Data protection policy for recruitment

Data protection policy for recruitment
Est Rus

Valid from 29.05.2023

  1. INTRODUCTION

This Data Protection Policy for Recruitment explains the purposes and legal bases for which Delfi Meedia AS (hereinafter also Delfi Meedia or we) as the controller of personal data collects and otherwise processes the personal data of data subjects and what the rights of the data subjects are. In addition, we provide other mandatory information to ensure transparency.

For the purposes of this Data Protection Policy, a Data Subject (hereinafter also you) is an applicant or potential candidate for a job at Delfi Meedia and any other person with whom we come into contact during the recruitment process (e.g. a referrer).

  1. DATA CONTROLLER

Delfi Meedia AS

Company registration code: 10586863

Address: Narva mnt 13, 10151 Tallinn

Contact details: 669 8080, info@delfi.ee 

Data Protection Officer: isikuandmed@delfi.ee 

  1. PRINCIPLES OF PROCESSING PERSONAL DATA

Delfi Meedia adheres to the following principles when processing personal data.

  1. Transparency – Delfi Meedia processes personal data in a lawful, fair and transparent manner.
  2. Limitation of purpose – Delfi Meedia collects your personal data for specified, explicit and legitimate purposes. Changes in the purposes of processing may result from legislation or your consent. In any case, we will let you know beforehand.
  3. Data minimisation – Delfi Meedia ensures that the personal data which are being processed are adequate, relevant and limited to what is necessary for the purpose of their processing.
  4. Accuracy – Delfi Meedia ensures that your personal data are accurate and up-to-date. Personal data that are inaccurate from the point of view of processing will be deleted or corrected without delay.
  5. Storage limitation – upon retaining personal data, Delfi Meedia follows the need to process them, i.e. data that enable the identification of a natural person are retained for as long as it is necessary to achieve the purpose of processing. Upon determining the retention period, Delfi Meedia complies with the requirements of legislation or determines the retention period on the basis of its legitimate interest.
  6. Integrity and confidentiality – Delfi Meedia processes your personal data in a manner that ensures their proper security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage. Delfi Meedia keeps all personal data being processed confidential and protects personal data from unlawful access by third parties by implementing effective security measures, including technical and organisational measures.
  7. Data protection by design and by default – in developing, selecting and using products and services requiring the processing personal data, Delfi Meedia takes into account the need to protect them. Delfi Meedia also implements appropriate technical and organisational measures to ensure that only personal data that are necessary to achieve the specific purpose of the processing are processed by default.

  1. PROCESSED PERSONAL DATA AND SOURCES OF THEIR COLLECTION

Delfi Meedia mainly processes personal data that you provide to Delfi Meedia yourself or that are generated during the recruitment process. Delfi Meedia processes the following types of personal data:

  1. Primary personal data, i.e. your first and last name.

We receive this data from you at the beginning of the recruitment process or during the recruitment process, as well as from third party referrers. If you are a referrer, we have received your data from the job applicant.

  1. Contact details, i.e. your email address and phone number.

We receive this information from you at the beginning of the recruitment process or during the recruitment process, as well as from third party referrers. If you are a referrer, we have received your data from the job applicant.

  1. Data on experience, education and training, including information on education and participation in training, as well as information on your skills and competences, as well as other evidence of professional qualifications.

We receive this information from you at the beginning of the recruitment process or during the recruitment process.

  1. General exchange of information applicable on recruitment, i.e. exchange of e-mail or other relevant information applicable on recruitment.

We receive this data either from you or the data are generated during the recruitment process.

  1. Compliance and risk management data, i.e. information that we collect during a background check.

We collect data for background checks from publicly available sources on the Internet and, where applicable, from your previous employers.

  1. Social media data, which is publicly available information in your social media accounts (e.g.  LinkedIn, Facebook, etc.), such as previous work experience, education or other information that is public and may be relevant to the recruitment process.

