Effective date: January 18, 2023

CANDIDATE PRIVACY POLICY

GENERAL PROVISIONS

This Candidate Privacy Policy (Candidate Privacy Policy) describes the principles and other information on which we collect, store, use and otherwise process candidates' personal data (Personal Data). Candidates are persons (you, your or yours) who are applying or intend to apply in the future for vacancies in iTo group companies.

In order for you to be able to apply for vacancies, it is necessary for us to process your Personal Data, i.e. any information about you as an identified or can be identified natural person (Data Subject).
The provision of your Personal Data as a candidate is voluntary, but is necessary for your application for job vacancies or, depending on your consent, for future job offers.

By applying or otherwise consenting to the processing of your Personal Data, you also consent to the processing of your Personal Data as a candidate in accordance with this Candidate Privacy Policy. If the Candidate Privacy Policy or any of its individual terms and conditions are not acceptable to you, we will not be able to accept your data or assess your application.

We process Personal Data in accordance with applicable law, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

CONTROLLERS

The Controller or we means the companies belonging to the iTo group of companies (either individually or collectively, depending on the relevant purpose of the processing), i.e.:

iToGroup, UAB, legal entity code 305257674
UAB „Informacinių technologijų organizacija“, legal entity code 300558136
TeamBit, UAB, legal entity code 305954666 having their registered office at K. Baršausko str. 47-13, Kaunas, the Republic of Lithuania
Sign on Tab, UAB, legal entity code 305487013, having its registered office at Ateities str. 77-7, Vilnius, the Republic of Lithuania
UAB „7 Sprints“, legal entity code 304891896, having its registered office at Aronijų str. 20-2, Kaunas district municipality, Užliedžių eldership, Giraitės village, the Republic of Lithuania

The iTo group companies use certain common information systems and may share your Personal Data for certain of the purposes as set out below in order to ensure a more effective and relevant selection of candidates for both you and our group. In such cases, the companies belonging to the iTo group are considered to be joint Controllers in respect of your Personal Data.

We have an agreement between us setting out our responsibility for compliance with our obligations under the GDPR (we will make the material provisions of this agreement available on written request).

Nevertheless, you can exercise your rights under the GDPR in relation to each of the joint Controllers.

PERSONAL DATA PROCESSED

We may process the following Personal Data for the purposes as set out in this Candidate Privacy Policy below:

Categories of processed Personal Data / Personal Data	General information: any information provided in the CV, including name, date of birth, details of education and work experience, possession of a work/residence permit, recommendations. Contact details: email address, phone number. Candidate assessment information: summary of the interview with the candidate, insights from the interviewer(s), results of the tasks carried out, GitHub submissions (where available). Special categories of data (only when necessary for the selection for a specific job and only in the final stages of the selection process), including data on health. Information relating to qualifications, professional skills and professional attributes obtained from your former employer or current employer (from your current employer only with your consent). Other data you provide to us during the selection process or otherwise.

Categories of processed Personal Data / Personal Data

General information: any information provided in the CV, including name, date of birth, details of education and work experience, possession of a work/residence permit, recommendations.
Contact details: email address, phone number.
Candidate assessment information: summary of the interview with the candidate, insights from the interviewer(s), results of the tasks carried out, GitHub submissions (where available).
Special categories of data (only when necessary for the selection for a specific job and only in the final stages of the selection process), including data on health.
Information relating to qualifications, professional skills and professional attributes obtained from your former employer or current employer (from your current employer only with your consent).
Other data you provide to us during the selection process or otherwise.

PURPOSES FOR PROCESSING OF PERSONAL DATA, LEGAL BASIS, SOURCES FOR OBTAINING PERSONAL DATA AND OTHER INFORMATION RELATING TO THE PROCESSING OF PERSONAL DATA

In order to ensure transparency and responsible processing of Personal Data, we inform you that we process your Personal Data for the following purposes under the following conditions:

1. Recruitment for current vacancies within iTo group companies or within a specific company .

For this purpose, we process the Personal Data of candidates who apply for our vacancies and who provide (including by email, other channels) us with the data necessary for this purpose.

We will process Personal Data depending on the position(s) for which you are applying, i.e.:

if you are applying for a specific position in a specific company within the iTo group, we will process your data in order to assess whether your candidacy is suitable for a specific position in a specific company. In this case, this specific company will be considered as your Controller;
if you apply for any positions currently available in iTo group companies, we will process your data in order to assess your suitability for any position in any group company. In this case, all group companies will be considered as joint Controllers.

