CV KESKUS PRIVACY POLICY
1. Scope of policy
1.1. The following privacy policy (Privacy Policy) applies to all cases where CV Keskus OÜ (CV Keskus) processes personal data of natural persons (Data Subject) as a controller when enabling the use of its online platform www.cvkeskus.ee, www.cvmarket.lv, www.cvmarket.lt (Platform) and by providing various services (Services) to the users of the Platform (User) via the Platform, including to Users who are natural persons and look for a job (Jobseeker).
1.2. This Privacy Policy does not apply insofar as CV Keskus processes the personal data of the Data Subjects as processor on behalf of a controller. For example, in a situation where a user registered as an employer (Employer) processes the Jobseeker’s personal data at the Platform, which the Employer has entered to the Platform itself (i.e. it is not the personal data that the Jobseeker himself/herself has provided to CV Keskus for performance of the contract entered into with CV Keskus). In this case the controller is the respective Employer and the processor is CV Keskus.
1.3. The Privacy Policy is valid from the date as set above. CV Keskus has the right to unilaterally make amendments to the Privacy Policy. In such case the amended Privacy Policy shall be uploaded to the Platform and the Data Subjects shall be notified by e-mail or by other means.
2. Data controller and principles of processing personal data
2.1. For the purpose of clarity, the data controller is CV Keskus OÜ, registry code 11325768, registry address Estonia, Harju County, Tallinn, Endla 16, 10142.
2.2. In all matters related to the Privacy Policy and processing of personal data, as regards to which CV Keskus is the controller, can be addressed to the data protection officer of CV Keskus by sending an inquiry by e-mail to dpo@cvkeskus.ee.
2.3. CV Keskus processes personal data in accordance with the principles of data protection recognized in the European Union (in particular with the principles of lawfulness, fairness, transparency, purpose limitation and data minimization) as well as with the requirements established by the applicable law.
3. Purposes of processing and categories of personal data
3.1. CV Keskus processes the Data Subject’s personal data for the following purposes:
(a) performing the agreement concluded with the Jobseeker which object is to intermediate the Jobseeker’s CV to the Employers via the Platform and enable the Jobseekers to apply for job offers (including providing user support);
(b) communicating with a Jobseeker who is interested in using of the Services;
(c) transmitting personalized marketing notifications (e.g. by e-mail or telephone);
(d) displaying personalized marketing notifications (e.g. displaying CV Keskus’ advertisements and offers by CV Keskus’ partners);
(e) developing and improving performance of the Platform and the Services (which includes the production of statistics and analysis of labour market trends);
(f) performing obligations arising from the legislation of the Republic of Estonia;
(g) exercising rights arising from the legislation of the Republic of Estonia and from the existing legal relations.
3.2. CV Keskus may process the following personal data:
(a) for the purpose stated in section 3.1(a): primarily Jobseeker’s name, date of birth, personal identification code, gender, language, e-mail address, telephone number, home address and any other personal data concerning the Jobseeker and his/her career (e.g. references, previous jobs, education, trainings, skills, photo and other data entered in the motivation letter and the CV), username and other data that is related to the usage of the Platform and the Services by the Jobseeker (e.g. test results, forum posts, personal data disclosed during job interviews, Jobseeker’s salary request, desired working place and time, etc) and personal data collected by cookies (if such personal data is collected at all), additionally Jobseeker’s IP-address;
(b) for the purpose stated in section 3.1(b): primarily name, e-mail address and telephone number of the Jobseeker interested in the Services and any personal data contained in other information which such person may submit;
(c) for the purpose stated in section 3.1(c): primarily Data Subject’s email address, telephone number and Platform usage logs (including personal data collected by cookies);
(d) for the purpose stated in section 3.1(d): primarily Platform usage logs (including personal data collected by cookies) for the display of personalized marketing notifications (for example, the display of CV Keskus adverts and offers by CV Keskus' cooperation partners);
(e) for the purpose stated in section 3.1(e): any personal data mentioned above;
(f) for the purpose stated in section 3.1(f): any personal data mentioned above, determined case-by-case according to the obligation which CV Keskus needs to fulfill;
(g) for the purpose stated in section 3.1(g): any personal data mentioned above, determined case-by-case according to the right CV Keskus implements.