We may collect this information when looking for potential candidates for recruitment, if we receive an application or recommendation from you from a third party.

  1. Surveillance camera data, i.e. recording of a surveillance camera (without audio recording).

We receive this information from you when you visit our office, as its entrances and the public area of customer service are equipped with a video surveillance system.

  1. Recruitment and hiring data, which is data that you provided to us or that was generated during the recruitment and hiring process, including your CV (including, where applicable, video CV), motivation letter, recommendations (please note that it is your responsibility to obtain prior consent from your referrers to provide us with this contact information), details of the interview, results of tests (including personality tests) and copies of relevant documents.

We receive this data from you at the beginning or during the recruitment process.

In addition to the above, Delfi Meedia also processes other personal data, which are further described in Section 5.

                

  1. PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

We process your personal data for the following purposes and legal bases:

  1. Legitimate interest

For the purposes described below, we rely on legitimate interest as the legal basis for processing personal data. You have the right to ask for explanations about the processing of personal data based on a legitimate interest by sending a request to the e-mail address specified in Section 2. You also have the right to object if you consider that the processing of your data for the purposes set out below violates your rights.

The purpose of processing personal data

Categories of data

Identification of potential candidates for open or future positions:

  • processing of data that are publicly available on the Internet in connection with the search for and recruitment of candidates prior to recruitment.

Primary personal data

Contact details

Data on experience, education and training 

Social media data

Conducting the recruitment process and related protection of our interests and rights:

  • assessing your qualifications and deciding whether to offer you a job offer;
  • decision-making on remuneration and other benefits;
  • assessment of training needs;
  • sending you notifications about the progress of the recruitment process;
  • protection against potential claims against us.

Primary personal data

Contact details

Data on experience, education and training 

Social media data

General information exchange on recruitment

Compliance and risk management data

Recruitment and hiring data

Use of security cameras at the entrances to our office and in the public area of customer service for the purpose of protecting persons and property.

Surveillance camera data

To perform a background check:

  • we collect information from publicly available sources (such as online search engines or your public social media accounts) to verify your suitability for the position and the organisation as a whole.
  • verification of the data provided by you through the referrers.

About the candidate:

  • primary personal data
  • contact details
  • data on experience, education and training 
  • social media data
  • general information exchange on recruitment
  • compliance and risk management data
  • recruitment and hiring data

For the referrer:

  • primary personal data
  • contact details
  • job and position data
  1. Processing of personal data for taking measures prior to entering into a contract

On this legal basis, we process your personal data if it is necessary to take measures at your request prior to entering into an employment contract.

The purpose of processing personal data

Categories of data

Identification of potential candidates for vacant or future positions:

  • the processing of data submitted on the initiative of the candidate in order to determine who he or she is, his or her background and whether he or she could be considered for vacant or future positions.

Primary personal data

Contact details

Data on experience, education and training 

Social media data

Making a job offer and/or preparing an employment contract.

Primary personal data

Contact details

Data on experience, education and training 

General information exchange on recruitment

Recruitment and hiring data
  1. Consent

In some limited cases, we need your consent to process the data. You always have the right to withdraw your consent by sending us a notice to the e-mail address specified in Section 2.

Withdrawal of consent shall not affect the lawfulness of the processing of personal data carried out on the basis of consent prior to the withdrawal.

The purpose of processing personal data

Categories of data

To offer employment to the next candidate in the ranking.

Primary personal data

Contact details

Data on experience, education and training 

General information exchange on recruitment

Recruitment and hiring data

Assessing your suitability for other job vacancies in the future. If you are not selected for the position, we will retain your personal data for this purpose in order to assess your future suitability.

Primary personal data

Contact details

Data on experience, education and training 

General information exchange on recruitment

Recruitment and hiring data 

Notifying you by email, phone, or otherwise about other job vacancies that we think you might be a suitable candidate for.

