Candidate Personal Data Processing Privacy Policy

1. Definitions

Candidate means any natural person who is applying/applied for a position at Wallester.

Data Protection Legislation means the applicable EU and national data protection legislation that Wallester is subject to, for example, Regulation (EU) 2016/679 (General Data Protection Regulation or the GDPR).

Personal Data means any information directly or indirectly related to a Candidate.

Data Controller means anyone who alone or jointly with others determines the purposes and means of the Processing of Personal Data. For the Processing of Personal Data described in this Policy, Wallester is the Data Controller.

Data Processor means anyone who Processes Personal Data on behalf of the Data Controller.

Recipient means a natural or legal person, public authority or another body, to whom Wallester is entitled to disclose Personal Data. See the categories of Recipients in Section 5 of the Policy.

Processing means any operation or set of operations performed regarding Personal Data (such as collection, recording, storing, erasure, sharing).

Regulatory Legislation means the applicable legal acts that Wallester is subject to, for example, relating to anti-money laundering, bookkeeping, payment services.

Third Person means a person with whom the Candidate may be in close relations (such as relatives) that can lead to conflict of interests at Wallester, as well as providers of feedback (such as the Candidate’s former colleagues, managers).

2. General

2.1 2.3 This Policy describes how Wallester Processes Personal Data of Candidates. Detailed information on the Processing of Candidates’ Personal Data might be additionally described in job advertisement.

2.2 2.3 Wallester ensures the confidentiality of Personal Data and has implemented technical and organisational measures to safeguard Personal Data from unauthorised access, unlawful disclosure, accidental loss, modification, destruction or any other unlawful Processing.

2.3 2.3 Wallester engages Data Processors for Processing of Personal Data and takes necessary steps to ensure that Processing of Candidates’ Personal Data by Data Processors takes place under a contract or Regulatory Legislation and according to documented instructions of Wallester

3. Source and Categories of Personal Data

Personal Data is collected directly from a Candidate, through the activities performed and systems used by the Candidate, as well as from external sources such as public registers or other third parties (mainly Data Processors) and Third Persons. Personal Data categories which Wallester collects and Processes are:

Identification data such as name, contact details like telephone number and email address.

Professional data such as education, professional career and duration, job title, training certificates.

Financial data such as debt commitments, indication of income, solvency.

Data about trustworthiness such as data regarding possible conflict of interest, incl. data about Candidate’s business activities, data related to anti-money laundering, counter terrorist financing or financial sanctions or organized crime.

Communication data such as the data contained in messages, emails, visual images, video and/or audio recordings, as well as other conversation and interactions collected during the recruitment process and when a Candidate participates in job interview.

Demographic data such as country of residence, citizenship and eligibility to work in the country (Estonia, Latvia or France, depending on the location of position applied to).

Sensitive data such as Special categories of Personal Data (for example, data concerning health) and Data about criminal convictions and offences such as data about absence or existence of criminal convictions.

4. Purpose and Legal Basis for Personal Data Processing

Wallester Processes Candidate’s Personal Data primarily for the following purposes:

4.1 4.7 Managing Candidate selection for vacancies

4.2 4.7 Managing Candidate Personal Data to establish employment

4.3 4.7 Suitability assessment

4.4 4.7 Managing Candidates for future job opportunities

4.5 4.7 Candidate feedback

4.6 4.7 Managing compliance, internal audit and fulfilling statutory duties

4.7 4.7 Establishing, exercising and defining legal claims

5. Recipients of Personal Data

To be able to provide the recruitment process, Wallester may share the Candidates’ Personal Data with different Recipients. The Recipients are in general:

5.1 5.4 Authorities, such as law enforcement authorities, tax authorities, supervisory and control authorities, as well as financial investigation authorities.

5.2 5.4 Auditors, legal advisors, and other Personal Data processors approved by Wallester (inc. recruitment management systems, recruitment agencies).

5.3 5.4 Judicial and extrajudicial dispute settlement institutions.

5.4 5.4 Providers of feedback concerning the previous professional career of the Candidate.

Wallester will not share Candidates’ Personal Data more than necessary for the particular purpose of Processing.

Recipients may Process the Personal data as Data Processors and/or as Data Controllers. When the Recipient is Processing Candidates’ Personal Data on its own behalf as a Data Controller, the Recipient is responsible for providing information to data subjects on such Processing of Personal Data.

6. Geographical Area of Processing

6.1 6.2 As a general rule, Personal Data is processed within the European Union/European Economic Area (hereinafter — EU/EEA) but in some cases can be transferred to and Processed in countries outside of the EU/EEA.

6.2 6.2 The transfer and Processing of Personal Data outside the EU/EEA can take place provided there is a legal basis, for example, performance of legal obligations, and appropriate safeguards are in place:

• The country outside of the EU/EEA where the Recipient is located has adequate level of data protection as decided by the EU Commission.
• The EU Standard Contractual Clauses or other approved clauses, codes of conduct, certifications approved in accordance with the GDPR.

7. Retention Period

Your Personal Data shall not be stored for longer than is necessary for the recruitment process and retention is dependent on the purpose of Processing as follows:

• If you are not selected for the position, then we will store your data for 24 months for resolving possible disputes arising from the recruitment process;
• If you are not selected for the position, then we will also store your data for 24 months for the purpose of contacting you to offer suitable job openings (on the condition the Candidate has provided their consent for this) for 24 months, unless the Candidate withdraws their consent before this.

8. Rights of Candidates as Data Subjects and Contact Details

Under the Data Protection Legislation, the Candidate has rights of a data subject regarding Processing of Personal Data. Such rights are:

• Receive confirmation if the Candidate’s Personal Data is being Processed by Wallester and, if so, to access it.
• Require the Candidate’s Personal Data to be corrected if it is inadequate, incomplete or incorrect.
• Require the erasure of the Candidate’s Personal Data.
• Restrict the Processing of the Candidate’s Personal Data.
• Object to Processing of the Candidate’s Personal Data if processing is based on Wallester’s legitimate interests.
• Object to Processing of the Candidate’s Personal Data for direct marketing
• Receive the Personal Data that is provided by the Candidate and is being Processed based on consent or performance of an agreement in a structured, commonly used electronical format and, were feasible, transmit such data to another Controller (i.e. right to data portability).
• Withdraw the consent to Process the Candidate’s Personal Data.

Answer to the data subject’s request will be provided not later than within one month of receipt of the request; when necessary, this period can be extended by two further months

The Candidate can exercise access their rights by submitting respective request to recruitment@wallester.com.

If the Candidate considers that the Processing of the Candidate’s Personal Data infringes the Candidate’s rights and interests under Data Protection Legislation, the Candidate can lodge a complaint to the Estonian Data Protection Authority (info@aki.ee; Tatari 39, Tallinn Estonia).