PRIVACY POLICY

1. DEFINITIONS


1.1. Personal Data - User Data, Access Data, Technical Data, Communication Data, and Cookie Data shall be understood as personal data as stipulated in the General Data Protection Regulation 2016/679 of the European Parliament and of the Council (“Regulation 2016/679”).

1.2. User Data – any and all data relating to the User entered by the latter in the Database, including those entered in the registration form, the data entered in the Database in CV form and other data processed by CV-Online in relation to the User. User Data includes but is not limited to: date of birth, gender, mother tongue, job status, education, phone number, country of residence.

1.3. Access Data– User Data provided by the User himself/herself, containing the username and password chosen by the User when registering as a User or later changed by the User in the Database. Access Data also includes User Data received from third-party service providers (for example, LinkedIn, Facebook, Google) the User has chosen to register or log in with, including but not limited to: User’s name, profile picture, age range, gender, e-mail, previous job experience, and other publicly available profile data.

1.4. Technical Data – User Data generated and collected automatically from User’s device used to reach the Website, including but not limited to: IP address (including location based on the IP address), access-provider, referring URL, date, time, access tokens, browser type and version, operating system, amount and state of transferred data, location data.

1.5. Communication Data - data the User provides to CV-Online during any correspondence exchanged between the User and CV-Online via electronic means (for example via Website, e-mails) including but not limited to: User’s name, e-mail, contents of the message.

1.6. Cookie Data – the User’s personal data collected by the cookies used on the Website.

1.7. Website – the web-based environment created for providing Services related to the mediation of jobseekers and employers, as administered by CV-Online at the address www.cv.lv.


2. PROCESSING OF PERSONAL DATA BY CV-ONLINE


2.1. The controller of the User’s Personal Data processed for the purposes of providing the Service in compliance with this Privacy policy, is CV-Online.

2.2. CV-Online processes the following categories of User’s Personal Data: User Data, Access Data, Communication Data, Technical Data and Cookie Data.

2.3. CV-Online’s legal basis for processing the User’s Personal Data depends on the objective and context in which CV-Online collects the Personal Data. CV-Online processes the User’s Personal Data on the following four legal grounds: performance of a legal obligation, performance of the Terms and Conditions, CV-Online’s legitimate interest or the User’s consent.

2.4. If the legal basis for processing the User’s Personal Data is:

2.4.1. legitimate interest, then this means first and foremost the objective and legitimate interest of providing the Services and essential functionalities of the Website;

2.4.2. consent, then this means first and foremost the objective of ensuring an effective user experience by adjusting content, as without the User’s consent it would not be possible to tailor the Website and the Services to meet User’s preferences;

2.4.3. performance of the Terms and Conditions, then this means first and foremost the objective of providing and fulfilling the obligations in regard to the provision of the Services;

2.4.4. compliance with an obligation arising from legislation, then this means first and foremost that CV-Online is required to process certain User Data as required by law. In this case CV-Online cannot decide which data are collected and processed, as it derives from applicable laws.

2.5. The following depicts a descriptive list of processing purposes that are linked to specific data categories and legal basis for processing:


Categories of Personal Data used by CV-Online as controller for the processing purpose

Legal basis for the processing purpose

Processing purpose

Legitimate interest in providing (data) security and prevent fraudulent actions

Diagnosing and repairing problems with the Services, the Database and the Website

Technical data

Legitimate interest in providing effective client communications and the Services itself.

Performance of the Terms and Conditions, as depending on the content and purpose of the communication

Enabling communication between the User and CV-Online

Communication Data, Technical Data

Legitimate interest in providing basic functionalities of the Website and the Database

Providing the functioning and accessibility to the Website and to the Database

Technical Data, Cookie Data

1) Legitimate interest in developing and enhancing the Website and the user experience in the course of regular business activities (if CV-Online process necessary cookies) or

2) a Consent (if CV-Online process reference, statistic or marketing cookies)


Improving, personalising and developing the Service and the Website

Technical Data, Cookie Data

Performance of the Terms and Conditions

Verifying the User’s identity

Access Data

Providing the Service and enabling access to the Database

Access Data, Technical Data, User Data, Communication Data

Performance of the Terms and Conditions

Performing sales analysis and identifying marketing opportunities and strategies

Consent for the purposes of promoting CV-Online and enhancing business opportunities

