Privacy policy

Version 10.11.2022

Protection of personal data of individuals is of great importance for “Stafferty” OÜ (hereinafter referred to as "Stafferty", "we"). The document titled "Privacy Policy" (hereinafter referred to as the "Policy") describes in detail what kind of information we collect to provide our services to job seekers. Policy also describes in detail how Stafferty and in certain cases Stafferty jointly with Stafferty Group companies processes personal data of the persons giving feedbacks on Stafferty, persons, giving feedbacks on candidates, and persons submitting requests in the request form, submitting job applications through the website. All the above indicated persons hereafter referred to as “Data Subjects”.

Stafferty processes personal data of Data Subjects in accordance with the General Data Protection Regulation (GDPR).

As a personal data controller, we have implemented multiple technical and organizational measures to ensure the security of personal data. If you do not wish to provide your personal data over the Internet, you can select alternative methods (for example, personal delivery at Stafferty office).

• Stafferty Group companies

  Stafferty Group companies are:

  UAB "STFF Stafferty", registered in the Register of Legal Entities of the Republic of Lithuania, code of registration 125956523, registered office at A. Goštauto g. 40B, Vilnius, Lietuva, privacy@Stafferty.lt.

  OÜ STFF Stafferty, registered in Register of Legal Entities of the Republic of Estonia, code of registration 10837414, registered office at Sõpruse blv. 145, Tallinn 14317, Eesti, privacy@stafferty.ee.

  SIA “STFF Stafferty”, registered in Register of Legal Entities of the Republic of Latvia, code of registration 50103810561, registered office at Terbatas street 74a, LV-1001, Riga, Latvija, privacy@stafferty.lv.

• Who we are and how to contact us

  For questions related to data processing and protection:

  “STFF Stafferty” OÜ 

  Registered address: Sõpruse blvd.145, 13417 Tallinn, Estonia, office address: Tornimäe 5, II korrus, 10145 Tallinn, Estonia

  E-mail: privacy@stafferty.ee

  The contact point for data subjects when personal data is processed by joint data controllers is “Stafferty” OÜ.

• Principles of personal data processing

  When processing personal data, Stafferty adheres to the following principles:
  

  • performs processing of personal data on the legal and fair basis
  • performs processing in transparent manner
  • identifies specific legitimate purposes prior to processing (including collection of) of personal data
  • collects only those personal data that is necessary and sufficient for the stated purpose of processing
  • personal data processed by Stafferty are accurate and, where necessary, kept up to date
  • personal data storage limitation
  • personal data are processed in a manner that ensures appropriate security of the personal data
• Terms and methods of personal data processing in Stafferty

  Processing of personal data in Stafferty is performed solely on the proper legal basis.

  Stafferty does not process biometric personal data and special categories of personal data of Data Subjects. Stafferty processes personal health data solely to the extent required to comply with the labor laws of the Republic of Estonia.

  Stafferty does not use the personal data of the Data Subjects to make decisions based solely on such data automated processing, which generate legal consequences for the personal data subject or otherwise affect their rights and legitimate interests.

  Personal data transfers to third countries are carried out on the basis of standard contractual clauses for data transfers between EU and non-EU countries concluded between the Stafferty Group companies.

  Stafferty does not publish personal data in publicly available sources without a specific prior written consent of the Data Subject, or without having any other lawful basis.

  Stafferty may engage third parties for processing of personal data on the basis of appropriate agreement entered into with such persons.

  Stafferty shall process personal data by the following methods:

  • with the use of automation tools, inter alia, using information technologies and technical facilities, including computer equipment, IT and technical complexes and networks, facilities and systems for transmitting, receiving and processing personal data, special software (operating systems, database management systems, etc.), information security tools used in IT systems
  • without using automation tools
    

  The set of operations performed by Stafferty for processing personal includes collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (provision, access), blocking, deletion, incineration of personal data, etc.

• Personal data processed by Stafferty, grounds for processing, purposes of processing and processing deadlines

