Privacy statement for job applicants

Last updated on 8 February 2024

Your privacy is important to us. In this privacy statement, we provide information about what personal data Empower 4Wind OÜ processes, how it processes it and for what purposes.

Controller of personal data

Empower 4Wind OÜ (hereinafter E4W)
Registry code: 11949894
Mõigu 3, Tallinn
10112, Estonia

Contact information for this statement

If you have any questions about the processing of personal data or the exercising of your rights under the EU Data Protection Regulation, you can write to our Data Protection Officer at kaisa.aadna@empower.ee 

Data controllers and data subjects

Personal data is processed by the HR representative and the managers involved in the recruitment process. In some cases, the personal data of the job applicant may be disclosed to third parties, such as recruitment consultants or affiliated companies carrying out the recruitment. In these situations, E4W will use contracts to ensure that job applicants’ personal data is used only for purposes that are consistent with this privacy statement, the law and the General Data Protection Regulation (GDPR).

The nature and purposes of processing and the legal bases

E4W collects information about job applicants that is necessary to establish an employment relationship between the job applicant and E4W, its affiliated companies or its customers.  
Based on the General Data Protection Regulation, E4W processes personal data on the following legal bases.

Purpose of processing personal data Legal basis for processing
The processing of personal data is necessary in order to take steps at the request of the data subject prior to entering into a contract. Contract

The processing of personal data is a necessary prerequisite for applying to open positions and thus for the conclusion of an employment agreement with E4W, its affiliated companies or its customers.

 

Personal data will be processed insofar as is necessary for the evaluation of the job applicant’s suitability for the position they have applied for or other open positions provided by E4W.

 

Personal data may be used to contact the job applicant about other open positions provided by E4W that could be suited to the applicant.

Legitimate interest

 

 

 

The search for potential employees and the offering of employment for job applicants can be considered the legitimate interests of the controller. The controller shall ensure that the processing of personal data is proportionate to the interests of the data subject and corresponds with their expectations.

 

The data subject has the right to object to the processing of personal data according to the requirements of the EU Data Protection Regulation insofar as the processing is based on the legitimate interest of E4W.

Personal data may also be collected and updated during the recruitment process without the job applicant’s consent from other sources, such as:

  • the job applicant’s referees;
  • E4W’s cooperation partners;
  • companies or authorities providing recruitment services.

 

Personal data relating to personality tests and aptitude tests may be collected without the data subject’s consent in order to determine the suitability of the job applicant.

Consent

 

 

 

‘Consent of the data subject’ means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them, which gives the controller the legal basis to process personal data.

Where required or permitted by law, E4W may process personal data (e.g. personal credit information, criminal record information, results of safety reviews or medical tests) for conducting a possible pre-employment background screening or employee reliability assessment. 

 

The controller informs the data subject in advance of obtaining such information.

 Legal obligation 

Profiling

The processing of personal data includes profiling. The personal data defined in the following section will be used to evaluate the suitability and competence of the job applicant for the position in question. Thus, the purpose of the profiling is to satisfy both the employer’s need to acquire competent workforce and the employee’s need to be employed in a suitable position. Artificial intelligence may be used to enhance the reliability of profiling. However, profiling does not include fully automated decision-making. The evaluation is carried out and decisions are made by competent and qualified employees.

Categories of personal data collected and storage period

E4W processes the personal data and contact information of job applicants as well as other data necessary for the recruitment process: 

Personal data

  • first name and surname
  • contact details (e.g. postal address, telephone number, email address)
  • date of birth
  • citizenship

Information included in the job application and related documents

  • education (including certificates and other special skills)
  • work experience
  • languages
  • work permit, including its validity and restrictions
  • driving licence and access to the use of a car
  • the position for which the applicant is applying
  • availability to start work
  • salary request
  • other personal data submitted by the data subject in their CV

Data collected and processed during the recruitment process

  • the job applicant’s preferences in relation to the job description
  • information given by the data subject in a job interview 

The personal data collected will be stored for two years from the date of the last update. Job applicants can update their information by logging in to the Register using a personal password.

Sources of personal data

Personal data is primarily collected from the job applicant who fills in the necessary details and uploads their CV to the Register 
Personal data may also be collected from other sources upon the data subject’s consent, such as the job applicant’s referees, E4W’s cooperation partners or companies or authorities providing recruitment services.
The personal data of the job applicant may also be collected and updated without the consent of the data subject in the circumstances permitted or obliged by law.

Transfer of personal data 

Personal data will not be transferred to third parties without the consent of the data subject. Subject to the data subject’s consent, personal data may be transferred to those customers of E4W and its affiliated companies in whose activities the data subject may be involved. In addition, the personal data used to assess the suitability of a job applicant may, with the job applicant’s consent, be transferred to partners who assist E4W or its affiliated companies in the recruitment process. 

Personal data will not be transferred outside the European Union (EU) or the European Economic Area (EEA) unless it is necessary in regard to the purposes of processing determined above. If personal data is transferred outside the EU or the EEA, E4W must implement suitable safeguards in order to comply with the requirements of applicable data protection legislation.

Security of data processing

E4W has put in place adequate technical and organisational data protection measures to safeguard the personal data of data subjects against loss, misuse or other equivalent unlawful access. Secure processing of personal data is ensured by providing instructions as well as managing access to provide access to the designated employees of E4W or its affiliated company.

Personal data is only processed by employees who are authorised to do so in the framework of their work duties.

Job applicant’s rights as a data subject

A data subject can exercise their rights by contacting the Data Protection Officer. The data subject has the following rights under the General Data Protection Regulation (GDPR):

  • The right to obtain confirmation as to whether personal data concerning them is being processed and, if so, to have access to the personal data.
  • The right to have incorrect or incomplete information corrected or completed.
  • The right to request erasure of personal data concerning them.
  • The right to restrict the processing of personal data, where applicable, according to the GDPR.
  • The right to receive the personal data concerning them that they have provided to a controller in a structured, commonly used and machine-readable format and the right to transmit this data to another controller.
  • The right to object to the processing of personal data, where applicable, according to the requirements of the GDPR.
  • The right to lodge a complaint with a supervisory authority if the data subject considers that the processing of personal data relating to them infringes that set out in the GDPR.

Updates to this privacy statement

Empower 4Wind seeks to develop its services continuously and thus reserves the right to change this privacy statement. This privacy statement may also be updated to reflect any changes in applicable laws. We encourage data subjects to periodically review this privacy statement.