Recruitment privacy policy

Recruitment privacy policy

• Which categories of personal data we collect and why

  It is your responsibility to provide only valid and genuine personal data and only such data as are appropriate and necessary for the purpose of fulfilling the objectives mentioned in this information text. In some cases, depending on the type of vacancy, we may ask you for additional information, for example, information about existence of driver’s license. If you submit information that is not required for the recruitment  process, it will not be taken into account.

  If you do not agree to the processing of personal data as described in this information text your application will not be evaluated during the recruitment process.

  You can submit an application, and exercise the rights in this information text if you are at least 18 years of age or in exceptional cases at least 15 years old.

  Evaluation of application during recruitment process

  We process your personal data in order to evaluate your application during our recruitment process:

  • if you apply for a specific vacancy;
  • if you submit an application;
  • if you apply by phone or directly in store orally;
  • if we have contacted you by cooperating with a recruitment company, or based on the professional information available in your profile in widely used and/or public career portals or databases (for example, but not limited to LinkedIn, CV Online, CV Keskus) or based on your friend’s or acquaintance’s recommendation. If you add link to your social media account (for example, Linkedin) we may process this information during recruitment process.
  • if we receive an application from an employment agency within the framework of our cooperation, for example, an EU-financed project managed by the State Employment Service, Unemployment Fund.

  Categories of personal data	Identity information, e.g., name, surname, username, customer ID etc. Contact details, e.g., email, phone number, address etc. Competence data, e.g., professional experience, education, certifications, courses, language skills etc. Reference data, e.g., characteristics of the person etc. Assessment information, e.g., performance assessment, rating, tests, evaluations etc
  Legal basis	Your consent and our legitimate interest to ensure our company’s operations
  Retention period	See section “For how long are my data stored?”

  Connection for future job interest

  When you have given your consent, we may process your personal data in the future in connection with another position in case we find you a suitable candidate for another role within our company. If you consent to this, we will process your data for the purpose of connection for future job interest, and you will become a part of our candidates’ database.

  In order to be able to inform you about vacancies that more suitable for you, we may take into account information that you have provided us, e.g., in your application, incl., e.g., your added LinkedIn profile, information that we have received during our cooperation, incl. during the personal interview with you, and what you have chosen as your specific interest.

  Categories of personal data	Identity information, e.g., name, surname, username, customer ID etc. Contact details, e.g., email, phone number, address etc. Competence data, e.g., professional experience, education, certifications, courses, language skills etc. Reference data, e.g., characteristics of the person etc. Assessment information, e.g., performance assessment, rating, tests, evaluations etc.
  Legal basis	Your consent and our legitimate interest to ensure our company’s operations
  Retention period	See section “For how long are my data stored?”

   

  Collection and assessment of references about the applicant

  We process your personal data in order to collect and assess references about the applicant during the recruitment process if the applicant has indicated you as a reference provider.

  If the applicant previously worked for us then we may ask references also from our own people who have worked with the applicant.

  Categories of personal data	Competence data, e.g., professional experience, education, certifications, courses, language skills etc. Performance data, e.g., goals, achievements, statistics about efficiency etc. Reference data, e.g., characteristics of the person etc.
  Legal basis	Applicant’ s and your consent
  Retention period	See section “For how long are my personal data stored?”

  Collection of applicants feedback about recruitment process

  We process your personal data in order to send you recruitment process evaluation form. Applicant feedback is gathered with the aim to improve our internal processes and overall future applicant experience.

  Participation in surveys is up to you.

  Categories of personal data	Identity information, e.g., name, surname, username, customer ID etc. Contact details, e.g., email, phone number, address etc. Feedback data, e.g., rating, comments etc.
  Legal basis	Your consent
  Retention period	See section “For how long are my personal data stored?”

  Background check of final candidates for specific positions

  We might process your personal data to obtain information of recommendative nature about your suitability to apply for the position and mitigate business risks related to human resources and to protect Rimi assets. Within recruitment process background checks might occasionally be carried out only on final candidates applying for specific sensitive positions requiring greater responsibility (i.e., positions within the company which take up legal and financial responsibilities for the company, have substantial impact on business partner selection and spending, has a high-profile representative function, e.g., top management, managerial positions in specific corresponding departments). The background check can be initiated by the person who starts the recruitment (e.g., recruitment specialist). During the background check it may be investigated whether you have a clear conflict of interest, an exceptionally bad reputation in the media (applicable to representative positions with high public exposure), financial distress (e.g., bankruptcies, forced debt recovery; applicable to finance positions with direct access to Rimi financial assets).

