority in the country where the relevant ELKO Group company is based, if the data subject considers that the processing of their personal data constitutes a violation of their rights and interests in accordance with data protection laws.

13.11. The contact information of data protection supervisory authorities is available on their websites: Latvia - Lithuania - Estonia - Poland - Czech Republic - Romania - Slovakia - Slovenia - Sweden -

14. Contact information

14.1. If you have any doubts or would like further information about the processing of personal data by ELKO Group, please contact ELKO Group by sending an e-mail to:

Availability of the Privacy policy and its amendments

15.1. ELKO Group is entitled to unilaterally modify and amend the Privacy policy at any time by posting the current version of the Privacy policy on ELKO Group's website at

15.2. The Privacy policy has been drafted in the Latvian language and may be translated into other languages used in the countries where ELKO Group operates. In the event of linguistic or interpretative contradictions, disagreements or statements, the Latvian language text will be legally binding.
  1. Privacy policy