1. What is provided in this Privacy Notice and who is it intended for?
TETAS (hereinafter referred to as the Company or we) processes (collects, stores and otherwise handles) your personal data in the course of its activities. When processing your personal data, the Company complies with the General Data Protection Regulation of the European Union (hereinafter referred to as the GDPR) and other applicable legislation governing the protection of personal data.
This Privacy Notice (hereinafter referred to as the Privacy Notice) provides essential information about how the Company processes your personal data, including where we obtain your personal data, to whom we may disclose it, the purposes and legal bases for processing it, your rights, how you can exercise those rights, and other relevant information. Please read this information carefully and visit our website periodically to review the latest version of the Privacy Notice.
To find out when the Privacy Notice was last updated, please refer to the “Last updated” date.
2. Who is responsible for the protection of your personal data?
TETAS:
- Legal entity code: 300513148;
- Registered office: Senamiesčio g. 102B, Panevėžys;
- Correspondence address: V. Krėvės pr. 120, Kaunas;
- Email: [email protected];
- Telephone: +370 640 38334.
3. Why do we collect your personal data and what data do we collect?
| No. | Why do we collect information about you? | What information do we collect about you? | What is the legal basis for collecting your personal data? | How long do we retain your personal data? |
|---|---|---|---|---|
|
1 |
We carry out employee recruitment and selection. |
Name, surname, date of birth, telephone number, email address, place of residence (address), information about the candidate’s education, position applied for, date of receipt of the CV, personal characteristics, work experience (employer, length of service, position held), other professional experience, knowledge of foreign languages (language, reading, writing and speaking proficiency), ability to use computer software, desired salary, other information provided in the CV, letter of recommendation and/or cover letter. |
We have obtained your consent (Article 6(1)(a) of the GDPR). |
Where the candidate consents to the retention of their personal data for future recruitment purposes, the data will be retained for 1 year after the recruitment process has ended. Where the candidate does not consent to the retention of their personal data for future recruitment purposes, the data will be deleted within 30 days after the recruitment process has ended. The recruitment process is considered completed when the candidate is informed of its outcome. Personal data obtained from LinkedIn or other professional social networks will be retained for 30 days from the date consent is obtained, where recruitment is conducted by the parent company, UAB EPSO-G, using the SmartRecruiters system. Personal data in the SmartRecruiters system will be retained for 1 year from the date the account is created and the candidate applies for a specific position, where recruitment is conducted by UAB EPSO-G using SmartRecruiters. If a person applies for a specific position outside the SmartRecruiters system and a recruitment officer subsequently creates an account in the system, the candidate will be asked to provide consent within 30 days of the account being created. Once consent has been obtained, the personal data will be retained in SmartRecruiters for 1 year. |
|
2 |
We conduct background checks on candidates applying for positions. |
Name, surname, residential address, position applied for, and personal data specified in Article 16 of the Law on Prevention of Corruption of the Republic of Lithuania. The scope of personal data depends on the information provided to the Company by the relevant authorities. Special categories of personal data may also be processed for this purpose where such data have been provided to the Company by the authorities conducting the candidate’s background check, including the Special Investigation Service of the Republic of Lithuania. |
We are legally obliged to process your personal data (Article 6(1)(c) of the GDPR). |
Where a background check reveals information leading to a decision not to employ a candidate, their personal data will be retained for 3 months after the recruitment process has ended. |
|
3 |
We administer an internal whistleblowing channel (Trust Line). |
Name, surname, telephone number, personal identification number and email address of persons reporting potential violations (where provided); circumstances described in the report; date of submission of the report; factual circumstances of the alleged violation (including when, how and by whom it was committed); and the reporting person’s decision on whether to be informed of the actions taken and decisions made. Personal data of persons allegedly involved in the reported violation may also be processed, including their names, surnames and other information provided by the reporting person. |
We have a legitimate interest in processing your personal data (Article 6(1)(f) of the GDPR) to prevent fraud, corruption, other criminal offences, breaches of the law, violations of employment duties and other misconduct, and to prevent similar violations in the future. We are legally obliged to process your personal data (Article 6(1)(c) of the GDPR). |
Where a violation has been established, personal data will be retained for 5 years after the investigation has been completed.
