Notice of processing of personal data

This privacy notice is intended for candidates participating in recruitment processes announced by a company within PLC Ignitis Group (hereinafter – the Group company). It provides information on how your personal data as a candidate is processed.

The recruitment process utilises the SmartRecruiters system, where candidates’ personal data is processed.

We respect your privacy and are committed to safeguarding your personal data. The Group company processes personal data in compliance with Regulation (EU) 2016/679 of the European Parliament and Council, dated 27 April 2016, concerning the protection of individuals with regard to personal data processing and the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter – GDPR), the Republic of Lithuania's Law on Legal Protection of Personal Data, and other applicable laws governing personal data protection, as well as the terms outlined in this privacy notice. We implement appropriate technical and organisational measures that meet GDPR requirements to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, use, or other unlawful processing. The terminology used in this privacy notice is as defined in the GDPR.

1. Data Controller and Data Protection Officer

The data controller responsible for your personal data is the Group company that has announced the recruitment for the position you are applying for. To carry out recruitment, the Group company may engage Ignitis Group Service Centre Ltd, which acts as a data processor and processes personal data on behalf of the data controller.

If you have any questions about the processing of your personal data, you may contact the Data Protection Officer at: [email protected].

2. Legal Grounds for Processing Personal Data

Your personal data is processed solely for specific purposes and based on the following legal grounds:

  • if you have given consent for your personal data to be processed for one or more specified purposes (GDPR Article 6(1)(a));

  • if the processing of your personal data is necessary to perform or enter into a contract with you (GDPR Article 6(1)(b));

  • if the processing of your personal data is required to comply with a legal obligation (GDPR Article 6(1)(c));

  • if the processing of your personal data is necessary to pursue the legitimate interests of the Group company (GDPR Article 6(1)(f));

  • if the processing of your special categories of personal data is necessary to allow the Group company (data controller) or you to fulfil obligations and exercise specific rights in employment and social security law, as permitted by EU or national law or a collective agreement, which includes appropriate safeguards for the rights and interests of the data subject (GDPR Article 9(2)(b)).

3. Purpose, Scope, and Retention Period of Personal Data Processing

The Group company collects and processes the following categories of your personal data as a candidate for the purposes outlined below:

For the purpose of organizing and conducting recruitment:
For the purpose of candidate background and reputation checks:
For the purpose of concluding employment contracts with successful candidates:
For the purpose of improving the quality of the recruitment process:
For the purpose of sending job notifications:
For the purpose of talent community activities:
For the purpose of reviewing candidate claims, requests, or complaints, as well as to express, enforce, or defend legal claims:

For the purpose of organizing and conducting recruitment:

  • The following personal data are processed: identity data (name, surname), contact details (phone number, email address), qualification data (education, qualifications, work experience, including previous employers, held positions, other work experience), professional skills, professional attributes, other personal data included in the CV and/or other submitted documents, publicly available information, including public information on professional social networks; application data completed in the SmartRecruiters system during the application process, data collected during the recruitment process (e.g., interview notes, completed task data, psychometric test results, if applicable), hiring decision, candidate’s application for positions within the Group, correspondence with the candidate, and video data if video recording is conducted during recruitment.

Legal basis for data processing: the legitimate interest of the Group company. Additionally, for the above purpose, the Group company may collect personal data related to the candidate’s qualifications, professional skills, and attributes from a former employer after notifying the candidate, or from a current employer only after obtaining the candidate’s consent.

Data retention period: personal data are stored for two (2) years after the recruitment process concludes (including cases when the candidate was not selected).

For the purpose of candidate background and reputation checks:

  • The following personal data are processed: identity data (name, surname, date of birth, or personal identification number if the date of birth does not suffice to identify the candidate accurately), other personal data (candidate’s CV, publicly available personal data related to reputation), and for high-risk or strategic positions as outlined by the Lithuanian Minister of Finance's Order No. 1K-267 dated 11 September 2019, additional data as stipulated in Article 16 of the Law on Corruption Prevention of the Republic of Lithuania and/or Article 17 of the Law on the Protection of Important Facilities for National Security of the Republic of Lithuania.

Legal basis for data processing: legal obligation fulfilment and the legitimate interest of the Group company.

Data retention period: personal data collected to fulfil a legal obligation are retained for the duration of the employment contract and for ten (10) years following its expiration. Other personal data (including when an employment contract was not concluded) are retained for one (1) year.

For the purpose of concluding employment contracts with successful candidates:

  • The following personal data are processed: identity data (name, surname, date of birth, personal identification number, gender, details of identity documents, photograph), contact details (residential address, declared residential address, phone number, email address), emergency contact, payment details (bank data, account number), qualification and education data, employment terms offered within the Group company, required health check certificates (Form No. 047/a), work capacity level, certificates related to dependencies, mental health, capacity, as required for positions identified in the Lithuanian Minister of Finance's Order No. 1K-267, children’s details (name, surname, personal identification number) and related documents, and details of children’s disability levels.

Legal basis for data processing: employment contract conclusion and legal obligation fulfilment.

Data retention period: following the conclusion of the employment contract, personal data are retained in accordance with the Republic of Lithuania’s Law on Documents and Archives and as determined by the Chief Archivist of Lithuania, (e.g. employment contracts and their appendices are stored for 50 years from the termination of the contract).

For the purpose of improving the quality of the recruitment process:

  • The following personal data are processed by sending a survey to the candidate's provided email address: identity data (name, surname), contact details (email address), other data (position, candidate’s responses in the survey).

Legal basis for data processing: the candidate's consent, given specifically for feedback on this recruitment process. You have the right to withdraw consent at any time in the candidate account on the Smart Recruiter system or by following the methods described in section 6 of this Privacy Notice. Withdrawal of consent does not affect the legality of processing based on consent before its withdrawal.

