Eco Baltia JSC (AS)

PERSONAL DATA PROCESSING STATEMENT ON RECRUITMENT DATA PROCESSING FOR DATA SUBJECTS

1. Controller details  

Our name is JSC (AS) “Eco Baltia”, registration number: 40103435432, registered address: Maskavas iela 240-3, Riga, LV-1063 You can call us by phone: +371 67409828 or write us to: info@ecobaltia.lv

2. Contact details for personal data protection matters

If you have any questions about this Statement or the processing of your personal data, you can contact us using the details shown in Section 1 or via e-mail: dati@ecobaltia.lv

3. General description of how we process personal data

This Statement describes how we process the personal data of applicants for our job openings and of other persons whose data may come into our possession in relation to our recruitment activities.

The purpose of this Statement is to familiarise persons who seek to apply for the job openings we and other companies within our group advertise, as well as persons whose data has been provided to us by job applicants (e.g. to provide references) with the rules we follow in the processing of personal data.

This is the current version of the Statement. We reserve the right to amend and update this Statement as necessary.

The purpose of this Statement is to provide you with an overview of our data processing activities and their purposes. Please note, however, that other documents (available on www.karjera.ecobaltia.lv) may also contain information about the processing of your personal data.

We recognise that your personal data are of value to you, we undertake to process your data a way that upholds the confidentiality and security of your personal data that come in our possession.

4. What do we process your personal data for, and what are the legal grounds for the processing of your personal data?

We will only process your personal data in accordance with pre-defined legitimate purposes, including:

To conduct the recruitment process and to exercise the rights and duties that arise from it

As part of this purpose, we collect CVs/resumes from job applicants, we contact them and the references that they specified in their CVs, we may seek additional information about the applicant using public sources, we save CVs in order to use them with other potential job openings (with the applicant’s consent) and to be able to defend our interests in court proceedings, we also save personal data to respond to claims and cases brought before courts.

For this purpose and for the sub-purposes indicated above, we may need at least the following personal data: name, surname, contact details (e-mail address, phone number), education and previous work experience of the applicant, as well as persons who can provide references and their contact details, references about the applicant, and other information that could be relevant for the performance of the job and for determining the best applicant.

The main legal grounds used to achieve these purposes are:

–           consent (Article 6(1)(a) of the General Data Protection Regulation[1]);) based on your submitting your CV and the storage of your CV for future job openings;

–           conclusion of a contract with the data subject (Article 6(1)(b) of the General Data Protection Regulation) for the processing of the data of those applicants whom we decide to conclude the employment contract with;

–           fulfilment of legal duties (Article 6(1)(c) of the General Data Protection Regulation) in certain cases for certain types of data, where laws and regulations set requirements for a specific job;

–           legitimate interest of the controller (Article 6(1)(f) of the General Data Protection Regulation) in the event of provision of evidence, in the context of possible legal claims, and in relation to the scope of information requested.

To conclude the employment contract

As part of this purpose, we collect the information that we need to include in the employment contract and its annexes, to identify you, to verify your qualifications, and to prepare the employment contract itself. To do this, we may need at least the following personal data: the employee’s name, surname, personal identity number, residence address, phone number, employment start date, place of work, education details, professional qualifications, job description, position, work contact details, wage amount, current account number, and health data, if applicable.

The main legal grounds used to achieve these purposes are:

–           conclusion of a contract with the data subject (Article 6(1)(b) of the General Data Protection Regulation);

–           fulfilment of legal duties (Article 6(1)(c) of the General Data Protection Regulation) with regard to the information to be shown in the employment contract and the necessary qualification requirements, as well as the reporting of the employment to public authorities (e.g. the State Revenue Service); –           fulfilment of the controller’s duties and exercise of its rights in the field of employment (Article 9(2)(b) of the General Data Protection Regulation) as part of the processing of special categories of data (health data, trade union membership).

Prevention of threats to security, property interests, and other important legitimate interests that we, or third parties, have.

For this purpose, we need to conduct video surveillance of our grounds, in our buildings and in other property, use personal data processors to perform various functions, exchange information within our company group whenever necessary, exercise the legitimate-interest rights vested in us by laws and regulations. As part of this purpose, we may need to process at least the following personal data: data contained in video surveillance recordings, premises access data recorded by access control systems, etc.

The main legal grounds used to achieve these purposes are:

–           Legitimate interest of the controller (Article 6(1)(f) of the General Data Protection Regulation).

5. Who can access your personal data?

We take appropriate measures to process your personal data in accordance with applicable laws and to ensure that your personal data are not accessed by third parties without appropriate legal grounds for processing your personal data.

If necessary, your personal data can be accessed by:

–           our employees and those of other companies in our group, or persons directly authorised to do so for the purpose of performing their work, such as accountants, line managers, human resources staff;

–           personal data processors in accordance with the services they provide and only to the extent necessary, such as accounting service providers, auditors, financial management and legal consultants, database technical maintenance providers;

–           other persons involved in the controller’s recruitment process and other companies in our group;

–           in the cases determined by law, national and local authorities such as law-enforcement and tax agencies.

