Recruitment Privacy Policy

Introduction

This Recruitment Privacy Policy provides an overview of the processing of personal data of candidates for employment at Clevon AS ("candidate", "you") during the recruitment process. The term "personal data" refers to the information specified in Article 4(1) of Regulation (EU) 2016/679 (General Data Protection Regulation) ("GDPR").

1. From what sources do we collect personal data?

The data controller is Clevon AS, registry code 16472103, address Reinu tee 48, 71020 Viljandi, Estonia, e-mail legal@clevon.com (“Clevon”, “we”, “us”, "our").

2. From what sources do we collect personal data?

Clevon collects personal data directly from candidates:

documents and materials provided by you during the recruitment process, e.g. CV, motivation letter, application video, portfolio and other documents;
e-mail correspondence in which you provide personal data to Clevon;
in the course of communication (video calls, phone conversations, on-site interviews, events for candidates);
as a result of testing during recruitment.

Clevon may collect personal data from external sources:

from persons referred by you as recommenders;
through public and private registries and platforms, e.g. data you have entered in job portals;
by internet search;
from companies that provide Clevon with recruitment consulting and professional assessment and testing services.

3. What personal data do we collect and process?

Clevon only collects such data from the candidate which is necessary for making recruitment decisions and which Clevon has a legitimate interest in collecting, considering the nature and requirements of the position in question. Providing data is voluntary at all times. It is not a legal or contractual obligation. Clevon may collect and process the following personal data about the candidate:


Identification data	first and last name, personal identification number, date of birth, right to work in the country of residence
Contact details	phone number, address, e-mail address and other contact information
Application data	data you have submitted when applying, including the data provided in your CV, motivation letter, application video and other documents; responses to written questions; responses during an interview; data provided via communication tools and other communication. Application data may include, for example, data on professional qualifications (e.g. education level, educational institutions, specialisation, language skills, employment history, training courses completed); data about the candidate's expectations and preferences (e.g. preferred location and organization of work, expectations towards the position and salary), etc.
Data available from public sources	relevant public data, e.g. data available from public registers for verification of application data; relevant data from public social media accounts

4. Purposes of data processing, legal basis and retention periods

Andmekoosseisud	Eesmärk	Õiguslik alus	Säilitamistähtaeg
Identification data	Identification of the candidate Making job offers in the future	Legitimate interest (GDPR Art 6 (1) (f)) Consent, in case data is retained for future job offers (GDPR Art 6 (1) (a))	Up to 1 year from the recruitment decision (Equal Treatment Act § 25) In case of consent, the time specified therein
Contact details	Conducting the recruitment process Making job offers in the future	Legitimate interest (GDPR Art 6 (1) (f)) Consent, in case data is retained for future job offers (GDPR Art 6 (1) (a))	Up to 1 year from the recruitment decision (Equal Treatment Act § 25) In case of consent, the time specified therein
Application data	Assessment of suitability for the position Making job offers in the future	Legitimate interest (GDPR Art 6 (1) (f)) Consent, in case data is retained for future job offers (GDPR Art 6 (1) (a))	Up to 1 year from the recruitment decision (Equal Treatment Act § 25) In case of consent, the time specified therein
Data available from public sources	Assessment of suitability for the position Making job offers in the future	Legitimate interest (GDPR Art 6 (1) (f)) Consent, in case data is retained for future job offers (GDPR Art 6 (1) (a))	Up to 1 year from the recruitment decision (Equal Treatment Act § 25) In case of consent, the time specified therein

If, as a result of the recruitment process, we make you an offer for employment at Clevon and you accept it, we will store your personal data collected during the recruitment process during the validity of the employment contract and thereafter in accordance with the principles of processing Clevon employees' personal data.

5. Transmission of personal data

We treat data carefully and confidentially. Data may only be transferred to the third parties outlined below and in accordance with the purposes described in this policy. We do not share or transmit your personal data to a greater extent than is necessary to achieve a specific purpose in the recruitment process. Transfer of personal data takes place only if Clevon has assessed that the activities of the data processor are in accordance with data protection legislation. Processing is carried out on the basis of the instructions of Clevon as the data controller and in accordance with an existing agreement between the parties.

1. Service providers within the recruitment process: Clevon may use the services of partner companies (recruitment agencies, candidate management systems), for example to carry out candidate testing, to evaluate applications or to store candidate data. To facilitate this, it may be necessary to share candidates' personal data with partner companies.

2. Regulatory and law enforcement authorities and partners (e.g. legal advisors) for the fulfilment of obligations arising from legislation or for filing or defending against claims.

6. How long do we retain data?

We store personal data according to the retention periods specified in part 4 of this policy. We will retain candidates' personal data for as long as required or permitted by law, but no longer than is reasonably necessary for us to achieve the purposes for which the data was collected or processed. With your consent, we will store data for up to 36 months so that we can assess your fit for potential positions in the future and contact you in case of a suitable job opportunity.

7. Security of personal data

The security of your personal data is important to us. We implement organizational, physical and IT security measures to ensure that candidates' personal data is protected against any misuse, unauthorized access, disclosure, alteration or destruction. Any third parties involved in the processing have been informed that they may use personal data only to the extent and for the purpose set forth in this privacy policy.

Only authorised persons have access to candidates' personal data. Additionally, everyone having access to personal data has undertaken to comply with obligations of confidentiality.

8. Automated decision-making

We do not make any automated decisions about you as a candidate. Even if we use some degree of automation in the recruitment process (such as candidate screening software), recruitment decisions are never based solely on automated processing. There is always a human decision-maker involved in every step of the recruitment process.

9. Your rights as a data subject

You have the following rights as a data subject:

The right to receive information about the processing of your personal data and gain access to your personal data (GDPR Art 15);
The right to request the rectification of incorrect personal data (GDPR Art 16);
The right to demand the erasure of data under the conditions set out in Article 17 of the GDPR;
The right to request restriction of personal data processing (GDPR Art 18);
The right to data portability (GDPR Art 20);
The right to object at any time to the processing of your personal data (GDPR Art 21);
The right to withdraw consent given for the processing of personal data at any time by sending a written request to Clevon (GDPR Art 7 (3));
The right to file a complaint with a supervisory authority (GDPR Art 77).

10. Exercise of rights and contact

To get more information about data processing, to exercise your rights or to file a complaint, please feel free to contact Clevon at legal@clevon.com.