Primary personal data

Contact details
  1. RETENTION PERIODS FOR PERSONAL DATA

Delfi Meedia stores data only for as long as it is necessary to achieve the purpose of the processing. For different data, this means different retention periods. For example:

  • We retain the personal data of unsuccessful candidates for 18 months in order to protect ourselves against possible legal claims arising from the Equal Treatment Act.
  • If you are not selected for the job, but you agree that we will make a proposal to start working for you as the next candidate in the ranking, we will retain your data for 5 months as of the proposal to start working for the winner of the competition.

  • If you have given your consent so that we can inform you about possible other vacancies, we will store your data for 18 months.

You will have access to more detailed retention periods if you contact us by using the contact details provided in Section 8 (Data subject’s rights).

  1. RECIPIENTS OF PERSONAL DATA AND TRANSFER OF DATA TO THIRD COUNTRIES

Delfi Meedia generally does not disclose personal data to third parties. In some cases, however, it is unavoidable. In the context of recruitment, we have classified data recipients into two categories:

  • independent controllers (e.g. auditors, lawyers, public authorities);
  • processors. The authorised processor of personal data is a person who processes personal data on behalf of the controller (Delfi Meedia). Delfi Meedia involves the processor, inter alia, for the following purposes:
  • to provide a service (for example, server hosting);
  • for the assessment of candidates (for example, carrying out tests).

Delfi Meedia does not transfer your personal data outside the European Union or the European Economic Area, as well as to a third country or international organisation whose level of data protection has not been assessed as adequate by the European Commission. However, if necessary, such transfer of personal data will only take place if there is an appropriate legal basis and we will take appropriate safeguards. In this case, the transfer of data to third countries is generally carried out on the basis of standard contractual clauses adopted by the European Commission.

You have the right to receive additional information about the transfer of your data by means of a data access request, if you contact us using the contact details provided in Section 8 (Data subject’s rights).

  1. RIGHTS OF THE DATA SUBJECT

Delfi Meedia considers the right to privacy of data subjects very important. Your rights as a data subject are as follows:

  • Examination of data. You have the right to know whether your personal data is being processed, what the purpose of the processing is and the categories of personal data concerned. To whom the data will be disclosed (in particular recipients in third countries), how long the data will be stored, and what your rights regarding rectification, erasure and restriction of processing are. 
  • Correcting or supplementing data. You have the right to request the correction of your personal data if it is incorrect or incomplete.
  • Deleting data. In certain cases and if you wish, you can exercise the right to be forgotten, i.e. ask us to delete your personal data. We will delete your data unless there is another legal basis for processing your personal data, such as a legal obligation.
  • Restriction of data processing. In certain cases, you have the right to restrict the processing of your personal data for a certain period of time (e.g. if you have objected to the processing of your personal data).
  • Objection to the processing of your personal data if Delfi Meedia uses your personal data, for example, for profiling. When submitting an objection, Delfi Meedia must stop processing your personal data, unless Delfi Meedia can prove that your personal data is being processed for a compelling legitimate reason that overrides your interests, rights and freedoms or if the processing is necessary for the establishment, exercise or defence of legal claims.
  • Transfer of personal data. If the processing of your personal data is based on your consent or on a contract entered into with us and the data is processed by automated means, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format. You also have the right to request that we transfer the data directly to another service provider, if this is technically feasible.
  • Revoking the consent. If personal data is processed on the basis of your consent, you have the right to withdraw this consent at any time by sending us a corresponding notice to the e-mail address isikuandmed@delfi.ee.
  • Right of recourse to Delfi Meedia, supervisory authority or court. If you wish to exercise any of the aforementioned rights, please send us a notice to the e-mail address isikuandmed@delfi.ee. If you find that your rights have been violated, you have the right to turn to the Data Protection Inspectorate and/or a court. The contact details of the Data Protection Inspectorate are available on the website at www.aki.ee.
  1. APPLICATION PROVISION

Delfi Meedia regularly reviews its Data Protection Policy and applies them in accordance with changes in the processing of personal data.