Candidate Personal Data Processing Privacy Policy

1. Definitions

Candidate means any natural person who is applying/applied for a position at Wallester.

Data Protection Legislation means the applicable EU and national data protection legislation that Wallester is subject to, for example, Regulation (EU) 2016/679 (General Data Protection Regulation or the GDPR).

Personal Data means any information directly or indirectly related to a Candidate.

Data Controller means anyone who alone or jointly with others determines the purposes and means of the Processing of Personal Data. For the Processing of Personal Data described in this Policy, Wallester is the Data Controller.

Data Processor means anyone who Processes Personal Data on behalf of the Data Controller.

Recipient means a natural or legal person, public authority or another body, to whom Wallester is entitled to disclose Personal Data. See the categories of Recipients in Section 5 of the Policy.

Processing means any operation or set of operations performed on Personal Data (such as collection, recording, storing, erasure, sharing).

Regulatory Legislation means the applicable legal acts that Wallester is subject to, for example, relating to anti-money laundering, bookkeeping, payment services.

Third Person means a person with whom the Candidate may have a close relationship (such as a relative) that could lead to a conflict of interest at Wallester, as well as those providing feedback (such as the Candidate’s former colleagues or managers).

2. General

2.1 2.3 This Policy describes how Wallester Processes the Personal Data of Candidates. Detailed information on the Processing of Candidates’ Personal Data might be additionally described in the job advertisement.

2.2 2.3 Wallester ensures the confidentiality of Personal Data and has implemented technical and organisational measures to safeguard Personal Data from unauthorised access, unlawful disclosure, accidental loss, modification, destruction or any other unlawful Processing.

2.3 2.3 Wallester engages Data Processors for the Processing of Personal Data and takes necessary steps to ensure that the Processing of Candidates’ Personal Data by Data Processors takes place under a contract or Regulatory Legislation and according to the documented instructions of Wallester.

3. Source and Categories of Personal Data

Personal Data is collected directly from a Candidate, through the activities performed and systems used by the Candidate, as well as from external sources such as public registers or other third parties (mainly Data Processors) and Third Persons. The categories of Personal Data which Wallester collects and Processes are:

Identification data such as name and contact details, including telephone number and email address.

Professional data such as education, professional career and duration, job title, training certificates.

Financial data such as debt commitments, indication of income and solvency.

Data about trustworthiness such as data regarding possible conflict of interest, incl. data about the Candidate’s business activities, data related to anti-money laundering, counter-terrorist financing, financial sanctions or organised crime.

Communication data such as the data contained in messages, emails, visual images, video and/or audio recordings, as well as other conversations and interactions collected during the recruitment process and when a Candidate participates in a job interview.

Demographic data such as country of residence, citizenship and eligibility to work in the country (Estonia, Latvia or France, depending on the location of the position applied for)

Sensitive data such as Special categories of Personal Data (for example, data concerning health) and Data about criminal convictions and offences such as data about absence or existence of criminal convictions.

4. Purpose and Legal Basis for Personal Data Processing

Wallester processes Candidate’s Personal Data primarily for the following purposes:

4.1 4.7 Managing Candidate selection for vacancies

4.2 4.7 Managing Candidate Personal Data to establish employment

4.3 4.7 Suitability assessment

4.4 4.7 Managing Candidates for future job opportunities

4.5 4.7 Candidate feedback

4.6 4.7 Managing compliance, internal audit and fulfilling statutory duties

4.7 4.7 Establishing, exercising and defining legal claims

5. Recipients of Personal Data

To facilitate the recruitment process, Wallester may share the Candidates’ Personal Data with various Recipients. These Recipients generally include:

5.1 5.4 Authorities, such as law enforcement authorities, tax authorities, supervisory and control authorities, as well as financial investigation authorities

5.2 5.4 Auditors, legal advisers and other Personal Data processors approved by Wallester (including recruitment management systems and recruitment agencies).

5.3 5.4 Judicial and extrajudicial dispute settlement institutions

5.4 5.4 Providers of feedback concerning the previous professional career of the Candidate.

Wallester will not share Candidates’ Personal Data more than necessary for the particular purpose of Processing.

Recipients may Process the Personal Data as Data Processors and/or as Data Controllers. When the Recipient is Processing Candidates’ Personal Data on its own behalf as a Data Controller, the Recipient is responsible for providing information to data subjects on such Processing of Personal Data.

6. Geographical Area of Processing

6.1 6.2 As a general rule, Personal Data is processed within the European Union/European Economic Area (hereinafter — EU/EEA) but in some cases can be transferred to and Processed in countries outside the EU/EEA.

6.2 6.2 The transfer and Processing of Personal Data outside the EU/EEA can take place provided there is a legal basis, for example, performance of legal obligations, and appropriate safeguards are in place:

• The country outside the EU/EEA where the Recipient is located has an adequate level of data protection as decided by the EU Commission.
• The EU Standard Contractual Clauses or other approved clauses, codes of conduct and certifications approved in accordance with the GDPR.

7. Retention Period

Your Personal Data shall not be stored for longer than necessary for the recruitment process, and retention depends on the purpose of Processing as follows:

• If you are not selected for the position, we will store your data for 24 months to resolve possible disputes arising from the recruitment process;
• If you are not selected for the position, we will also store your data for 24 months for the purpose of contacting you to offer suitable job openings (on the condition the Candidate has provided their consent for this), unless the Candidate withdraws their consent before this.

8. Rights of Candidates as Data Subjects and Contact Details

Under the Data Protection Legislation, the Candidate has the rights of a data subject regarding the Processing of Personal Data. These rights are:

• Receive confirmation of whether the Candidate’s Personal Data is being Processed by Wallester and, if so, to access it
• Require the Candidate’s Personal Data to be corrected if it is inadequate, incomplete or incorrect.
• Require the erasure of the Candidate’s Personal Data.
• Restrict the Processing of the Candidate’s Personal Data
• Object to Processing of the Candidate’s Personal Data if processing is based on Wallester’s legitimate interests.
• Object to Processing of the Candidate’s Personal Data for direct marketing
• Receive the Personal Data that is provided by the Candidate and is being Processed based on consent or performance of an agreement in a structured, commonly used electronic format and, where feasible, transmit such data to another Controller (i.e. right to data portability).
• Withdraw consent to Process the Candidate’s Personal Data.

A response to the data subject’s request will be provided within one month of receipt; where necessary, this period can be extended by a further two months.

The Candidate can exercise their rights by submitting a request to recruitment@wallester.com.

If the Candidate considers that the Processing of the Candidate’s Personal Data infringes the Candidate’s rights and interests under Data Protection Legislation, the Candidate can lodge a complaint with the Estonian Data Protection Authority (info@aki.ee; Tatari 39, Tallinn Estonia).