EN Privacy Policy

1. DEFINITIONS

1.1. Personal Data - User Data, Access Data, Technical Data, Communication Data, and Cookie Data shall be understood as personal data as stipulated in the General Data Protection Regulation 2016/679 of the European Parliament and of the Council (“Regulation 2016/679”).

1.2. User Data – any and all data relating to the User entered by the latter in the Database, including those entered in the registration form, the data entered in the Database in CV form and other data processed by CV-Online in relation to the User. User Data includes but is not limited to: date of birth, gender, mother tongue, job status, education, phone number, country of residence.

1.3. Access Data– User Data provided by the User himself/herself, containing the username and password chosen by the User when registering as a User or later changed by the User in the Database. Access Data also includes User Data received from third-party service providers (for example, LinkedIn, Facebook, Google) the User has chosen to register or log in with, including but not limited to: User’s name, profile picture, age range, gender, e-mail, previous job experience, and other publicly available profile data.

1.4. Technical Data – User Data generated and collected automatically from User’s device used to reach the Website, including but not limited to: IP address (including location based on the IP address), access-provider, referring URL, date, time, access tokens, browser type and version, operating system, amount and state of transferred data, location data.

1.5. Communication Data - data the User provides to CV-Online during any correspondence exchanged between the User and CV-Online via electronic means (for example via Website, e-mails) including but not limited to: User’s name, e-mail, contents of the message.

1.6. Cookie Data – the User’s personal data collected by the cookies used on the Website.

1.7. Website – the web-based environment created for providing Services related to the mediation of jobseekers and employers, as administered by CV-Online at the address www.cv.lv.

2. PROCESSING OF PERSONAL DATA BY CV-ONLINE

2.1. The controller of the User’s Personal Data processed for the purposes of providing the Service in compliance with this Privacy policy, is CV-Online.

2.2. CV-Online processes the following categories of User’s Personal Data: User Data, Access Data, Communication Data, Technical Data and Cookie Data.

2.3. CV-Online’s legal basis for processing the User’s Personal Data depends on the objective and context in which CV-Online collects the Personal Data. CV-Online processes the User’s Personal Data on the following four legal grounds: performance of a legal obligation, performance of the Terms and Conditions, CV-Online’s legitimate interest or the User’s consent.

2.4. If the legal basis for processing the User’s Personal Data is:

2.4.1. legitimate interest, then this means first and foremost the objective and legitimate interest of providing the Services and essential functionalities of the Website;

2.4.2. consent, then this means first and foremost the objective of ensuring an effective user experience by adjusting content, as without the User’s consent it would not be possible to tailor the Website and the Services to meet User’s preferences;

2.4.3. performance of the Terms and Conditions, then this means first and foremost the objective of providing and fulfilling the obligations in regard to the provision of the Services;

2.4.4. compliance with an obligation arising from legislation, then this means first and foremost that CV-Online is required to process certain User Data as required by law. In this case CV-Online cannot decide which data are collected and processed, as it derives from applicable laws.

2.5. The following depicts a descriptive list of processing purposes that are linked to specific data categories and legal basis for processing:

2.6. Please note that the respective employer to whom the User agrees to transmit his/her Personal Data is a separate data controller in respect of the Personal Data. The employer shall process User’s personal data in the manner and for the purposes of which it has informed the User separately.

2.7. CV-Online may process User’s data for other purposes, provided that CV-Online discloses the purposes to the User at the relevant time, and that the User either agrees to the proposed use of the Personal Data or legal grounds exists or if the new purpose is compatible with the original purpose brought out herein.

2.8. Please note that in the course of Services, CV-Online might analyse the User’s User Data to build individual profiles. These profiles will be used to predict suitable Data Recipients that match the User’s profile and needs. The profiling is based on User’s preferences and requirements set in the User Data. CV-Online expects that the profiling will have no extensive impact other than providing the User with a more customised and pleasant user experience whilst using CV-Online’s Services.

