PRIVACY NOTICE FOR TALENTS
Last update: 27-february-2020
We are Jobbatical OÜ, an Estonian company with registry code 12671900 (Jobbatical, we, us and our). We operate an online platform at www.jobbatical.com (the Website) to provide certain services relating to relocation of candidates (the Talents) from one country to the place of employment in another country (the Services).
The term “Talent” or “you” refers to a natural person who has accepted our Terms of Service (the Terms).
The EU General Data Protection Regulation (GDPR) aims at protecting individuals from violations of their personal privacy in connection with the processing of their personal data. Jobbatical is committed to protect your privacy when processing your personal data.
The purpose of this privacy notice (the Privacy Notice) is to provide information on how Jobbatical processes your personal data in connection with the Services as data controller. The terms used in the Privacy Notice are used in the meaning given to them in Article 4 of the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
1. WHY WE PROCESS PERSONAL DATA AND WHAT PERSONAL DATA DO WE PROCESS?
1.1. We process personal data to enable Services to you (Talent) provided via our Website and/or to enable Services to your employer to whom you have granted a consent to process your personal data in relation to the Services (the Employer).
1.2. We process personal data that is submitted to us directly by you or by your Employer via email or forms provided on the Website.
1.3. Personal data we process may include following data about you:
1.3.1. general personal information: name,nationality, personal identity number, gender, marital status, educational qualifications
1.3.2. identification data: photographs, copies of ID documents (such as passport)
1.3.3. contact details: address, phone number, email address, bank details
1.3.4. employment data: resume, date of employment, position, salary information, information regarding bonus, benefits, other employment documentation, rehabilitation matters, information on entry and exit at the work place
1.3.5. family data: data about family members who are subject to Services
1.3.6. other: any other information that you, your Employer and any other person, as applicable, submit to us.
1.4. You can see all data that we process about you and that we have collected about you on the Website under your profile after logging in with the log in credentials provided to you by us.
2. WHAT IS THE LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA?
2.1. We process your personal data to fulfil our duties under the Agreement concluded between us and your Employer and under the Agreement concluded between you and us (please read Terms of Services for using our Website and the Services) (legal basis: GDPR Article 6-1-(c)).
2.2. In certain specific situations we might also process your personal data where processing your personal data is necessary for the purpose of our legitimate interests pursued by us (legal basis: GDPR Article 6-1-(f)). In such a case we shall ensure that processing is proportionate and that we have carried out legitimate interest impact assessment.
2.3. In certain specific situations we may also process your personal data based on your consent (GDPR Article 6-1-(a)). In those situations, we process your personal data on the terms as provided in the consent that you have granted to us.
3. WHEN DO WE SHARE YOUR PERSONAL DATA?
3.1. To the extent this is necessary for the provision of our Services, we may share your personal data with certain authorities, agencies or other third parties. For example, we may share your personal data with following parties in following situations:
3.1.1. with police (in Estonia Police and Border Guard Board) when it is necessary for applying for documents, such as residence permit to work in a country of your destination or for applying for other required documentation
3.1.2. embassies in the country of your residence, in your home country or in your destination country
3.1.3. state registers such as population registry
3.1.4. state authorities, such as tax authority
3.1.5. banks, for example to help creating a bank account
3.1.6. family doctor or other health care providers, for example to find a suitable service provider for you
3.1.7. Kindergartens and schools, for example if part of the Services includes relocation services concerning your family
3.1.8. your Employer.
3.2. You can ask for the overview of specific third parties with whom your data has been shared and what personal data has been shared with each party from your Jobbatical agent, from your employer or by contacting Jobbatical on the contact details indicated in clause 9 below.
3.3. We may also share your personal data with third party suppliers providing services to us, e.g. IT suppliers. At the moment of adopting this Privacy Notice, we use the following service providers:
3.3.2. We use Google Cloud Storage provided by Google Commerce Limited ("GCL"), a company incorporated under the laws of Ireland, with offices at Gordon House, Barrow Street, Dublin 4, Ireland. Please visit https://cloud.google.com/terms/ for Google Cloud Storage terms and https://cloud.google.com/terms/data-processing-terms for data processing terms
3.4. We may also transfer your personal data to third countries, i.e. countries outside the EU/EEA area, for the purposes explained above in clause 3.1. When transferring your personal data to third countries, we will ensure that the transfer is subject to appropriate safeguards and that your rights are protected.
4. HOW LONG IS YOUR PERSONAL DATA RETAINED?
Personal data related to contracts can be retained during the term of the contract and based on our legitimate interest pursuant to Article 6 (1) (f) of the GDPR until the end of the statutory limitation periods under applicable law. Accordingly, Jobbatical processes your personal data as long as it is necessary for the provision of the Services. If you have not used our Website for 3 years (you have not logged in to your profile on our Website for 3 years), your profile and all personal data therein will be deleted, unless we have a legal basis for retaining your personal data for a longer time period.
5. HOW DO WE PROTECT YOUR PERSONAL DATA?
To protect your personal data from unauthorized access, unlawful processing or disclosure, accidental loss, modification or destruction, we use appropriate technical and organisational measures that comply with applicable laws. These measures include but are not limited to the implementation of appropriate computer security systems, protection of paper and electronic format files by technical and logical means, controlling and limiting access to documents and buildings.
6.3. We use session cookies on our website that are temporary cookies which only exist during the time you use the website (or more strictly, until you close the browser after using the website). Session cookies help our websites remember what you chose on the previous page, avoiding the need to re-enter information.
6.5. You can delete or block cookies on the Website through your browser settings at any time. However, some cookies might be necessary for the functionality of the Website. Therefore, you understand that when blocking or deleting the cookies some features of the Website might not function correctly. For more general information about cookies including the difference between session and persistent cookies please see www.allaboutcookies.org.
6.6. Your continuing use of the Website stipulates your acceptance to using cookies.
7. YOUR RIGHTS
7.1. Jobbatical is dedicated ensuring that all data subject rights arising under applicable law are always guaranteed to you. In particular, any data subject has:
7.1.1. the right to access the personal data that Jobbatical processes about you
7.1.2. the right to request that Jobbatical rectifies any inaccurate personal data about you
7.1.3. the right to request Jobbatical to erases your personal data and/or restricts of processing of your personal data if we do not have valid legal basis for processing
7.1.4. the right to receive your processed personal data in a structured, commonly used and machine-readable format and have the right to transmit your personal data to another controller
7.1.5. the right to object to the processing of your personal data.
7.2. If you believe that your rights have been infringed, you may contact and lodge a complaint to the supervisory authority applicable for your jurisdiction (Data Protection Inspectorate in Estonia address Tatari 39, Tallinn 10134, www.aki.ee, [email protected] or other competent authority in your jurisdiction).
8. GOVERNING LAW AND JURISDICTION
9. CONTACT DETAILS AND NOTICES