1. GENERAL PROVISIONS
1.1. Rules on the Processing of Personal Data of Participants in Personnel Selection (hereinafter referred to as the Rules) establish how UAB “BALTIC AMADEUS” (hereinafter referred to as the Company) processes the personal data of participants in personnel selection (hereinafter referred to as Candidates).
1.2. The Rules are prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the Regulation), the national Law on the Legal Protection of Personal Data of the Republic of Lithuania (hereinafter referred to as the Law) and other legal acts regulating the protection and processing of personal data.
1.3. These Rules are intended for Candidates to familiarize themselves with how their personal data is processed by the Company during and after the personnel selection process. They also establish requirements that must be followed by the employees of the Company’s Human Resources Unit, Personnel Development Managers and the Unit Managers responsible for organizing and conducting personnel selections.
1.4. These Rules are published on the Company’s website www.ba.lt and in the Company’s job advertisements.
2. PROCESSING OF CANDIDATE PERSONAL DATA DURING PERSONNEL SELECTION
2.1. Candidates submitting their CV and/or other personal data to the Company for participation in the personnel selection process are provided with the information specified in Articles 13 and 14 of the Regulation regarding the processing of their personal data. This is done by including a link to these Rules and the Company’s Privacy Policy in job advertisements.
2.2. If a Candidate is recommended by a friend who is already an employee of the Company, the recommending employee, in accordance with the Company’s approved recommendation rules, before providing information to the Company must inform the proposed Candidate that the Candidate’s personal data (name, surname, phone number, email address, recommended position, additional information such as a link to a LinkedIn profile, information about work experience, etc.) will be submitted to the Company and processed in accordance with these Rules and the Candidate’s consent to being recommended must be obtained.
2.3. In conducting employee recruitment, the Company utilizes a personnel recruitment platform (hereinafter referred to as the System) managed by external service providers (data processors engaged by the Company). Candidates can submit their personal data in the System when applying for positions advertised by the Company or when receiving an invitation from the Company via email or a LinkedIn message. Before providing their personal data in the System, Candidates must familiarize themselves with the Privacy Policy and terms of use of the service provider managing the System.
2.4. The Company processes the personal data of Candidates on the basis of these legal grounds:
2.4.1. On a basis of the consent, expressed when the Candidate sends his/her CV and/or other data to the Company by email, LinkedIn message, when participating in a selection process conducted by a personnel search agency, or when the Candidate agrees to be recommended by a friend or submits data in the System.
2.4.2. On a basis of the Company’s legitimate interest, where the Company has an objective need to document the personnel selection process, to retain minimal information about the selections made and the Candidates who participated in them, to keep selection statistics, to preserve the traceability of communications (e.g., where a recruitment agency proposes Candidates for a specific position and a bonus is paid to the recruitment agency in return for the Candidates recruited by the Company within the specified period of time), or to protect its rights (e.g. in the event of a legal dispute).
2.5. The Company must have and maintain evidence that the Candidates have been informed about the processing of their personal data.
3. CATEGORIES OF PROCESSED DATA, PROCESSING PURPOSES, AND DATA SOURCES
3.1. The Company processes only those personal data of Candidates that are related to the Candidate’s qualifications, professional abilities, and job-related characteristics, except as specified by law. Information about the Candidate’s personal life, if not related to qualifications, professional abilities, and job-related characteristics, is not collected.
3.2. The Company processes the following personal data of Candidates:
3.2.1. Name, surname, email address, phone number, desired job position, information about education and work experience, qualifications, CV, content of the motivational letter, comments provided by the Candidate, other information submitted by the Candidate, e.g., links to social media accounts, Candidate profiles and examples of work on the internet, etc.;
3.2.2. Recommendations, feedback from previous employers, contact persons’ personal data, their contacts, and the content of the feedback are identified;
3.2.3. Candidate evaluation information, i.e., insights and opinions of the person(s) conducting the selection, results of Candidate testing, answers to questions, task solutions, etc.
3.3. The Company does not process special categories of personal data (sensitive data), except when such data is necessary to verify whether a person meets the legal requirements applicable for the specific position or work, and except in other cases provided by legislation.
3.4. Special (sensitive) personal data, which cannot be processed without the legal basis specified in the applicable law, includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or membership in trade unions, as well as genetic data, biometric data for the purpose of uniquely identifying a person, health data, or data about a person’s sexual life and sexual orientation.
3.5. During the selection process, the Company may also ask the Candidate to provide personal data on convictions and criminal offences (hereinafter referred to as the “Criminal Record Data”). The processing of the Criminal Record Data may only be carried out if the processing of such data is necessary in accordance with the requirements of the legislation applicable to the Company or if there is a legitimate interest of the Company, which the Company undertakes to justify in accordance with the procedures laid down in the Regulation and the Law, and the safeguards for the protection of the rights and freedoms of the data subjects set out in Article 5 of the Law are implemented.
3.6. The Company may check the Candidate’s profile on the professional social network LinkedIn and the information published there. To ensure the Candidate’s privacy and objectivity of evaluation during the personnel selection, the Company does not proactively check data on the Candidate’s Facebook, X, and other personal social media accounts unless the Candidates provide links to their profiles in specific social networks.
3.7. The personal data of Candidates defined in point 3.2 of the Rules can be processed by the Company for the following purposes: to identify the Candidate, communicate with the Candidate through communication channels, assess the Candidate’s qualifications, experience and suitability for a specific job position.