Where no violation has been established or a decision has been made not to initiate an internal investigation, personal data will be retained for 3 years after the investigation has been completed. |
|
4 |
We organise and conduct procurement procedures. |
Name, surname, date of birth, address, telephone number, position, bank account number, individual activity certificate number, business licence number, copies of diplomas and certificates, work experience, and number of contracts performed. |
We have a legitimate interest in processing your personal data (Article 6(1)(f) of the GDPR) to ensure the proper organisation and conduct of procurement procedures. |
For 5 years after the completion of the procurement procedure. |
|
5 |
We conclude and perform contracts. |
Name, surname, personal identification number or date of birth, telephone number, email address, bank account number, signature, basis of representation (power of attorney, articles of association, etc.), authorisation number, period of validity of the authorisation, position, payment information, payment period, and other information related to the conclusion and performance of contracts, depending on the nature of the contract. |
We have a legitimate interest in processing your personal data (Article 6(1)(f) of the GDPR) to collect the personal data necessary before entering into a contract and to ensure the proper performance of contractual obligations. We enter into and perform a contract with you (Article 6(1)(b) of the GDPR). |
For the duration of the contract and for 10 years after its termination or expiry. |
|
6 |
We handle legal matters and proceedings. |
Name, surname, personal identification number, date of birth, employment information, email address, and other personal data contained in documents and their annexes, procedural documents, court orders, judgments, rulings and decisions, including special categories of personal data. |
We have a legitimate interest in processing your personal data (Article 6(1)(f) of the GDPR) to protect the Company’s rights in legal proceedings.Duomenys yra reikalingi tam, kad galėtume pareikšti, vykdyti arba apginti teisinius reikalavimus. The processing of personal data is necessary for the establishment, exercise or defence of legal claims. |
For 10 years after the conclusion of legal proceedings. |
|
7 |
We review and respond to requests, complaints and suggestions submitted by you. |
Name, surname, email address, telephone number, signature, date of submission, reference number (registration number), information contained in the request, complaint or suggestion, outcome of its review, and personal data recorded in email correspondence where communication has taken place by email. |
We have a legitimate interest in processing your personal data (Article 6(1)(f) of the GDPR) to review requests, complaints and suggestions submitted to the Company. |
For 3 years from the date of receipt of the request, complaint or suggestion. |
|
8 |
We conduct video surveillance. |
Video footage containing your image. |
We have a legitimate interest in processing your personal data (Article 6(1)(f) of the GDPR) to ensure the safety and security of persons and property. |
For 30 days, unless a longer retention period is necessary for the investigation of an incident. |
|
9 |
We ensure effective management of corruption and international sanctions risks. |
Name, surname, date of birth, nationality, place of residence, registered address, country and percentage of shares held by the business partner; information about links to politically exposed persons (PEPs); information about investigations into corruption, competition law infringements, money laundering and terrorist financing, and occupational health and safety violations; and information about business partners and customers.
Personal data of the business partner’s shareholders (participants) and beneficial owners, including name, surname, date of birth, nationality and place of residence.
Name, surname, position and email address of the business partner’s representative.
Other information provided by the business partner or its representative in questionnaires.
|
We are legally obliged to collect this information (Article 6(1)(c) of the GDPR).We also have a legitimate interest in processing your personal data (Article 6(1)(f) of the GDPR) to ensure that business partners comply with the requirements of the Group’s Partner Code of Ethics and to manage potential financial and reputational risks. |
For 5 years after the termination of the contractual relationship. |
You can read the Candidates’ Privacy Policy applicable to recruitment conducted by UAB EPSO-G here.
4. Where do we obtain your personal data?
Most of the information is provided directly by you. However, we may also obtain certain personal data from legal entities for which you work (e.g. companies belonging to the UAB EPSO-G group) or which you represent (e.g. suppliers with whom we enter into contracts).
When collecting personal data directly from you, we ask that you provide only the information necessary to achieve the purposes specified in Section 3 of this Privacy Notice. Please do not provide any information that is not relevant to these purposes, such as information about your political opinions, nationality, religion or other sensitive personal matters.