3.3. If the entry of personal data has been made mandatory upon account registration or after registration when using the functions of the Platform, the submission of the respective personal data is required for concluding the agreement between the Jobseeker and CV Keskus or for performing under the respective agreement. In that case, the submission of personal data is mandatory and if it is not submitted, it is impossible to enter into this agreement or perform this agreement. If the entry of personal data has not been made mandatory on the Platform and the submission of personal data is not required from the Data Subject in any other way, the submission of personal data is voluntary and non-submission does not have any direct adverse consequences for the Data Subject. However, failure to provide personal data may limit the use of the Platform functions and, for example, reduce the Jobseeker’s prospects in finding a job (which is not decided by the CV Keskus but by the Employer).
3.4. As a general rule, the above-mentioned personal data has been collected by CV Keskus directly from the Data Subject, except in the following cases:
(a) if the Data Subject uses Google account to log in to the Platform, Google forwards the name, e-mail address, language preference and profile picture of the Data Subject to CV Keskus;
(b) if the Data Subject uses Facebook account to log in to the Platform, Facebook forwards the name, profile picture and e-mail address of the Data Subject to CV Keskus;
(c) personal data which has been collected by CV Keskus from publicly available sources (e.g. LinkedIn) in situations where CV Keskus provides recruitment services for the Employer;
(d) Platform usage logs which have been automatically collected by CV Keskus in accordance with the Data Subject’s actions on the Platform.
4. Legal basis for processing personal data
4.1. CV Keskus processes the Jobseeker’s personal data as it is necessary for the performance of the agreement concluded with the Data Subject (see section 3.1(a) above) or for taking steps at the Jobseeker’s request prior to entering into the agreement (see section 3.1(b) above). In such case the legal basis for processing personal data is the agreement concluded with Jobseeker; or the Jobseeker’s request for pre-contractual negotiations.
4.2. CV Keskus processes the Data Subject’s personal data also for transmitting personalized marketing notifications (see section 3.1(c) above). In such case, the legal basis for processing personal data is the prior consent given by the Data Subject. If the Data Subject does not give a consent for transmitting personalized marketing notifications, CV Keskus shall not process personal data for that purpose and personalized marketing notifications are not sent. The Data Subject providing such consent must be at least 13 years old. If the Data Subject is younger than 13 years, his/her consent is valid only if he/she provides also a consent from his/her legal representative (parent or legal guardian). The Data Subject may at any time withdraw his/her consent by sending a respective notice to CV Keskus’ e-mail address dpo@cvkeskus.ee. Withdrawal of the consent shall not affect the Data Subject’s right to use the Services and the Platform.
4.3. CV Keskus processes the Data Subject’s personal data also for displaying personalized marketing notifications (see section 3.1(d) above). In such case, the legal basis for processing personal data is also the prior consent given by the Data Subject. If the Data Subject does not give a consent for displaying personalized marketing notifications, CV Keskus shall not process personal data for that purpose and personalized marketing notifications are not shown. The Data Subject providing such consent must be at least 13 years old. If the Data Subject is younger than 13 years, his/her consent is valid only if he/she provides also a consent from his/her legal representative (parent or legal guardian). The Data Subject may at any time withdraw his/her consent by sending a respective notice to CV Keskus’ e-mail address dpo@cvkeskus.ee. Withdrawal of the consent shall not affect the Data Subject’s right to use the Services and the Platform.
