Candidate’s Personal Data Privacy Note

1. This candidate’s personal data privacy notice (Notice) applies to RB Rail AS, reg. No. 40103845025, legal address: Krišjāņa Valdemāra iela 8-7, Rīga, Latvia, LV – 1010 (Company) and a natural person who has applied for a vacancy announced by the Company (Candidate). The Company processes the Candidate’s personal data in order to assess the Candidate’s compliance with the requirements set by the Company.

2. The purpose of the Notice is to inform the Candidate about the Candidate’s personal data processing and to determine the legal basis for personal data processing based on Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation). Furthermore, with this Notice the Company gives the Candidate an opportunity to express his / her consent to the processing of his / her personal data in cases where the legal basis for their processing is the consent of the Candidate.

Data Controller and its contact information

3. The Company informs that with regard to the processing of the Candidate’s personal data, the Company is considered to be the Data Controller of personal data within the meaning of the General Data Protection Regulation.

4. Contact information of the Company for personal data processing issues:

Address: Krišjāņa Valdemāra Street 8-7, Riga, Latvia, LV-1010
Email address: info@railbaltica.org

Personal data

5. Personal data is any information about an identified or identifiable natural person, in this case the Candidate. The Company shall process the personal data of the candidate only to the extent that is reasonably necessary, observing the requirements of the applicable regulatory enactments.

6. The Company may process the following categories of personal data:

(a)      Identification data: name, surname, personal identification code, passport or identity card (ID card) number.

(b)      Contact information: address, e-mail, phone.

(c)      Qualifying data: education, work experience, CV and information included in the application.

(d)      Recommendations: identity and contact information of the current or former employer’s representative, content of the reference.

(e)      Data created during the recruitment process: tests, assignments, interviews and information obtained during them.

(f)       Criminal record: information on the Criminal record of the Candidate, which is required in accordance with the regulatory enactments and legitimate interests binding on the Company.

(g)      Reputation: information characterizing the Candidate and information about the Candidate’s previous activities, which are required in accordance with the laws and regulations binding on the Company and legitimate interests.

(h)      Bank account: if a job offer is made to the Candidate, a bank account for preparation of the employment contract and transfer of salary.

(i)       Video recording: video surveillance is performed at the Company’s premises.

(j)       Other data: all other data submitted by the Candidate at his / her discretion in the selection process.

7. In cases when the Candidate submits personal data that is not necessary and / or not in accordance with the selection process (for example, religious beliefs), the Company deletes / redacts them as much as possible, etc.

8. We ask you not to provide personal data that is not necessary for the selection process, such as information on race, colour, disability, pregnancy, and marital status, information on religious, political or other beliefs, information on national or social origin, property or family status, sexual orientation, or other circumstances.

9. The Company has the right to request that the Candidate submit a Criminal Record statement on the Candidate’s criminal record for the last 12 months, as well as to investigate publicly available information (SIA “Lursoft IT”, SRS EDS, SIA “Creditreform Latvija”, SIA “Paus Konsults” and other databases) and to obtain feedback on the Candidate in order to conduct a study of the Candidate’s reputation.

Purpose and basis of data processing

Purpose Personal Data Legal Basis
Selection Identification data, contact information, qualification data, recommendations, data generated during the selection process, other data Consent:

The candidate sends an application and CV

Evaluate the Candidate and his/her compliance with the criteria set by the Company Identification data, contact information, qualification data, recommendations, data generated during the selection process, other data Legitimate interests of the Company, such as selection of the most suitable candidates to ensure effective operation
Communication with the Candidate Contact information Consent:

The candidate sends the application

Preparation of Employment Agreement Identification data, contact information, bank account Conclusion of a contract and fulfilment of legal obligations in accordance with the Labour Law
Comply with the requirements of regulatory enactments, with regard to employees, members of the board and supervisory board Conclusion of a contract and fulfilment of legal obligations in accordance with the Labour Law Conclusion of a contract and fulfilment of legal obligations in accordance with the Labour Law
To ensure a safe environment and protect its real estate, video surveillance is performed at the Company’s premises Video recording Company’s legitimate interests – physical security management, event investigation, vital interests – security in the work environment

Recipients of personal data

10. The Company may transfer the Candidate’s personal data to a third party that provides the Candidate’s testing, evaluation, research and other personnel selection services; to the Candidate’s former employers to obtain information about the Candidate’s previous activities, Candidate’s professional and social competencies; and in cases provided by law also law enforcement authorities, such as the State Police, national security authorities.