6. What personal data processing partners/processors do we choose?

We take appropriate measures to ensure that the processing and protection of your personal data and their transfer to data processors is in accordance with applicable law. We carefully select our personal data processors and, whenever we transfer data to them, we assess the need for the transfer to take place and the amount of data to be transferred. The transfer of data to our processors takes place in compliance with the requirements governing confidentiality and secure processing of personal data.

We may currently work with the following categories of data processors:

–           outsourced accountants, recruitment companies, auditors, financial management and legal consultants;

–           IT infrastructure, database owner/developer/technical maintainer, other parties involved in conducting the recruitment process for the controller and other companies within our group.

Personal data processors may change from time to time, and we will amend this document in line with such changes.

7. Are your personal data transferred to countries outside the European Union (EU) or the European Economic Area (EEA)?

We do not transfer data to countries outside the European Union or the European Economic Area.

8. How long will we keep your personal data for?

Your personal data will be stored for as long as it is necessary for the purposes for which the personal data are processed and in accordance with the requirements of applicable law.

Whenever we assess the personal data retention period, we take into account the applicable legal requirements, the performance of contractual obligations, your instructions (e.g. in the case of consent), as well as our legitimate interests. If your personal data are no longer necessary for the purposes specified, we will delete or destroy them.

For example, we will keep your CV and supporting documents submitted for a specific job opening until the end of the recruitment process and for at least 6 months afterwards, in order to safeguard ourselves against possible claims and legal proceedings against us. However, if you have submitted your CV and supporting documents without addressing them to a specific job opening, or if you have given your consent for your CV and supporting documents to be used in later recruitment, we will store your CV and supporting documents for 1 year. You always have the right to withdraw your consent to the storage of such data.

If we offer you an employment contract, your CV and supporting documents may be added to your employee file and stored for the duration of the contract, if necessary.

9. What are your rights as a data subject in the context of processing your personal data?

Updating personal data

If there are changes in the personal data you have provided to us, such as in your contact address, phone number or e-mail, please contact us and give us updated data so that we can achieve the corresponding purposes of processing your personal data.

Your right to access and rectify your personal data

In accordance with the General Data Protection Regulation, you have the right to access your personal data that we are in possession of, to request that these data be rectified, deleted, that the processing of your data be restricted, to object to the processing of your data, and you have the right to data portability in the cases and in the manner specified in the General Data Protection Regulation.

We respect your right to access and control your personal data, so if we receive such a request from, we will respond to it within the time prescribed in laws and regulations (usually no more than a month, unless there is a specific request that requires more time to prepare a reply) and, if possible, we will rectify or delete your personal data accordingly.

You can obtain information about your personal data that are in our possession or exercise your other rights as a data subject in any of the following ways:

1)           by submitting an application in person, identifying yourself at our office using an ID document (this can be done every working day from 10 to 16) at the following address: Maskavas iela 240-3, Riga, LV-1063

2)           by submitting an application to us by post, to the following address: Maskavas iela 240-3, Riga, LV-1063

3)           by submitting an application signed with a secure electronic signature to us via e-mail: dati@ecobaltia.lv.

Once we receive your application, we will assess its content and the possibility of identifying you and, depending on the situation, we reserve the right to ask you to identify yourself further in order to ensure the security and proper disclosure of your data to the correct person.

Withdrawal of consent

If the processing of your personal data is based on your consent, you have the right to withdraw it at any time, which means that we will no longer process your personal data that we previously processed on the basis of the purpose that you provided your consent for. Please note, however, that withdrawing consent may not affect the processing of personal data that is necessary to comply with laws and regulations or that is based on a contract, on our legitimate interests or on other legal grounds for data processing, as set in laws and regulations.

You may also object to the processing of your personal data whenever the processing is based on legitimate interests.

10. Where can you lodge a complaint on the matters pertaining to the processing of personal data?

If you have any questions or objections regarding our processing of your personal data, we encourage you to contact us first.

If you believe that we have not been able to resolve the issue in an amicable manner, and you believe that we have violated your right to the protection of your personal data, you may file a complaint with the Data State Inspectorate. You can find model applications for the Data State Inspectorate and other related information on the website of the Data State Inspectorate (http://www.dvi.gov.lv/lv/datu-aizsardziba/privatpersonam/iesniegumu-paraugi/).

11. Why should you provide us with your personal data?

We primarily collect your data for our recruitment process, for compliance with legal requirements we are subject to, and to pursue our legitimate interests. In these cases, obtaining certain information is necessary for the purposes in question, so failure to provide such information may jeopardise the arrangement of your employment. If the data are not strictly necessary, but their provision could help us improve the working environment or your employment conditions, we will state that the provision of the data is voluntary.

12. How do we obtain your personal data?

We can obtain your personal data in one of the following ways:

1)           from you, when you submit your application and CV to us for the job opening;

2)           from an applicant, if they provide your personal data for the purpose of receiving feedback about them from you;

3)           from recruitment companies;

4)           from you, as part of concluding the contract;

5)           from you, if you send us any applications, e-mails, or call us by phone;

6)           from you, if you provide information about an applicant;

7)           where applicable, from other companies in our group;

8)           where applicable, from CCTV footage and access control systems.

13. Are your personal data used for automated decision-making?

We do not use your data for automated decision-making.

[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)