4.4. CV Keskus processes the Data Subject’s personal data additionally to improve the Platform and the Services offered (see section 3.1(e) above). In such case the legal basis for processing personal data is the legitimate interest of CV Keskus as the controller to improve and develop functioning of the Platform, provision of the Services and its quality. CV Keskus cannot guarantee the best and most modern Platform and Services without doing any development works, statistics and market analysis. Impact of such processing is minimal to the rights of the Data Subject since as a general rule, personal data is processed minimally for this purpose.
4.5. CV Keskus processes also the Data Subject’s personal data to fulfil the obligations arising from the laws of the Republic of Estonia (see section 3.1(f) above). In such case, the legal basis for processing personal data is the fulfilment of legal obligations applicable to CV Keskus as a controller.
4.6. CV Keskus processes the Data Subject’s personal data also to exercise the rights arising from the laws of the Republic of Estonia and from the agreement entered into with the Data Subject (see section 3.1(g) above). In such case, the legal basis for processing of personal data is the legitimate interest of CV Keskus as the controller. It is the legitimate interest of CV Keskus to exercise its rights in the way CV Keskus deems necessary.
5. Disclosing personal data
5.1. The Jobseeker’s CV published on the Platform and the related personal data shall be made available to the Employers according to the level of disclosure selected by the Jobseeker:
(a) if the Jobseeker selects the status of the CV as an active and non-confidential, then CV Keskus has the right to disclose to the Employers all personal data entered by the Jobseeker in the CV and any personal data related to it;
(b) if the Jobseeker selects the status of the CV as an active and confidential, CV Keskus has the right to disclose to the Employers all personal data entered in the CV and any personal data related to it, except the Jobseeker’s name, photo, jobs and names of the recommenders. CV Keskus has the right to process the e-mail address entered in the CV to enable Employers to contact the Jobseeker;
(c) if the Jobseeker selects the status of the CV as a passive, the Jobseeker’s personal data is not visible to the Employers and the Employers cannot make offers to the Jobseeker.
5.2. If the Jobseeker has started filling out the CV and has entered his/her personal data to the database but has not finished the CV (all mandatory fields have not been fulfilled), then the Jobseeker’s personal data is not visible to the Employers and is not transferred to them.
5.3. If the Jobseeker submits his/her CV to apply for a particular job offer, then regardless of the selected disclosure status, all personal data entered in the CV as well as any other personal data entered to or submitted through the Platform shall be transferred to that respective Employer.
5.4. In some cases, the Employers may want to use their applicant tracking system for conducting recruitment process for a job offer.
(a) In case the applicant tracking system has been interfaced with the Platform (i.e. the Jobseeker does not leave the Platform during the application process and when entering personal data), CV Keskus continues as the controller of the Data Subject’s personal data. In such case, upon applying for a job offer, CV Keskus as a controller automatically forwards the personal data of the Jobseeker to such Employer’s applicant tracking system.
(b) In case the applicant tracking system has not been interfaced with the Platform (i.e. the Jobseeker exits the Platform during the recruitment process and while entering personal data), then CV Keskus will no longer be the Data Subject’s personal data controller to the extent where the application takes place outside the Platform. Such third party websites are subject to different privacy regulation terms, the implementation of which cannot be controlled by CV Keskus. CV Keskus is not liable for privacy policies on third party websites or for the processing of personal data through the third party websites.
5.5. In addition to the Employers and providers of applicant tracking systems, CV Keskus may also transfer personal data to other third parties (listed as follows by category):
(a) IT-service providers who assist CV Keskus in securing, systemizing and processing of personal data and that ensure the operation and development of the Platform, including, but not limited to, cloud service providers, software developers, etc.;
(b) e-mail delivery service provider that assists in transmitting of marketing notifications to the Data Subjects;
(c) service providers that help to display personalized marketing notifications;
(d) companies that belong to the same group of companies with CV Keskus, insofar as it is necessary for the provision of the Services.