Transfer of data to third countries

11. The Company will not transfer the Candidate’s personal data outside the European Union without a legal basis.

Data sources

12. Sources of personal data:

(a)      The candidate independently submits his / her personal data to the Company, such as a CV, application letter or e-mail.

(b)      Feedback on the Candidate from previous employers with prior agreement with the Candidate.

(c)      Information on social networks, such as LinkedIn, about the Candidate’s business and employment goals.

(d)      Recruitment companies.

(e)      Publicly available databases, social networks, and other news sources.

(f)       Law enforcement agencies.

Term of storage of personal data

13. Personal data is stored until:

(a)      the specified processing purpose is achieved,

(b)      to the extent that the regulatory framework imposes an obligation on the Company to process and / or store such data,

(c)      if processing is based on consent, personal data are processed for as long as the consent given is valid and not revoked.

14. The Company keeps the Candidate’s personal data for 6 months after closing the respective vacancy.

15. After the establishment of employment or other civil law relations, the Candidate’s personal data may be stored for a longer period of time and the Company’s internal regulations and the requirements of external regulatory enactments shall apply to their processing. For instance:

(a)      in accordance with the Cabinet of Ministers Regulations of 13 November 2018 No. 690 “Regulations Regarding Documents Attesting the Course of a Person’s Work or Service and Education of Archival Value, and Time Periods for Their Keeping”, documents on the establishment, amendment and termination of employment relations (documents of instructions, employment agreements and their amendments, notices on termination and mutual agreements on employment termination), the documents equated to them and their registers, which are necessary for the administration of legal employment relations, shall be kept for a period of 75 years, or

(b)      in accordance with the Accounting Law, justification documents for employees calculated monthly salary (wages) with a breakdown by years and months, shall be kept for a period of 10 years.

Security of personal data

16. The Company shall ensure constant review and improvement of security measures to protect the Candidate’s personal data from unauthorized access, accidental loss, disclosure or destruction. To implement this, the Company uses modern technologies, technical and organizational requirements, including the use of firewalls, antivirus programs, and data encryption.

17. In the event of a security incident with a Candidate’s personal data, if it poses the highest possible risk to the Candidate’s rights and freedoms, the Company will immediately notify the Candidate, if it is possible or the information will be published on the Company’s Internet site or published otherwise.

Which laws and regulations are applicable?

18. The following regulatory enactments are applicable to the selection of a Candidate:

(a)      General Data Protection Regulation,

(b)      Personal Data Processing Law,

(c)      various special legal norms (for example, Labour Law, etc.).

Candidate’s rights

19. The regulatory framework in the field of data protection gives the Candidate several rights to influence the processing of the Candidate’s personal data. In order to exercise this right, the Candidate may:

(a)      submit a written application to the Company in person, presenting an identity document (passport or identity card (ID card)) to the Company, or

(b)      send an application signed with a secure electronic signature to info@railbaltica.org.

20. After receiving the application, the Company identifies the Candidate, i.e., makes sure that the Candidate is the same person as the person has identified themselves to be, and provides the Candidate with an answer within one month.

21. The Candidate has all the rights guaranteed by the General Data Protection Regulation, such as:

(a)      the right to access and process information about his / her personal data,

(b)      the right to request the correction of incorrect, inaccurate or incomplete personal data, to restrict their processing,

(c)      the right to be forgotten,

(d)      the right to data portability,

(e)      the right to file a complaint with the Data State Inspectorate (http://www.dvi.gov.lv/lv/funkcijas/kontaktinformacija/);

(f)       the right to withdraw consent. The candidate has the right to withdraw his / her consent to the processing of his / her personal data if the basis for the processing of personal data is consent. To revoke the consent, the Candidate may use the contact information of the Company provided in this Notice. If the Candidate withdraws his / her consent to the processing of his / her personal data necessary to assess the Candidate’s compliance with the requirements of the advertised vacancy and the Company’s recruitment criteria, this may affect the Candidate’s evaluation results and the Company will not be liable for such consequences.

22. Further information is available in the General Data Protection Regulation, which can be found online at:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

23. The Company has the right to make additions to this Notice by publishing the most current version on its website.