Technical Data, Cookie Data

Tailoring the contents of the Website and general communication to suit the User’s preferences

Consent

Technical Data, certain Cookie Data

Making the User’s CV accessible to registered Data Recipients of the Website with the objective of performing a trial search

Consent

User Data

Legitimate interest in providing the Services more effectively and ensuring a more positive impact for the employment-prospects of the User

Profiling for the purposes of mediating the User and a suitable employer pursuant to the metrics/means automated decision making

User Data; Cookie Data

Notifying the User of the Services, opportunities and news of CV-Online and its partners via the e-mail address entered when registering via the Website

Consent

User Data

Notifying the User via e-mail of new job offers that meet the conditions set out by the User or in the User’s CV

Consent

User Data

Legitimate interest in providing the Services more effectively and ensuring a more positive impact for the employment-prospects of the User

Asking User whether they received feedback from the Data Recipient to whose job the User applied to

User Data

Forwarding User’s application data to the Data Recipient who posted the job advertisement

Performance of the Terms and Conditions

User Data

Performance of the Terms and Conditions.

Performance of a legal obligation (e.g. GDPR). Legitimate interest in developing and enhancing the Website and the user experience in the course of regular business activities.


Deleting (potentially) erroneous and/or incorrect User Data

User Data

Consent for ensuring business continuity and enabling the onboarding of different investors

User Data, Access Data, Technical Data, Communication Data, Cookie Data

Selling CV-Online’s business operations or for onboarding investors

2.6. Please note that the respective employer to whom the User agrees to transmit his/her Personal Data is a separate data controller in respect of the Personal Data. The employer shall process User’s personal data in the manner and for the purposes of which it has informed the User separately.

2.7. CV-Online may process User’s data for other purposes, provided that CV-Online discloses the purposes to the User at the relevant time, and that the User either agrees to the proposed use of the Personal Data or legal grounds exists or if the new purpose is compatible with the original purpose brought out herein.

2.8. Please note that in the course of Services, CV-Online might analyse the User’s User Data to build individual profiles. These profiles will be used to predict suitable Data Recipients that match the User’s profile and needs. The profiling is based on User’s preferences and requirements set in the User Data. CV-Online expects that the profiling will have no extensive impact other than providing the User with a more customised and pleasant user experience whilst using CV-Online’s Services.

2.9. CV-Online would like to emphasise that the submission of User Data and Access Data is an obligation arising from the Terms and Conditions and the failure to submit them or the request that their processing be terminated or restricted may render it impossible for CV-Online to provide the Services to the User pursuant to the Terms and Conditions. If the User files a respective request with regard to the processing of his/her User Data, CV-Online shall be entitled to suspend the provision of the Services to the User and to delete the User’s account along with any and all data related thereto. In the respective case, the User may also apply that his/her account and any and all data related thereto be deleted.

2.10. User’s Personal Data shall be stored insofar as reasonably necessary to attain the objectives stated in Section 2.5. of the Terms and Conditions, unless stipulated otherwise in applicable laws.

2.11. After the term mentioned in Section 2.10. of the Terms and Conditions, CV-Online will delete User’s respective data immediately, except as noted below:

2.11.1. CV-Online has the right to retain the Access Data and User Data after the User has requested to delete his/her account for the purposes of enforcing the Terms and Conditions, presenting, resolving, mitigating and defending any claims and disputes related to the User and in relation to the activities related to the respective User’s account, however, in ordinary circumstances this retention period shall not exceed 3 years;

2.11.2. CV-Online retains the User’s Personal Data for a longer period if it is necessary to comply with the CV-Online’s legal obligations and meet regulatory requirements;

2.11.3. CV-Online may anonymize User’s data and retain this anonymized information indefinitely.

2.12. CV-Online does not communicate User Data to any third parties except in the following instances:


Categories of Recipients

Reason for sharing

As described in these Terms and Conditions, the User can make his/her Personal Data accessible to the Data Recipients by choosing such account settings via the Database, thus making the User Data accessible or visible; any other sharing is being done on the basis of the User’s own activity whereby the User requests to send certain User Data to the Data Recipients in the course of a job-application process.

Data Recipients

Only if CV-Online is under a duty to disclose or share User’s Personal Data in order to comply with any legal obligation (for example, if required to do so under applicable law, by a court order or for the purposes of prevention of fraud or other crime).