5.6. CV Keskus generally processes personal data only in the European Economic Area and does not transfer it to third countries or international organizations. However, if CV Keskus does so, it shall ensure that personal data is only transferred to a third country or international organization which complies with the personal data protection requirements equivalent to those in force in the European Economic Area.
5.7. CV Keskus has no automatic obligation to transfer the Jobseeker’s personal data to the Employers or any other third parties (unless otherwise provided by the Privacy Policy and/or CV Keskus Conditions of Use). If the Jobseeker wishes that CV Keskus would transfer the Jobseeker’s personal data to a third party, the Jobseeker shall submit a written application to CV Keskus, indicating to whom and what personal data the Jobseeker requests to be transferred.
5.8. All authorized third party processors to whom CV Keskus transmits personal data shall ensure the protection of personal data as provided by the legislation regulating the protection of personal data.
6. Retaining personal data
6.1. The Data Subject’s personal data shall be stored:
(a) insofar as personal data is processed for the performance of the agreement entered into with the Jobseeker (see section 3.1(a) above), for the development of the Platform and the Services (see section 3.1(e) above) and for the CV Keskus’ obligations (see section 3.1(f) above) and rights (see section 3.1(g) above):
i. up to three years after the deletion of the Jobseeker’s User account (or, if the personal data of the Employer’s representative is processed, then up to three years after the Employer’s User account has been deleted); or
ii. up to one month after the Data Subject has requested erasure of his/her personal data in written form and the Data Subject has the corresponding right; or
iii. up to one month after CV Keskus becomes aware of the fact that the Data Subject is no longer alive;
(b) insofar as personal data is processed for the communication with a Jobseeker who is interested in using the Services (see section 3.1(b) above), up to three years after the last communication;
(c) insofar as personal data is processed for the purpose of transmitting personalized marketing notifications (see section 3.1(c) above) and/or displaying them (see section 3.1(d) above), until the Data Subject withdraws his/her consent.
6.2. Accounting documents that contain personal data shall be stored for seven years from the end of the financial year to which they relate to.
6.3. If the Jobseeker starts composing a CV, but the CV is not finished, CV Keskus shall send a reminder within seven days from the creation of the unfinished CV that the CV is unfinished. If the Jobseeker does not complete the CV within thirty days after sending the notification, CV Keskus shall send to the Jobseeker a new reminder. If the Jobseeker does not complete the CV within thirty days after the last reminder has been sent, CV Keskus will delete the unfinished CV and the personal data provided therein.
7. Processing of personal data for recruitment services
7.1. In order to fulfil the agreement entered into with the Jobseeker in the best possible way and to help match a suitable Jobseeker with a suitable job offer, CV Keskus allows the Employers to select potential suitable Jobseekers using keywords and filters based on the personal data submitted to CV Keskus by the Jobseekers. For example – if the Employer selects computer programming skill as a filter, Jobseekers who do not have a corresponding skill on the basis of the personal data provided to CV Keskus will not be displayed to the Employer. It is in the best interests of the Jobseeker, as he/she shall not receive job offers that he/she would not be interested in.
7.2. The nature of processing of personal data described above is not fully automated (choices are made by the respective Employer) and it does not have legal or otherwise significant consequences to the Jobseeker.
8. Data Subject’s rights
8.1. The Data Subject has the right at any time to contact CV Keskus by writing an e-mail at dpo@cvkeskus.ee and:
(a) request once in a month from CV Keskus information about persons who have looked at the Jobseeker’s personal data;
(b) right to request access of personal data;
(c) right to request rectification of personal data;
(d) right to request erasure of personal data;
(e) right to request restriction of processing of personal data;
(f) right to object to processing of personal data;
(g) right to request portability of personal data;
(h) right to request that decision is not taken concerning the Data Subject which is based on automated decision-making;
(i) right to withdraw a consent for processing personal data;
(j) right to lodge a complaint with a supervisory authority (Estonian Data Protection Inspectorate).