  Processing purpose	Processed data	Legal basis	Deadlines for storage	Data Recipients	Transfers to third countries
  Employment selection for clients and administration of candidates’ data basis	Applicants (candidates): surname, first name and patronymic sex photo contact telephone number email address date of birth citizenship city and area of residence readiness to move and travel work experience information about education obtained information about previous employment level of computer proficiency level of foreign language proficiency salary expectations Personal data listed above are necessary. Without the above specified data, we will be deprived of the possibility to evaluate your suitability. address of personal web page in social networks other information to be included at your discretion into your resume	Consent and preparation for the conclusion of the contract	5 years from the receipt of the consent	Joint controllers Stafferty Group companies; clients of Stafferty Group companies	Yes. Data are transferred in accordance with the Standard Contractual Clauses concluded between Stafferty Group companies Upon separate consent of the candidate data may be transferred to the client residing in third country
  	evaluation characteristics made by an employee of Stafferty	Legitimate interest to assess the candidate
  	Previous employers e-mail telephone number references from previous employers	Legitimate interest to assess the candidate
  Labor market analysis	Applicants (candidates): Applicants (candidates): surname, first name and patronymic sex photo contact telephone number email address date of birth citizenship city and area of residence readiness to move and travel work experience information about education obtained information about previous employment level of computer proficiency level of foreign language proficiency salary expectations evaluation characteristics made by an employee of Stafferty address of personal web page in social networks other information to be included at your discretion into your resume references from previous employers	Legitimate interest of the Stafferty Group to get information on the market trends	5 years	Joint controllers Stafferty Group companies	Yes. Data are transferred in accordance with the Standard Contractual Clauses concluded between Stafferty Group companies
  Feedback from website users (including a publication of a review and identification)	Website visitors (including job seekers, employees and customer representatives): surname and forename place of employment (company name) contact telephone number email address photo other personal data you will include in your review yourself	Consent of the website user to data processing; Legitimate interest (to verify whether the feedback is true)	5 years	Joint controllers Stafferty Group companies	Yes. Data are transferred in accordance with the Standard Contractual Clauses concluded between Stafferty Group companies
  Managing online requests	Person submitting request: name surname email address telephone number request answer to the request This information is obligatory, if you will not provide it, we may not respond to your request	Consent of the website used to data processing	3 years	Joint controllers Stafferty Group companies	Yes. Data are transferred in accordance with the Standard Contractual Clauses concluded between Stafferty Group companies
  Direct marketing (newsletters)	Person submitting request: name e-mail	Consent	3 years	Joint controllers Stafferty Group companies	Yes. Data are transferred in accordance with the Standard Contractual Clauses concluded between Stafferty Group companies
  Search for candidates on the Internet and social media networks (contact a potential candidate)	Person submitting request: Name Surname  duties	Our (and our client’s) legitimate interest to find the due candidate for our client	Correspondence shall be kept until the candidate has given his consent and, if he has not replied, until the end of the selection	N/A	N/A
  CV builder service	Users of CV builder: surname, first name and patronymic photo contact telephone number email address date of birth citizenship city and area of residence readiness to move and travel work experience information about education obtained information about previous employment level of computer proficiency level of foreign language proficiency salary expectations address of personal web page in social networks other information to be included at your discretion into your resume	Consent	5 years from the receipt of the consent	Joint controllers Stafferty Group companies; clients of Stafferty Group companies	Yes. Data are transferred in accordance with the Standard Contractual Clauses concluded between Stafferty Group companies Upon separate consent of the candidate data may be transferred to the client residing in third country

• Source of personal data

  The personal data of applicants (candidates) can be obtained by the Stafferty directly from you personally (e.g., via e-mail, on-line form), from your representative who acts in your interests, or from the work sites on which you have posted your resume in accordance with the terms of use of the sites. Personal data of the potential candidates may be received from the public information published in the Internet.

  Personal data of the website visitors may be obtained by Stafferty directly from you personally, from your representative who acts in your interests, or from your devices used by you to access the website.

• Recipients of personal data to whom the Stafferty may transmit the data
  • Stafferty clients - potential employers
  • Stafferty Group companies as indicated above
• Personal data protection

  Stafferty implements a set of measures aimed at ensuring security of personal data in the process of Stafferty management and business operations.

  To protect personal data, Stafferty has the inter alia following measures in place:

  • appointment of the person responsible for organizing the processing of personal data and the person responsible for ensuring security of personal data in information systems
  • development and approval of local acts for processing and protection of personal data
  • use of information security tools
  • discovery of unauthorized access to personal data and taking measures to prevent such incidents in the future
  • recovery of personal data modified or destroyed as a result of unauthorized access to it
  • etc.
• Rights and obligations of Stafferty as data processor

  Stafferty is authorized to:
  

  • provide personal data to governmental and other competent authorities, if provided for by the laws of the Republic of Estonia (tax, law enforcement agencies, etc.)
    
  • refuse to provide personal data in cases stipulated by the laws of the Republic of Estonia
• Rights of the Data Subject

  This section contains information about your rights related to the processing of your personal data carried out by us and cases where you can exercise these rights. If you would like to receive more information on your rights or to exercise them, please contact us via e-mail indicated in this Policy. In case of joint data processing, you also may contact either of the Stafferty group companies to exercise your data protection related rights under Articles 15 to 22 of the GDPR.

  We will provide information on actions taken on a request with regard to implementation of your rights without undue delay and in any event within 1 (one) month of receipt of the request. In consideration of the request complexity and the number of received requests, the aforementioned term may be extended for 2 (two) further months. In this case, we will notify you of such term extension and reasons for it within 1 (one) month as of the receipt of request. We will refuse to implement your rights only in cases provided for in the legal acts.