3.8. The Company receives Candidates’ personal data, such as CVs, Candidate questionnaires, and/or other application documents (motivational letters, etc.), directly from Candidates through the following channels: e-mail and/or LinkedIn messages, through the System. Criminal Record Data can be provided to the Company solely by the Candidate himself/herself.
3.9. The Company may also obtain information about the Candidate, including their CV and/or other application documents, from the System, as well as from entities providing job search, recruitment, and/or intermediary services, such as recruitment agencies, online job search portals, specialized career social networks and recommendations.
3.10. The Company may collect Candidates’ personal data related to qualifications, professional abilities, and job-related characteristics from the Candidate’s current employer, having obtained the Candidate’s consent beforehand. Consent may be obtained via e-mail, LinkedIn message, or any other method allowing for the preservation of evidence of consent.
3.11. The Company has the right to collect Candidates’ personal data related to qualifications, professional abilities, and job-related characteristics from the Candidate’s previous employers without the Candidate’s consent, only by informing the Candidate about this source of information.
4. DISCLOSURE OF CANDIDATE DATA TO THE THIRD PARTIES
4.1. The Company may disclose the Candidate’s data to third parties (for example, the Company’s clients in whose projects the potential Candidates might be involved) only after informing the Candidate in advance.
4.2. Following the requirements of data protection laws, the Company enters into data processing or transfer agreements with all third parties that the Company may utilize to conduct personnel selections and to which access to Candidates’ personal data may be granted (e.g., managers of personnel management platforms, recruitment agencies, etc.). This includes signing standard terms for the processing of personal data or applying other measures specified in Chapter V of the Regulation if personal data are to be transferred to data recipients or processors in third countries outside the European Economic Area.
4.3. Data processing agreements are also concluded with any other service providers who would have access to Candidates’ personal data, such as IT or server service providers, system administrators and other assisting service providers managing personal data according to the Company’s instructions.
4.4. Candidate personal data may also be disclosed to competent authorities or law enforcement agencies (e.g., law enforcement institutions or supervisory authorities) but only upon their legal request justified by applicable laws, or in cases provided by laws and following the procedures required to ensure the rights of the Company, the security of clients, employees, and resources, or to assert legal claims and defend legitimate interests of the Company.
5. PROCESSING OF CANDIDATES’ PERSONAL DATA AFTER THE END OF THE PERSONNEL SELECTION PROCESS
5.1. A Candidate who has participated in a selection for a specific position advertised by the Company and has not been selected for a position with the Company, or who has applied to the Company without applying for a specific position, but with a view to participating in future selections, may consent to his/her CV and/or other data being processed by the Company after the end of the selection process, for a period of 3 years following the end of the selection process, or following the Candidate’s application, if the Candidate did not apply for a specific position. In this case, the Company shall have the right to contact the Candidate during the 3-year period, to maintain contact with the Candidate and to suggest other positions that match the Candidate’s competences. The opportunity to consent to the processing of personal data as defined in this clause shall be given by informing the Candidate by email, LinkedIn message or by submitting a consent form via the System. The Candidate is free to withdraw his/her consent at any time by informing the Company by email to ta@ba.lt.
5.2. The end of the personnel selection is considered to be the date of concluding an employment contract with the Candidate selected for a specific position or the end of the selected Candidate’s probationary period (if specified).
5.3. The Company may, on a basis of its legitimate interests and without prejudice to the balance between the rights of the Candidate and its own interests, retain some of the Candidate’s personal data for the purposes of documenting the personnel selection and compiling an archive of the selections made. The Company shall have the right to keep the following personal data of the Candidate for a maximum period of 5 (five) years from the end of the personnel selection process (or from the Candidate’s application, if the Candidate did not apply for the specific position): name, surname, email address, telephone no., LinkedIn profile link, date of the personnel selection, the position for which the selection was made, the Company’s decision on the results of the selection, remarks and comments made by the Company’s representatives who participated in the selection process, information on the progress/stages of the selection process, information on the communication with the Candidate during the selection process, and any other information of a technical/organisational nature of the Company related to the selection process.
5.4. Unless the Candidate has given his/her separate consent to be contacted after the end of the selection process as provided for in a clause 5.1, the Company undertakes not to contact the Candidate with further job offers or otherwise actively communicate with the Candidate during the period of retention of the archive data as provided for in a clause 5.3 unless the Candidate himself/herself has contacted the Company or has decided to apply again.
5.5. At the end of the retention period for the Candidate’s data set out in point 5.3, all personal data shall be destroyed (including data in paper form, in an email or other information medium) or anonymised in such a way that the Candidate’s identity can no longer be established.
6. FINAL PROVISIONS
6.1. The Rules are reviewed and, if necessary, updated in accordance with changes in data protection laws or their implementation practices, as well as changes in the Company’s data processing practices, but no less frequently than once a year.
6.2. These Rules and their amendments are approved by the order of the Chief Executive Officer of the Company.
6.3. All employees of the Company’s Human Resources Unit, Personnel Development Managers and Unit Managers are formally familiarized with these Rules in writing (electronically via the Company’s Document Management System).
6.4. For any questions related to the processing of Candidates’ personal data, it is recommended to contact the Company in writing at the email address dpo@ba.lt.