Legal basis for the processing of Personal Data	Personal Data is processed on the basis of your consent (Article 6(1)(a) of the GDPR), which is expressed by submitting your CV or other data to us, otherwise applying for a vacancy or by expressing your consent. Accordingly, you are guaranteed the possibility to revoke your consent at any time (for the exercise of this right, please see the section "Rights and exercise of your rights as Data Subjects"). The data is obtained from the former employer on the basis of our legitimate interest in obtaining information about the candidate from his/her former employer (Article 6(1)(f) GDPR).
Period of storage of the Personal Data	6 months from the date of consent (e.g. submission of a CV or other data for candidacy).
Source of the Personal Data	Candidate data is usually obtained from Data Subjects themselves (by phone, letters, meetings, etc.). However, data may also be obtained from third parties such as: (1) a representative of the candidate's former or current employer. When applying for vacancies, you are informed that we have the right to contact the former employer you have indicated in order to obtain information from him/her concerning your qualifications, professional skills and business characteristics. We will only contact the current employer you have indicated for the above purposes with your consent. When you provide us with the contact details of your former or current employer, you should inform him/her that you are providing such details to us and that we may contact him/her for the purposes of your selection. (2) third-party service providers (employment services, recruitment agencies, online job search portals, career social networks (e. g. LinkedIn) and other recruitment service providers) who should, where appropriate, inform you of the provision of your data to us and/or obtain your consent. (3) iTo group companies for which you have applied for vacancies and have consented to the transfer of your data for recruitment purposes to other iTo group companies. (4) The members of our team who have recommended you/referred you.

2. Maintaining a database of candidates from iTo group companies in order to offer you the opportunity to participate in the selection process for currently available and/or future vacancies

Legal basis for the processing of Personal Data	The processing of Personal Data is based on your consent (Article 6(1)(a) of the GDPR), which is expressed by filling in a form on our website and requesting to be included in the database of candidates, or by other means of consent (e.g., by confirming by email after the end of the selection process you are currently participating in, that you consent to your inclusion in the database of candidates). Accordingly, you are guaranteed the possibility to revoke your consent at any time (for the exercise of this right, please see the section "Rights and exercise of your rights as Data Subjects").
Legal basis for the processing of Personal data	Personal data are processed on the basis of the Data subject‘s consent, which may be expressed by submitting an appropriate inquiry, request or complaint to the Company. In the event you provide us with the data of other persons for this purpose (e.g. email address), you must inform such person and obtain their consent for provision of their data to us.
Period of storage of the Personal Data	3 years from the date of consent.
Source of the Personal Data	Candidate data is obtained from the Data Subject themselves. However, data may also be obtained from third parties such as: (1) third-party service providers (career social networks (e.g. LinkedIn)); (2) where consent to be included in the candidate database is given after the end of the recruitment process in which you have participated, the data obtained from third parties for the purposes of the recruitment process are processed for the purposes of compiling the candidate database; (3) a representative of the candidate's former or current employer. When applying for a vacancy, you are informed that we have the right to contact the former employer you have indicated in order to obtain information from him/her concerning your qualifications, professional skills and business qualities. We will only contact the current employer you have indicated for the above purposes with your consent. When you provide us with the contact details of your former or current employer, you should inform him/her that you are providing such details to us and that we may contact him/her for the purposes of your selection.

STORAGE OF THE PERSONAL DATA

We will process your Personal Data for the periods established in this Candidate Privacy Policy above.
Please note that in some cases the longer period for the Personal Data storage or our right to store the Personal Data for the longer period may be established in applicable legal acts, e. g. in cases where the processing of Personal Data is necessary for the establishment, exercise or defense of legal claims.
In such cases we may process your Personal Data for a longer period, but only to the extent necessary for these purposes of the processing of Personal Data. Such Personal Data will be erased as soon as the Personal Data are no longer necessary in relation to the purposes for which they are processed.

DISCLOSURE OF PERSONAL DATA

We may disclose your Personal Data only under the legitimate basis (for example, when required by legal acts, agreement concluded with you or when we have your consent) and in accordance with the requirements of applicable legal acts.

In addition to the cases already mentioned in this Candidate Privacy Policy, you are informed that we may transfer your Personal Data to the following entities:

Service providers acting as processors of our Personal Data and providing us with services related to IT, website support and maintenance (e.g. UAB Interneto vizija providing website hosting service), provision and maintenance of the applications used by us (e.g. TeamBit, UAB providing task management software; Google Cloud EMEA Limited providing the GSuite suite of applications), the provision and maintenance of servers, the provision of other services (e.g. iToGroup, UAB, a group company), and other;
to other companies in the iTo group, where you have consented to the transfer of your data to other companies in the iTo group for the purposes of recruitment;
in the cases specified in legal acts, to law enforcement and supervisory, as well as other state and municipal authorities; if necessary, to providers of legal advice, courts;
other business entities, in the event of our reorganization (including spin-off), sale of business, including to persons carrying out legal due diligence;
other third parties where you have made an appropriate request for your Personal Data or obtained your consent to provide information.

TRANSFER OF PERSONAL DATA OUTSIDE THE EEA

We do not transfer your Personal Data outside the European Economic Area.
In the case of a transfer of Personal Data outside the European Economic Area (e.g., by engaging a relevant Personal Data processor), we will ensure that Personal data is adequately protected and that the transfer complies with the GDPR. In this case, we will transfer the Personal Data to countries for which the European Commission has issued an adequacy decision, or shall ensure and implement an adequate level of protection of Personal data by means of standard contractual clauses, other documents or measures in accordance with the GDPR.