2.9. CV-Online would like to emphasise that the submission of User Data and Access Data is an obligation arising from the Terms and Conditions and the failure to submit them or the request that their processing be terminated or restricted may render it impossible for CV-Online to provide the Services to the User pursuant to the Terms and Conditions. If the User files a respective request with regard to the processing of his/her User Data, CV-Online shall be entitled to suspend the provision of the Services to the User and to delete the User’s account along with any and all data related thereto. In the respective case, the User may also apply that his/her account and any and all data related thereto be deleted.

2.10. User’s Personal Data shall be stored insofar as reasonably necessary to attain the objectives stated in Section 2.5. of the Terms and Conditions, unless stipulated otherwise in applicable laws.

2.11. After the term mentioned in Section 2.10. of the Terms and Conditions, CV-Online will delete User’s respective data immediately, except as noted below:

2.11.1. CV-Online has the right to retain the Access Data and User Data after the User has requested to delete his/her account for the purposes of enforcing the Terms and Conditions, presenting, resolving, mitigating and defending any claims and disputes related to the User and in relation to the activities related to the respective User’s account, however, in ordinary circumstances this retention period shall not exceed 3 years;

2.11.2. CV-Online retains the User’s Personal Data for a longer period if it is necessary to comply with the CV-Online’s legal obligations and meet regulatory requirements;

2.11.3. CV-Online may anonymize User’s data and retain this anonymized information indefinitely.

2.12. CV-Online does not communicate User Data to any third parties except in the following instances:

CV-Online may transfer Personal Data to third party service providers who act as data processors and may operate the technical infrastructure that CV-Online needs to host, store manage and maintain the Services, its contents and the data that CV-Online processes, also to provide data backup and security.

Please see the list of the categories of the processors used by CV-Online:

• Cloud / infrastructure host,

• Software development partner,

• E-mail service provider,

• Client Relationship Management tool provider,

• Authentication service provider.

2.13. Please note that some service providers might be located outside the EU/EEA, thus CV-Online may transfer User’s Personal Data outside the EU/EEA (including the whole Database) (e.g, Google Analytics cookie service). In such cases CV-Online shall opt to use special personal data protection safeguards, in order to ensure the safety of User’s Personal Data. For instance, if your data is transferred to countries outside the EU/EEA, CV-Online guarantees an appropriate level of protection by using the available transfer tools, such as EU adequacy decision, standard contractual clauses, binding corporate rules, derogations or other tools and/or supplementary measures appropriate for particular transfer.

The Users have the right to get acquainted with or obtain information on the transferring of their Personal Data outside the EU/EEA by contacting CV-Online using the contact information specified in Section 1.1. of the Terms and Conditions.

COOKIE DATA PROCESSING

2.14. Cookies are small text files that are generated automatically by your browser and stored on your device (e.g. laptop, tablet, smartphone) when you visit the Website. The information generated by the connection to the specific device used is stored in a cookie. This does not mean that CV-Online can directly identify you.

2.15. CV-Online uses the following cookies:

Necessary cookies help make a Website usable by enabling basic functions like page navigation and access to secure areas of the Website. The Website cannot function properly without these cookies.

Preference cookies enable a Website to remember information that changes the way the Website behaves or looks, like your preferred language or the region that you are in.

Statistic cookies help Website owners to understand how visitors interact with Websites by collecting and reporting information anonymously.

Marketing cookies are used to track visitors across Websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

Most browsers automatically accept cookies. You can adjust your browser settings so that no cookies are stored on your device, or a notification will appear on your device each time you set a cookie. However, completely deactivating cookies may result in you not being able to take full advantage of all the features of CV-Onlines’ Website.