Law enforcement and data protection authorities

Operational service providers (legal advisors, auditors etc. bound to confidentiality)

Ensuring adequate performance of the website and the Service and functioning thereof; enforcing the Terms and Conditions.

Third parties in the context of selling

CV-Online’s business operations or for onboarding investors

For ensuring business continuity and enabling the onboarding of different investors.

CV-Online may transfer Personal Data to third party service providers who act as data processors and may operate the technical infrastructure that CV-Online needs to host, store manage and maintain the Services, its contents and the data that CV-Online processes, also to provide data backup and security.

Please see the list of the categories of the processors used by CV-Online:


• Cloud / infrastructure host,

• Software development partner,

• E-mail service provider,

• Client Relationship Management tool provider,

• Authentication service provider.

Authorised processors

Group companies:

  • Alma Media Corporation, registered address: Alma House, Alvar Aallon katu 3 C, FI-00100, Helsinki;
  • CV-Online Latvia SIA, registered address: Baznicas iela 20/22-30, Riga;
  • CV-Online Estonia OÜ, registered address: Parnu mnt 158/1, 11317 Tallin;
  •  CV-Online LT, UAB, registered address: Svitrigailos g. 11B, 03228, Vilnius

Cost optimisation and general business management

2.13. Please note that some service providers might be located outside the EU/EEA, thus CV-Online may transfer User’s Personal Data outside the EU/EEA (including the whole Database) (e.g, Google Analytics cookie service). In such cases CV-Online shall opt to use special personal data protection safeguards, in order to ensure the safety of User’s Personal Data. For instance, if your data is transferred to countries outside the EU/EEA, CV-Online guarantees an appropriate level of protection by using the available transfer tools, such as EU adequacy decision, standard contractual clauses, binding corporate rules, derogations or other tools and/or supplementary measures appropriate for particular transfer.

The Users have the right to get acquainted with or obtain information on the transferring of their Personal Data outside the EU/EEA by contacting CV-Online using the contact information specified in Section 1.1. of the Terms and Conditions.


COOKIE DATA PROCESSING


2.14. Cookies are small text files that are generated automatically by your browser and stored on your device (e.g. laptop, tablet, smartphone) when you visit the Website. The information generated by the connection to the specific device used is stored in a cookie. This does not mean that CV-Online can directly identify you.

2.15. CV-Online uses the following cookies:


Necessary cookies help make a Website usable by enabling basic functions like page navigation and access to secure areas of the Website. The Website cannot function properly without these cookies.


Preference cookies enable a Website to remember information that changes the way the Website behaves or looks, like your preferred language or the region that you are in.


Statistic cookies help Website owners to understand how visitors interact with Websites by collecting and reporting information anonymously.


Marketing cookies are used to track visitors across Websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.


Most browsers automatically accept cookies. You can adjust your browser settings so that no cookies are stored on your device, or a notification will appear on your device each time you set a cookie. However, completely deactivating cookies may result in you not being able to take full advantage of all the features of CV-Onlines’ Website.


Read more about the cookie data processed by CV-Online:


Cookie

Domain

Type

Description

Duration

This cookie is set by Facebook to deliver advertisment when they are in Facebook or a digital platform powered by Facebook advertising after visiting this website.

_fbp

.cv.lv

Advertisment

3 months

This is set by Hotjar to identify a new user`s first session. It stores a true/false value, indicating whether this was the first time Hotjar saw this user. It is used by Recording filters to identify new user sessions.

_hjFirstSeen

.cv.lv

Analytics

30 minutes

This cookie is installed by Google Analytics, where the pattern elemeent on the name contains thee unique identify number of the account or website it relates to. It appears to be variation of the _gat cookie with is used to limit the amount of data recovered by Google on high traffic volume websites.

_ga

.cv.lv

Analytics

2 years

This cookie is installed by Google Analytics. The cookie is used to store user information of how visitors use a website and helps in creating an analytics report of how the website doing. The data collected including the nummber visitors, the source where they have come from, and the pages visited in and anonymous form.

_gid

.cv.lv

Analytics

1 day

This is a pattern type cookie set by Google Analytics, where the pattern element on the name contains the unique identify number of a account or website it relates to. It appears to be variation of the _gat cookie witch is used to limit the amount of data recovered by Google on high traffic volume websites.