  Categories of personal data	Identity information, e.g., name, surname, username, customer ID, etc. Employment information, e.g., time and date of employment, type of employment, position, job duties, work permit etc. Information on secondary occupations and conflicts of interest, e.g., type of secondary job, financial interest in other companies, conflicts of interest, etc. Credit information, e.g., credit records, solvency, credit worthiness, etc.
  Legal basis	Our legitimate interest to mitigate business risks related to human resources and to protect Rimi assets.
  Retention period	See section “For how long are my personal data stored?”

   

  Management of legal claims

  We might process your personal data what was taken into account within evaluation of recruitment process in order to establish, exercise and defend legal claims.

  Categories of personal data	Personal data that we already have about you: Identity information, e.g., name, surname, username, customer ID etc. Contact details, e.g., email, phone number, address etc. Competence data, e.g., professional experience, education, certifications, courses, language skills etc. Reference data, e.g., characteristics of the person etc. Assessment information, e.g., performance assessment, rating, tests, evaluations etc. other information necessary For management of legal claims
  Legal basis	Our legitimate interest in establishing, exercising or defending legal claims.
  Retention period	See section “For how long are my personal data stored?”

  If you visit our office, store or other business premises, please see our CCTV privacy policy.

  Management of conflicts of interest

  We process your personal data in order to protect company’s interests and manage conflicts of interest situations, when recruiting new employees who will be making decisions on behalf of Rimi or will be involved in the decision-making-process. During the last stages of the recruitment process we may ask applicants to inform us about potential or existing conflicts of interest in order to make an informed decision about the applicant with the conflict of interest (e.g. if Rimi can employ/engage the person with such conflict, if Rimi will be able to manage the conflict during the employment, if applicant will be employed, etc.).

  Categories of personal data	Identity information, e.g., name, surname, username, customer ID etc. Company information, e.g., name of the company, person’s job title, company ownership data, etc. Communication data, e.g., metadata, content of e-mail, phone call, voice mail etc. Information on secondary occupations & conflicts of interest, e.g., type of secondary job, financial interest in other companies, conflict of interest etc. Information about situation, e.g., type of situation, time and date when situation occurred, description of situation, accompanying documents etc.
  Legal basis	Our legitimate interests to protect company’s interests
  Retention period	See section “For how long are my personal data stored?”

   

  Statistical purposes

  We process your personal data for the purposes of reporting and statistics, to evaluate and improve recruitment process. For this purpose, personal data are processed only to the extent necessary for the preparation of statistics. The aggregate statistical information will not contain your name, contact information or any other directly identifiable information that may directly identify you as a specific person.

  Categories of personal data	Identity information, e.g., name, surname etc. User generated personal data, e.g., information about activities within our information systems, behavior in digital channels etc. Information about situation, e.g., type of situation, time and date when situation occurred, description of situation, accompanying documents etc., for instance, application information, e.g., vacancies you applied, application date, etc. information about recruitment process, e.g., processing time, current process step etc. Assessment information, e.g., performance assessment, rating, tests, evaluations etc.
  Legal basis	Our legitimate interests
  Retention period	See section “For how long are my personal data stored?”

   

  Use of Cookies

  When you visit our website or apply directly via candidate selection platform, information about the usage may be stored as cookies. We may use cookies to improve the user’s usage of the website/platform and to gather information about, e.g., statistics about the usage of the website/platform. This is done to secure, maintain and improve the website/platform. Non-essential cookies are processed based on your consent and you can, at any time, disable the use of non-essential cookies by changing cookies settings. Please see our Cookie policy and our Website privacy policy.

• From which sources do we collect personal data?

  Yourself

  We collect the personal data you provide to us regarding yourself, such as when you are submitting an application, contact us and etc.

  Other sources

  We may collect the personal data from a recruitment company, or career portals or databases where you have posted your CV (for example, but not limited to LinkedIn, CV Online, CV Keskus) or from your friends or acquaintances who have recommended you as a candidate or in specific cases from your legal guardian, or an employment agency, or education provider or organization that promotes education.