Read more about the cookie data processed by CV-Online:

2.16. The User has the following data protection rights, which can be exercised by contacting CV-Online via contact information referred to in Section 1.1. of the Terms and Conditions, the User has the right to:

2.16.1. request that CV-Online provides information as to which User Data CV-Online is processing with respect to him/her and request that User Data is supplemented, corrected or replaced if the User is unable to exercise these rights in the manner provided in Section 2.6. of the Terms and Conditions.

2.16.2. request deletion of the User Data and termination of any further processing;

2.16.3. request restrictions to the processing of the User Data or file objections to the processing of the User Data if the processing is based on

CV-Online’s legitimate interest;

2.16.4. file complaints to the respective supervisory authority with regard to the processing of the User Data if the User finds that his/her rights are violated;

2.16.5. not be subject to a decision based solely on automated decision making, including profiling, where the decision would have a legal effect on the User or produce a significant effect;

2.16.6. withdraw the User’s consent to the processing of the Personal Data in the cases where the legal basis for the Personal Data processing is the User’s consent. For withdrawing consent, the User may use the contact information referred to in Section 1.1. of the Terms and Conditions;

2.16.7. exercise their right to the portability of the User Data pursuant to Article 20 of Regulation 2016/679.

2.17. The User has the right to communicate with CV-Online’s data protection officer in order to obtain information on the processing of his/her Personal Data, using the following contact information: Vesse Vesiaid, e-mail: vesse@cv.ee.

3. PRIVACY STATEMENT

3.1. For the provision of the Services to the Customer, CV-Online is processing the personal data of the following data subjects: Customer’s representatives/employees whose personal data is processed while registering for the Services and while providing the Services.

3.1.1. CV-Online as the data controller has the right to share the personal data of customers with third parties, such as authorized data processors, accountants, transport and courier companies, companies providing transfer services. The data controller forwards the personal data necessary for making payments to the authorized processor Maksekeskus AS (Niine 11, Tallinn 10414, Estonia, reg. nr.:12268475).

3.2. The Customer is aware that it, as a legal entity, is considered to be a data controller regarding its employees, management board members and other natural persons who represent the Customer and through whom the Customer is entitled to use the Service.

3.3. Therefore, the Customer is required to provide to the foregoing persons all the relevant notices and/or obtain all necessary consents, or ensure the existence of other legal grounds, for the processing of the said personal data by CV-Online for providing the Service to the Customer.

3.4. In case, despite the correct fulfilment of the obligations by the Customer as stated in Section 5.3 above, CV-Online is considered to be a data controller regarding the Customer’s representatives/employees whose personal data is processed while registering for the Services and while providing the Services, CV-Online hereby, in this privacy statement (the “Privacy Statement”), informs the affected natural person of the processing of his/her personal data (the “Affected Person”). The Customer is obliged to make the information presented herein known to the Affected Person.

3.5. CV-Online processes the Affected Person’s personal data only for the preparation, execution and ensuring the execution of the Terms and Conditions, as concluded with the Customer, and for the provision of the Services to the Customer. CV-Online may also process the personal data of the Affected Person for: (i) commencing any legal actions against, or defending itself against any legal actions by, the Affected Person or the Customer; and (ii) for providing and administering the Services.

3.6. All the processing activities for the purposes described under Section 3.5 are done under the legitimate interest of CV-Online and the Customer. The legitimate interests of the Customer and CV-Online are to ensure the fulfilment of the Terms and Conditions, enforcing any rights deriving from applicable legislation and to enable direct and clear communication between the Customer and CV-Online via the Affected Person, taken into account the position of the Affected Person in the Customer’s organization.

3.7. The personal data of the Affected Person may be accessible to the sub-processors of CV-Online, who are used for the provision of the Service.

3.8. The provision of the personal data by the Affected Person is not mandatory, however, not presenting such data affects CV-Online’s possibility to conclude the Terms and Conditions with the Customer, meaning, that CV-Online is not able to provide the Services to the Customer, which may result the Affected Person facing legal or other consequences on behalf of the Customer.