_gat_UA-8200891-1

.cv.lv

Analytics

1 minute

This cookie is used to store the language preferences of a user to serve up content in that stored language the next time user visit the website.

lang

.ads.linkedn.com

Functional

session

This cookie is set by linkedin. The purpose of the cookie is to enable LinkedIn functionalities on the page.

bcookie

.linkedin.com

Functional

2 years

lidc

.linkedin.com

Functional

This cookie is set by LinkedIn and used for routing.

1 day

This cookie is set by Hotjar. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to parsist the random user ID, unique to that site on the browser. This ensures that behavior in subseqent visits to the same site will bee attributed to the same user ID.

_hjid

.cv.lv

Other

1 year

_hjlncludedlnPageviewSample

.cv.lv

Other

No description

2 minutes

_hjAbsoluteSessionlnProgress

.cv.lv

Other

No description

30 minutes

_hjlncludedlnSessionSample

.cv.lv

Other

No description

2 minutes

2.16. The User has the following data protection rights, which can be exercised by contacting CV-Online via contact information referred to in Section 1.1. of the Terms and Conditions, the User has the right to:

2.16.1. request that CV-Online provides information as to which User Data CV-Online is processing with respect to him/her and request that User Data is supplemented, corrected or replaced if the User is unable to exercise these rights in the manner provided in Section 2.6. of the Terms and Conditions.

2.16.2. request deletion of the User Data and termination of any further processing;

2.16.3. request restrictions to the processing of the User Data or file objections to the processing of the User Data if the processing is based on

CV-Online’s legitimate interest;

2.16.4. file complaints to the respective supervisory authority with regard to the processing of the User Data if the User finds that his/her rights are violated;

2.16.5. not be subject to a decision based solely on automated decision making, including profiling, where the decision would have a legal effect on the User or produce a significant effect;

2.16.6. withdraw the User’s consent to the processing of the Personal Data in the cases where the legal basis for the Personal Data processing is the User’s consent. For withdrawing consent, the User may use the contact information referred to in Section 1.1. of the Terms and Conditions;

2.16.7. exercise their right to the portability of the User Data pursuant to Article 20 of Regulation 2016/679.

2.17. The User has the right to communicate with CV-Online’s data protection officer in order to obtain information on the processing of his/her Personal Data, using the following contact information: Vesse Vesiaid, e-mail: vesse@cv.ee.


3. PRIVACY STATEMENT


3.1. For the provision of the Services to the Customer, CV-Online is processing the personal data of the following data subjects: Customer’s representatives/employees whose personal data is processed while registering for the Services and while providing the Services.

3.1.1. CV-Online as the data controller has the right to share the personal data of customers with third parties, such as authorized data processors, accountants, transport and courier companies, companies providing transfer services. The data controller forwards the personal data necessary for making payments to the authorized processor Maksekeskus AS (Niine 11, Tallinn 10414, Estonia, reg. nr.:12268475).

3.2. The Customer is aware that it, as a legal entity, is considered to be a data controller regarding its employees, management board members and other natural persons who represent the Customer and through whom the Customer is entitled to use the Service.

3.3. Therefore, the Customer is required to provide to the foregoing persons all the relevant notices and/or obtain all necessary consents, or ensure the existence of other legal grounds, for the processing of the said personal data by CV-Online for providing the Service to the Customer.

3.4. In case, despite the correct fulfilment of the obligations by the Customer as stated in Section 5.3 above, CV-Online is considered to be a data controller regarding the Customer’s representatives/employees whose personal data is processed while registering for the Services and while providing the Services, CV-Online hereby, in this privacy statement (the “Privacy Statement”), informs the affected natural person of the processing of his/her personal data (the “Affected Person”). The Customer is obliged to make the information presented herein known to the Affected Person.

3.5. CV-Online processes the Affected Person’s personal data only for the preparation, execution and ensuring the execution of the Terms and Conditions, as concluded with the Customer, and for the provision of the Services to the Customer. CV-Online may also process the personal data of the Affected Person for: (i) commencing any legal actions against, or defending itself against any legal actions by, the Affected Person or the Customer; and (ii) for providing and administering the Services.

3.6. All the processing activities for the purposes described under Section 3.5 are done under the legitimate interest of CV-Online and the Customer. The legitimate interests of the Customer and CV-Online are to ensure the fulfilment of the Terms and Conditions, enforcing any rights deriving from applicable legislation and to enable direct and clear communication between the Customer and CV-Online via the Affected Person, taken into account the position of the Affected Person in the Customer’s organization.