  If you connect with us from external sources (such as Linkedin) we may receive your information related to your social media account and may process it during the recruitment process. You can choose to apply directly via our candidate selection platform.

  In a situation when we use career portals or databases, we may use data what is added by yourself and in those cases, we are acting as controllers based on our privacy policy. When you are adding your personal data in our used career portals or databases we invite you to read career portal or database privacy policy and their terms and conditions as they act as separate controllers.

  We may collect the personal data during the background check also from external information systems and databases, e.g., from the Commercial Register, Real Estate Register, Credit Information Registers, public information search engines (such as Google), social platforms (only publicly available information, e.g., LinkedIn).

• Sharing of personal data

  Service providers

  We share your personal data with companies that provides services to us, for example, recruitment company. These companies can only process your personal data according to our instructions and not use them for other purposes. They are also required by law and our cooperation agreement to protect your personal data.

  • Data Centre service providers,
  • Databases and recruitment channels,
  • Recruitment companies,
  • Information system development and maintenance service providers.

  For instance, our candidate selection platform is provided by Teamtailor AB that may have access to candidates' personal data when providing their services. Teamtailor AB acts as our data processor.

  Group companies

  We might share your personal data with relevant Rimi Baltic group companies if it is necessary for achieving defined purposes.

  Law enforcement authorities, state and local government institutions

  To fulfil our legal obligation we may transfer your personal data to law enforcement authorities, state and local government institutions upon their request. We may also transfer your personal data to law enforcement authorities, state and local government institutions in order to meet our legitimate interest in establishing, exercising and defending legal claims.

• Where do we process your personal data?

  We always aim to process your personal data within EU/EEA.

  In certain cases, your personal data might be transferred or processed in a country outside EU/EEA by contracted service providers. When your data is processed outside the EU/EEA by our service providers, we ensure that there are sufficient technical and organizational safeguards in place in order to ensure that the recipients process the data in a secure way. For instance, for IT and other support, we may use service providers accessing personal data from countries outside the EU/EEA. We may use service providers that are based in a variety of countries outside the EU/EEA and transfers depends on the time of the day (follow-the-sun).

  When we transfer your personal data to a country outside the EU/EEA, we use either the standard contractual clauses or an adequacy decision as a transfer mechanism. In rare cases our service provider who acts as data processor may transfer the personal data to a sub-processor outside the EU/EEA with Binding Corporate Rules as a transfer mechanism. You can receive information about used introduced personal data safeguards by providing written request to us. Countries with an adequacy decision can be found here and the standard contractual clauses issued by the European Commission can be found here.

• For how long are my personal data stored?

  Recruitment and personal data necessary for feedback about recruitment process: We will process your personal data for up to 8 months from the date of receipt, unless we employ you, or you agree to retain your data for an extended period to invite you to participate in future job interest (Connection for future job interest), or we need to retain the personal data for a longer period within the context of our legitimate interests, e.g., regarding management of legal claims etc.

  Data based on your consent will be processed for the particular purpose until you withdraw your consent.

  For statistical purposes: Feedback data and data for statistical purpose in aggregate format that does not contain personal data - retention time is as long as necessary for the purpose.

  Personal data necessary for background checks: Personal data are processed only from the moment the background check is initiated during the recruitment process till the end of the recruitment process. No records kept of the actual background check.

  If there was a legal claim, then we retain your personal data till the completion of respective investigation and legal claim settlement.

  If employee, having a conflict of interest, is employed in Rimi, personal data regarding the conflict are processed according to provisions set in Employee privacy policy.

   

• Your rights

  Data protection laws give you a number of rights with regards to the processing of your personal data.

  Access to personal data

  You are entitled to request confirmation from us if we process personal data relating to you, and in such cases request access to the personal data we are processing about you. To carry out the mentioned right, you also can provide a written request to us or to our Data protection officer.

  Rectification of personal data

  Furthermore, if you believe that information about you is incorrect or incomplete, you have the right to correct it yourself or ask us to do it. To carry out the mentioned right, you also can provide a written request to us or to our Data protection officer.

  Withdrawal of consent

  To the extent that we process your personal data based on your consent, you are entitled to, at any time, withdraw your consent to the personal data processing. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. To carry out the mentioned right, please, provide a written request to us or to our Data protection officer.