Data retention period: personal data are retained for one (1) year.

For the purpose of sending job notifications:

  • Personal data processed when candidates subscribe to job notifications for new job offers: identity data (name, surname), contact details (email address).

Legal basis for data processing: the candidate's consent, valid until withdrawn. You have the right to withdraw consent at any time by clicking the “unsubscribe” button in the received email or through the methods described in section 6 of this Privacy Notice. Withdrawal of consent does not affect the legality of processing based on consent before its withdrawal.

Data retention period: personal data are retained until consent is withdrawn.

For the purpose of talent community activities:

  • The following personal data are processed for the purpose of sending periodic newsletters about the Group’s activities, events, and relevant job openings: identity data (name, surname), contact details (email address), other data (city).

Legal basis for data processing: your consent, valid for two (2) years. You have the right to withdraw your consent at any time by clicking the “unsubscribe” button in the received email, deleting your candidate account in the Smart Recruiter program, or through the methods described in section 6 of this Privacy Notice. Withdrawal of consent does not affect the legality of processing based on consent before its withdrawal.

Data retention period: personal data are retained for two (2) years unless you cancel it earlier.

For the purpose of reviewing candidate claims, requests, or complaints, as well as to express, enforce, or defend legal claims:

  • The following personal data are processed: all the above-listed personal data, including when data are processed based on consent, data confirming the granting and/or withdrawal of consent. The Group company may process these data as necessary to review a candidate’s claim, request, or complaint, and to make decisions or express, enforce, or defend legal claims and retain evidence.

Legal basis for data processing: the legitimate interest of the Group company.

Data retention period: data may be retained for three (3) years or until the conclusion of relevant legal proceedings and for the duration necessary after their conclusion, depending on the specific legal procedure or process, or as stipulated by legal terms.

4. Acquisition of Personal Data

The Group company obtains your personal data as a Candidate from the following sources:

  • Directly from you;

  • From publicly available sources, such as professional social networks (e.g., LinkedIn) and job listing portals (e.g., CV bank, CV online, Glassdoor, etc.);

  • From law enforcement authorities;

  • Through recommendation by an employee of the Group company. The Group operates a referral system, where an employee can submit information about a recommended candidate. The referring employee is obligated to inform the candidate about the sharing of their data with the Group company. After a recommendation is submitted, the candidate receives an automatic email with information about the relevant job opportunity for which they may apply;

  • From third parties (e.g., the candidate’s current and/or former employer).

5. Provision of Personal Data

In compliance with legal requirements, the Group company may transfer your processed personal data to the following categories of recipients:

  • Service providers (engaged data processors) processing personal data on behalf of the Group company (the data controller) and providing services related to candidate recruitment (e.g., recruitment, IT development and maintenance, and other services), including the Smart Recruiters system service provider, to ensure proper service delivery;

  • Other Group companies. The Group company may share processed personal data with other Group entities as necessary to complete recruitment for a vacant position within its own company or another Group company;

  • Government, law enforcement, and supervisory authorities when required by law or when necessary to protect the legitimate interests of the Group company, its employees, or third parties, in accordance with legal requirements;

  • Other third parties, only under lawful grounds and legitimate purposes as outlined in legal regulations.

Personal data is processed within the European Union (EU) and European Economic Area (EEA), but in certain cases, such as when a data processor engaged by the Group company is located outside the EU/EEA, certain personal data may need to be transferred or accessed outside the EU/EEA to ensure the provision of services. Personal data may be transferred outside the EU/EEA only if the Group company ensures the necessary safeguards required by the GDPR and if there is a legal basis for such a transfer.

6. Your Rights as a Data Subject and Their Implementation

As a data subject, you have the following rights:

  • To be informed about the processing of personal data (GDPR Articles 13-14);

  • To access your personal data processed by the Group company (GDPR Article 15);

  • To request the rectification of incorrect, incomplete, or inaccurate personal data (GDPR Article 16);

  • To request the erasure of your personal data ("right to be forgotten") (GDPR Article 17). Note: This right can be exercised when at least one of the conditions set out in GDPR Article 17(1) is met;

  • To restrict the processing of personal data (GDPR Article 18). Note: This right can be exercised when at least one of the conditions set out in GDPR Article 18(1) is met;

  • To receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another data controller. You have this right insofar as it pertains to your personal data obtained by the Group company from you, processed based on your consent, or carried out under a contract, and if it is processed by automated means (GDPR Article 20);

  • To object to the processing of your personal data when the legal basis for such processing is a legitimate interest (GDPR Article 21(1));

  • To withdraw your consent at any time when personal data is processed based on consent, although such withdrawal will not affect the legality of processing before the withdrawal of consent (GDPR Article 7(3), Article 21(3));

  • To file a complaint with the supervisory authority – the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius, [email protected]) if you believe that your rights as a data subject are not being properly implemented or if your personal data is not being processed correctly. Before filing a complaint, we suggest contacting the Data Protection Officer at [email protected] to address any concerns promptly.

You may exercise your rights as a data subject by submitting a written request to Laisvės pr. 10, LT-04215 Vilnius, or via email at [email protected]. To delete your SmartRecruiters account, you can do so by logging into your account on the system. You can exercise your rights directly or through a representative holding a power of attorney.

If there are doubts about your identity as a data subject, we reserve the right to request additional information necessary to verify your identity.

Your request will be reviewed, and a written response will be provided as promptly as possible, but no later than one month from the date of receipt. To facilitate your request, we may ask for further clarification or specific information. In certain cases, this period may be extended by two additional months, depending on the complexity of the request. In such cases, we will notify you of the extension and the reasons for it.

To ensure data protection, we ensure that any information provided to you does not infringe the rights of others if any information about you is related to other individuals.