3.7. The personal data of the Affected Person may be accessible to the sub-processors of CV-Online, who are used for the provision of the Service.

3.8. The provision of the personal data by the Affected Person is not mandatory, however, not presenting such data affects CV-Online’s possibility to conclude the Terms and Conditions with the Customer, meaning, that CV-Online is not able to provide the Services to the Customer, which may result the Affected Person facing legal or other consequences on behalf of the Customer.

3.9. Under the applicable legislation, the Affected Person has the right to request the following rights to be exercised by CV-Online: the right to request access to the personal data and rectification or erasure of personal data or restriction of processing concerning the Affected Person or to object to the processing of the personal data and to lodge a complaint to the respective supervisory authority. The Affected Person takes note that he/she may be limited in exercising of the foregoing rights, as described under applicable legislation.

3.10. As the personal data regarding the Affected Person is processed in relation to the documentation of the Terms and Conditions and any legal claims which may arise from the foregoing, then the personal data of the Affected Person is processed as long as the foregoing documentation is retained, and any legal claims are expired under applicable legislation. The Agreement and any related documentation is retained for a period of maximum 10 years, taken into account the expiration of the possible legal claims.


4. THE PROCESSOR AND CONTROLLER OF THE PERSONAL DATA AND SPECIFICATION OF PERSONAL DATA


4.1. Depending on which of the Services the Customer will use, the data processing roles of the Customer and CV-Online are defined as follows:

4.1.1. The Ad Service: For the purposes of finding a suitable employee via the Ad Service, the Customer is the data controller and CV-Online is the data processor of the processing activities regarding the personal data of job seekers, who have applied to the vacancies published by the Customer.

For the purposes of providing the Ad Service, CV-Online, as the data processor, will process the personal data of job seekers only to the extent it is necessary for transmitting the job applications via the processor’s systems to the controller’s possession.

The Customer, as a data controller, is required to ensure that it will fulfil, in relation to the relevant job-seeker, all the necessary notification and other requirements, deriving from the applicable data protection legislation, including the need to ensure the existence of relevant legal grounds for the processing of the job seeker’s personal data by the Customer. The Customer shall take note that in case the applicant is a registered and logged in job seeker his/her personal data which has been transmitted to the Customer, may be processed by CV-Online for other purposes which derive from the agreement concluded between CV-Online and the job seeker.

In order to provide the Ad Service, CV-Online processes job seekers’ personal data that does not belong to the special categories of personal data and which comprises of personal data, made available to CV-Online by the job seeker, including but not limited to: e-mail address, full name, phone number, and other personal data provided in job seeker’s CV whilst applying for a specific position. CV-Online shall process the personal data for which the Customer is the controller while providing the Ad Service, and also after that, if it is required by applicable laws, for the purposes and to the extent stipulated herein.

4.1.2. The Database Service: For the purposes of finding a suitable employee via the Database Service, the Customer is a separate data controller from CV-Online regarding the personal data of the active job seekers, whom CVs are displayed in the Database.

For the purposes of providing the Database Service, CV-Online is processing the personal data of all job seekers registered with CV-Online via the Website. Regarding the said job seekers’ personal data, CV-Online is deemed to be a data controller (a separate one from the Customer). CV-Online, as a controller is processing the job seekers’ personal data under a separate agreement concluded between CV-Online and the job seeker.

CV-Online grants the access to the Database for the Customer only for employment-related purposes. The Customer is aware and acknowledges that it, as a data controller, takes full responsibility for the processing of any personal data contained in the Database for any purposes and through any means the Customer has foreseen.

4.1.3. The Services: In case the Customer wishes to access the Services, then, if the Services consist of the Ad Service and the Database Service, the Customer is deemed to be a data controller and CV-Online is deemed to be data processor in regard to the Ad Service and the Customer and CV-Online are considered to be independent data controllers in regard to the Database Service. The respective purposes and scope are defined in Sections 4.1.1. and 4.1.2. of these Terms and Conditions.

4.2. In the context of services mentioned in Sections 4.1.1.-4.1.3., the Customer as a controller, is required to ensure that it will fulfil, in relation to the relevant job seekers, all the necessary notification and other requirements, deriving from the data protection legislation, including the need to ensure the existence of relevant legal grounds for the processing of the job seeker’s personal data.