5. What personal data must you provide to us and why?
- Carry out employee recruitment and selection;
- Conduct background checks on candidates applying for positions;
- Organise and conduct procurement procedures;
- Enter into contracts with you and fulfil our contractual obligations.
6. To whom may we disclose your personal data?
- Banks providing payment processing services;
- Courts, supervisory authorities, law enforcement agencies and other public authorities;
- Lawyers, notaries, bailiffs, auditors, consultants, data centre service providers, hosting, cloud computing and website administration service providers, software development and maintenance providers, IT infrastructure service providers, telecommunications service providers, insurance companies, archiving service providers and other companies providing services to the Company.
7. Will your personal data be transferred outside the European Economic Area?
In most cases, personal data are processed and transferred within the European Union and the European Economic Area (EEA).
- On the basis of an adequacy decision adopted by the European Commission, recognising that the country in which the third party is established and/or operates ensures an adequate level of personal data protection;
- We have entered into an agreement with the third party based on the Standard Contractual Clauses approved by the European Commission;
- We have obtained authorisation from the State Data Protection Inspectorate;
- We have applied, where possible, other appropriate safeguards for the protection of personal data and derogations permitted by law.
8. How do we protect your personal data?
To ensure that your personal data are protected against unauthorised access, disclosure, accidental loss, alteration, destruction or any other unlawful processing, we have implemented and apply appropriate technical and organisational security measures designed to ensure a level of protection appropriate to the risks involved.
9. What rights do you have?
The GDPR and other applicable legislation grant you certain rights and specify the circumstances in which you may exercise them, the procedures to be followed and the exceptions under which these rights may be restricted. Where permitted by law, you have the right to:
- Access your personal data, i.e. obtain confirmation as to whether the Company processes your personal data and, where it does, request access to those data and related information;
- Request the rectification of inaccurate or incorrect personal data or the completion of incomplete personal data;
- Request the erasure of your personal data where one of the grounds specified in Article 17(1) of the GDPR applies;
- Request the restriction of processing of your personal data where one of the circumstances specified in Article 18(1) of the GDPR applies;
- Object to the processing of your personal data where such processing is based on the legitimate interests of the Company and/or third parties;
- Request the portability of personal data that you have provided to us on the basis of a contract or consent and that we process by automated means, in a structured, commonly used and machine-readable format;
- Object to being subject to a decision based solely on automated processing, including profiling, where such a decision may produce legal effects concerning you or similarly significantly affect you;
- Withdraw your consent to the processing of your personal data at any time where processing is based on your consent;
- Lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence or the place where the alleged infringement of the GDPR occurred, and seek a judicial remedy. In Lithuania, the supervisory authority is the State Data Protection Inspectorate (L. Sapiegos g. 17, Vilnius; email: [email protected]). However, we recommend that you contact us first so that we can work together to resolve your concerns or requests.
10. How can you exercise your rights?
To exercise the rights specified in Section 9 of this Privacy Notice, you must:
- Submit a request to exercise your data subject rights (hereinafter referred to as the Request) in person to the Company at V. Krėvės pr. 120, LT-51119 Kaunas, Lithuania. When submitting the Request, you must present an identity document for verification;
- Send the Request to the Company or its Data Protection Expert by email at [email protected]. Requests submitted electronically must be signed with a secure electronic signature;
- Send the Request by post to the Company or its Data Protection Expert at V. Krėvės pr. 120, LT-51119 Kaunas, Lithuania. The Request must be accompanied by a copy of an identity document certified by a notary or in accordance with another procedure prescribed by law.
11. How will we inform you about changes to this Notice?
We may update or amend this Privacy Notice at any time. Any updated or amended version will take effect on the date it is published on our website.
Where we update this Privacy Notice, we will inform you of any significant changes by publishing the relevant information on our website. You can check when this Privacy Notice was last updated by referring to the “Last updated” date displayed above.
12. Does our website use cookies on your computer or device?
Yes, we use cookies. You can find detailed information about the cookies we use in our Cookie Policy.
13. How can you contact the Company or the Data Protection Expert?
- The Company: V. Krėvės pr. 120, Kaunas, Lithuania; telephone: +370 640 38334; email:
- The Company’s Data Protection Expert: email: [email protected].