3.9. Under the applicable legislation, the Affected Person has the right to request the following rights to be exercised by CV-Online: the right to request access to the personal data and rectification or erasure of personal data or restriction of processing concerning the Affected Person or to object to the processing of the personal data and to lodge a complaint to the respective supervisory authority. The Affected Person takes note that he/she may be limited in exercising of the foregoing rights, as described under applicable legislation.

3.10. As the personal data regarding the Affected Person is processed in relation to the documentation of the Terms and Conditions and any legal claims which may arise from the foregoing, then the personal data of the Affected Person is processed as long as the foregoing documentation is retained, and any legal claims are expired under applicable legislation. The Agreement and any related documentation is retained for a period of maximum 10 years, taken into account the expiration of the possible legal claims.

4. THE PROCESSOR AND CONTROLLER OF THE PERSONAL DATA AND SPECIFICATION OF PERSONAL DATA

4.1. Depending on which of the Services the Customer will use, the data processing roles of the Customer and CV-Online are defined as follows:

4.1.1. The Ad Service: For the purposes of finding a suitable employee via the Ad Service, the Customer is the data controller and CV-Online is the data processor of the processing activities regarding the personal data of job seekers, who have applied to the vacancies published by the Customer.

For the purposes of providing the Ad Service, CV-Online, as the data processor, will process the personal data of job seekers only to the extent it is necessary for transmitting the job applications via the processor’s systems to the controller’s possession.

The Customer, as a data controller, is required to ensure that it will fulfil, in relation to the relevant job-seeker, all the necessary notification and other requirements, deriving from the applicable data protection legislation, including the need to ensure the existence of relevant legal grounds for the processing of the job seeker’s personal data by the Customer. The Customer shall take note that in case the applicant is a registered and logged in job seeker his/her personal data which has been transmitted to the Customer, may be processed by CV-Online for other purposes which derive from the agreement concluded between CV-Online and the job seeker.

In order to provide the Ad Service, CV-Online processes job seekers’ personal data that does not belong to the special categories of personal data and which comprises of personal data, made available to CV-Online by the job seeker, including but not limited to: e-mail address, full name, phone number, and other personal data provided in job seeker’s CV whilst applying for a specific position. CV-Online shall process the personal data for which the Customer is the controller while providing the Ad Service, and also after that, if it is required by applicable laws, for the purposes and to the extent stipulated herein.

4.1.2. The Database Service: For the purposes of finding a suitable employee via the Database Service, the Customer is a separate data controller from CV-Online regarding the personal data of the active job seekers, whom CVs are displayed in the Database.

For the purposes of providing the Database Service, CV-Online is processing the personal data of all job seekers registered with CV-Online via the Website. Regarding the said job seekers’ personal data, CV-Online is deemed to be a data controller (a separate one from the Customer). CV-Online, as a controller is processing the job seekers’ personal data under a separate agreement concluded between CV-Online and the job seeker.

CV-Online grants the access to the Database for the Customer only for employment-related purposes. The Customer is aware and acknowledges that it, as a data controller, takes full responsibility for the processing of any personal data contained in the Database for any purposes and through any means the Customer has foreseen.

4.1.3. The Services: In case the Customer wishes to access the Services, then, if the Services consist of the Ad Service and the Database Service, the Customer is deemed to be a data controller and CV-Online is deemed to be data processor in regard to the Ad Service and the Customer and CV-Online are considered to be independent data controllers in regard to the Database Service. The respective purposes and scope are defined in Sections 4.1.1. and 4.1.2. of these Terms and Conditions.

4.2. In the context of services mentioned in Sections 4.1.1.-4.1.3., the Customer as a controller, is required to ensure that it will fulfil, in relation to the relevant job seekers, all the necessary notification and other requirements, deriving from the data protection legislation, including the need to ensure the existence of relevant legal grounds for the processing of the job seeker’s personal data.

PRIVACY POLICY