YOUR (AS THE DATA SUBJECT) RIGHTS

You, as the Data Subject, have all rights specified in the applicable legal acts, including indicated down below:

Right to revoke the given consent	If you have given us your consent to process your Personal Data, you may revoke it at any time (withdrawal of the consent shall not affect the lawfulness of the processing of Personal Data based on the consent before its withdrawal) by contacting us using the contact details specified in this Candidate Privacy Policy or by using other functionalities (e.g. by notifying the representative with whom you are in contact with about the withdrawal of your consent).
Right to request the access to your Personal Data	You can access your Personal Data that we process. You can get information on how it is collected, period for which your data are stored and who and to what extent receive your data. However, your right of access may be limited by legal acts.
Right to request rectification of Personal Data	You may request that we rectify the Personal Data we process about you if it is incorrect, inaccurate or incomplete.
Right to object	Under the certain circumstances, you have the right to object the processing of your Personal Data, including when your Personal Data are processed on the basis of the legitimate interest.
Right to restriction of the processing	If you believe that the Personal Data we process about you is incorrect or you disagree with the use of the data, you may request that the use of this data would be limited solely to storage. The use will be limited to the storage until the verification of the accuracy of the data or until the verification that our legitimate interests override your interests.
Right to erasure	If your Personal Data are processed illegally, you disagree to such processing of your Personal Data or there are other legal grounds, you have the right to request that the data be erased in accordance with the restrictions specified in legal acts.
Right to data portability	You have the right to get the Personal Data related to you, which you submitted to us, in a structured, commonly used and machine-readable format, and have the right to transmit those data to another Controller in accordance with the procedure established by legal acts.
The right to lodge a complaint	You also have the right to lodge a complaint to the State Data Protection Inspectorate, if you consider that the processing of Personal Data relating to you infringes requirements of legal acts. However, we kindly as you to firstly contact us using the contacts indicated in this Candidate Privacy Policy.

PROCEDURE OF IMPLEMENTATION OF DATA SUBJECT’S RIGHTS

If you have additional questions or want to implement your rights indicated in this Candidate Privacy Policy and related to the processing of the Personal Data, you should contact us by using the contacts indicated in this Candidate Privacy Policy (by email, by post (by sending to the indicated address).

When submitting requests on rights related to the processing of Personal Data, you will be asked to confirm your identity (e. g. in case you submit an application by electronic means, you must sign it by electronic signature, in case you apply to us upon sending request by post, you must provide an identity document or a its copy confirmed in a manner prescribed by legal acts).

We will only accept those requests on implementation of the Data Subject’s rights that will be completed/submitted in a coherent and understandable state language (the Lithuanian language) and specifies circumstances related to the implementation of the right.

We will consider the request on the right(s) of the Data Subject as unjustified and may not execute it in cases where it does not contain the necessary information required by the GDPR. We may also not execute your request if we do not process your Personal Data, the appropriate documentation to identify your (or your representative) identity are not provided together with the request, the person submitting the request is not duly authorized or has no right to make the request (no Power of Attorney or other document granting the right to represent you is submitted) or legal acts do not provide possibility of satisfying your request.

Please note that in cases where you abuse your right to submit the request, we have the right to charge a fee for execution of the request.

AMENDMENTS OF THE CANDIDATE PRIVACY POLICY

We have the right, at our sole discretion, to adjust (including change, edit, supplement, cancel, annul) this Candidate Privacy Policy or any part thereof and any related information. The updated Candidate Privacy Policy will take effect from the date of its publication (the link "Valid from" at the bottom of the Candidate Privacy Policy indicates when the Candidate Privacy Policy was last updated).

We recommend you check the Candidate Privacy Policy and its updates and make sure that you are satisfied with the current version of the Candidate Privacy Policy. If you apply/consent after the publication of the updated Candidates Privacy Policy, you accept the current Candidates Privacy Policy.

FINAL PROVISIONS AND THE CONTACT DETAILS

This Candidate Privacy Policy is governed by the laws of the Republic of Lithuania.

Any disagreement over the implementation of this Candidate Privacy Policy shall be resolved by negotiation. If the parties are unable to agree, disagreements shall be resolved in the manner prescribed by the laws of the Republic of Lithuania.

If you have any questions, claims or need our help with the interpretation or application of the Candidate Privacy Policy, or if you wish to exercise your rights as the Data Subject, please contact us using the following contacts:

E-mail: dataprotection@itogroup.lt

Address: K. Baršausko g. 47-13, Kaunas, Lietuva.

We will try to respond to all your requests regarding this Candidate Privacy Policy and submitted in a written form immediately (we shall respond to all your requests related to the implementation of your, as the Personal Data Subject, rights no later than within 1 (one) month from the receipt of the request. This period may be extended by a further 2 (two) months with prior notice to you.

Please make the information contained in this Candidate Privacy Policy available to persons who may be affected by your provision of their Personal Data to us and obtain their consent to the provision of their data to us where required.