  Right to Consent Withdrawal

  If you have given us your explicit consent to the processing of your data, you can withdraw it at any time. 

  Right to Access Your Personal Data

  We want you to fully understand how we use your personal data and not to experience any inconvenience because of that. You can contact us at any time and ask if we process any of your personal data. If we store or use your personal data in any way, you have the right to access them. If you wish to do this, please submit a written request to Stafferty at the address indicated in this Policy and confirm your identity. Please comply to the fairness and reasonableness principles when submitting such request. 

  Right to Request More Information

  We hope that you will understand that it is very difficult to discuss all possible methods of collection and use of personal data. We try to provide as explicit and comprehensive information as possible and undertake to update this Policy if there are any changes to the personal data use process. Nevertheless, if you have any questions about the use of your personal data, we will be happy to answer them or will provide you with all additional information that we can disclose. If you have any specific questions or did not understand the provided information, please contact us.

  Additional Rights

  Below, you will find information about your additional rights that you can exercise in compliance with the following procedure.

  You have the right to request us to rectify any inaccuracies of data held by us. In this case, we may ask you to confirm the rectified information.

  You have the right to ask us to erase your personal data. This right will be implemented in cases provided in Article 17 of the General Data Protection Regulation (EU) 2016/679.

  You have the right to ask us to restrict the processing of your personal data or to object to their processing:

  • during the period required for us to verify the accuracy of your personal data when you submit claims with regard to data accuracy
    
  • in cases of unlawful collection, storage or use of your personal data where you decide not to request the erasure of data
  • when we do not need your personal data anymore, but you need them for the establishment, exercise or defense of legal claims
  • during the period required to determine if we have an overriding legal basis to continue processing your personal data if you exercise your right to object to the processing of your personal data

  You have the right to the portability of data obtained by us under your consent or for the purpose of agreement conclusion. If you exercise this right, we will transfer a copy of the data provided by you.

  You have the right to obtain the extract with the material clauses of the Joint Controllers Agreement concluded between the Stafferty Group companies. 

  You have the right to object to use of your personal data by us:

  • in cases where we use such data in order to implement our legitimate interests, but we do not have an overriding legal basis to continue using your personal data; or
    
  • at any time when we use your personal data to send newsletters or for direct marketing purposes. In such case, the data will not be used for these purposes anymore; however, they may be used for other legitimate purposes.

  Complaints
  

  If you believe that your rights of the data subject have been and/or may be violated, please promptly contact us via e-mail indicated in this Policy. We ensure that as soon as we receive your complaint, we will contact you within the reasonable period and inform you about the complaint handling process, and then about its result.

  If the handling results are unsatisfactory to you, you will be able to submit a claim to the supervisory authority – the Data Protection Inspectorate (https://www.aki.ee/et).

• Changes in this Policy

  This Policy may be amended from time to time to reflect possible changes in our personal data processing processes. We will notify you of any material changes to this Policy. 

  The date of the most recent change and the current version shall be stated at the beginning of the Policy.

• Appendix 1. Form of request for the implementation of right(s) of the data subject

  _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

  (Name and surname of the data subject)

  _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

  (Address and/or other contact details (phone number or e-mail address (indicated at applicant's discretion))

  _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
  

  (Representative and basis of representation if the request is submitted by the data subject’s representative)

  
  “Stafferty” OÜ
  
  

  REQUEST

  FOR THE IMPLEMENTATION OF RIGHT(S) OF THE DATA SUBJECT
  
  

  _ _ _ _ _ _ _ _ _ _ _ _ _

  (Date)

  _ _ _ _ _ _ _ _ _ _ _ _ _

  (Location)

  1. I hereby request to implement the following right(s) of the data subject:

  (Check the appropriate box):

  • Right to receive the information about data processing
  • Right of access
  • Right to rectification
  • Right to erasure (‘right to be forgotten’)
  • Right to restriction of processing
  • Right to data portability
  • Right to object
  • Right to withdraw the consent
  • Right to demand not to be subject to a decision based solely on automated processing, including profiling

  2. Please indicate your specific request and provide as much information as possible to enable the proper implementation of your right(s) (for example, if you wish to obtain a copy of personal data, please indicate the specific data you wish to obtain (for example, a copy of email of x day of x month of 2018); if you want to rectify your data, please indicate the specific personal data which are inaccurate; if you object against processing of your personal data, please provide the arguments for your objection and indicate the specific processing of data you object against; if you wish to exercise the right to data portability, please indicate with regard to which data you wish to implement this right and if you wish to transmit them to your device or to another controller, and if the latter, please indicate this controller):
  

  _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
  
  ATTACHMENTS:
  
  1. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
  2. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
  3. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
  4. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
  

  _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 

           (Date)               (Signature) 

  _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

                (Name, surname)