  Objection against processing based on a legitimate interests

  You are entitled to object to personal data processing based on our legitimate interests. However, we will continue to process your data, even if you have objected to it, if we have compelling motivated reasons for continuing to process data. To carry out the mentioned right, please, provide a written request to us or to our Data protection officer.

  Erasure

  Under certain circumstances, you have rights to ask us to delete your personal data. However, this does not apply if we are required by law to keep the data. To carry out the mentioned right you also can provide a written request to us or to our Data protection officer.

  Restriction of processing

  Under certain circumstances, you are also entitled to restrict the processing of your personal data. To carry out the mentioned right, please, provide a written request to us or to our Data protection officer.

  Data portability

  Finally, you have the right to receive or transmit your personal data further to another data controller (“data portability”). This right solely covers only data what you have provided to us based on you consent or on a contract and where processing is carried out by automated means. To carry out the mentioned right, please, provide a written request to us or to our Data protection officer.

• Who do I contact if I have any questions?

  If you have any questions about the processing of your personal data, please feel free to contact us.

  If you are not satisfied with the response you received, you are entitled to file a complaint with the relevant Data Protection Authority. In Latvia: Data State Inspectorate / in Estonia: Data Protection Inspectorate / in Lithuania: State Data Protection Inspectorate.

  Contact details of company in charge of handling your personal data

  Each Rimi Baltic group company acts as a separate controller. However, in certain cases we can act as joint controllers, for instance, in relation to cross-border activities, e.g., if you are applying to work in Rimi pan-Baltic team or in relation to statistics in aggregate format to evaluate and/or improve common recruitment process. In such a case relevant Rimi Baltic group companies are responsible for processing your personal data in accordance with the applicable data protection laws.

  In relation to joint processing, Rimi companies have therefore entered into an arrangement for the protection of personal data among themselves and each Rimi company involved acting as a joint controller in respect of its own processing of personal data is responsible for establishing a lawful basis; providing necessary personal data processing information, incl. on joint processing; ensuring data subject rights and, when necessary, cooperating among themselves to ensure response to the request received; implementation of appropriate technical and organizational security measures; taking appropriate measures in case of a personal data breach etc. It involves, e.g., controls of physical access to data processing facilities, training of people involved in personal data processing, continuous security risks assessments and follow-ups, access rights management, as well as technological security such as use of encryption, safe data transfers etc. You may exercise your rights in respect of and against each of the joint controllers. In order to ensure that any request can be handled as swiftly as possible, contact details of Rimi company that is a contact point for you are mentioned below. For any other processing of personal data for which there is no joint processing, each Rimi Baltic group company, where applicable, remains separate and independent controller

  For you, the company responsible for processing your personal data is Rimi company that you have contacted with. If you wish to contact us or exercise your rights in this privacy policy, please contact Rimi company that you have contacted with, and we will make sure that all Rimi Baltic group companies that may process your personal data respect and ensure your rights. Please see contact details below.

  SIA Rimi Baltic, reg. No. 40003592957
  Legal address: A. Deglava iela 161, Riga, Latvia, LV-1021
  Phone number: +371 67045409
  Email address: info.lv@rimibaltic.com

  SIA Rimi Latvia, reg. No. 40003053029
  Legal address: A. Deglava iela 161, Riga, Latvia, LV 1021
  Phone number: +371 67045409
  Email: info.lv@rimibaltic.com

  Rimi Eesti Food AS, reg. No.  10263574
  Legal address: Saue tee 10, Laagri, 76401, Harju county, Estonia
  Phone number: +373 6059400
  Email: info.ee@rimibaltic.com

  UAB „Rimi Lietuva“, reg. No. 123715317,
  Legal address: Spaudos Street 6-1, LT-05132 Vilnius, Lithuania
  Phone number: +370 5 2461057
  Email: info.lt@rimibaltic.com

  Contact details of the Data protection officer

  Email: RimiDPO@rimibaltic.com

  You also can contact our Data protection officer by sending a letter to us at the above-mentioned address and addressing it to the Data protection officer.

• Changes to our privacy policy

  We have the right to, at any time, make changes or additions to this privacy policy. The latest version of this privacy policy will be available on our candidate selection platform. We may, where applicable, use additional communication channels, e.g., e-mail you have provided us, to inform you about changes if the changes may affect you

Last modified on: August 1, 2022