Version applicable as approved by the CEO of UAB “Orbio World” on 27 March 2024

This Candidates’ Personal Data Privacy Policy (hereinafter referred to as “Policy”) provides a detailed description of how UAB “Orbio World” (hereinafter referred to as the “Company”), who is acting as the Data Controller, processes the personal data of Candidates to open job positions.

This Policy provides information about:

• the types of personal data of Candidates that is being processed by the Company;
• the purposes and basis for processing personal data of Candidates;
• for how long the personal data of Candidates is being stored;
• other relevant related information.

This Policy may be amended without individual notice. The latest version of the Policy is always available on the Company’s website: https://orbio.world.

1. Details of the data controller

UAB ,,Orbio World“

Legal entity number: 305049890

Office address: K. Donelaičio 60, LT-44248, Kaunas, Lithuania

E-mail address: hello@orbio.world

2. Types of personal data and purposes for processing candidates’ personal data

In order to choose the right Candidate for a job vacancy, the Company collects the following personal data:

• name, surname;
• e-mail address and/or phone number;
• information about the Candidate’s work experience (name of previous workplaces, period of employment, job positions, responsibilities and/or achievements);
• information about the Candidate’s education and qualifications;
• information about the language proficiency and other competencies required for performing the functions of the relevant position;
• a summary and results of the interview with the Candidate, feedback and insights from the person responsible for the selection of the employee;
• other information provided by the Candidates on their own initiative in their CV, cover letter, or other application documents (e.g. recommendations, feedback). If a Candidate decides to provide such data, it will be processed according to the same rules as the personal data solicited by the Company.

Special categories of personal data (e. g., information related to personal health, criminal records) may be collected only when necessary for the selection process for a specific job position and only to the extent necessary and permitted by applicable law.

The Company may also collect personal data related to the Candidate’s qualifications, professional skills and business characteristics from their former employer after informing the Candidate about it, and from the current employer only with the Candidate’s consent.

3. The legal bases and duration of the processing of personal data

In order to select the right Candidate for an open position, the Company collects data based on the following legal bases established in the General Data Protection Regulation (hereinafter referred to as the “GDPR”):

• having the Candidate’s consent (Article 6(1)(a) of the GDPR);
• having a legitimate interest in selecting the appropriate Candidate for a specific job position (Article 6(1)(f) of the GDPR).

Personal data is being stored for 30 days after the end of the respective selection process except where otherwise provided by applicable laws. The end of the respective selections process is considered to be the expiration of the selected Candidate’s probationary period (3 months).

If the Candidate is giving their consent to store their data in the Company’s database, the data will be stored for 2 years from the moment of giving the consent. Please note that a Candidate has the right to withdraw their consent at any time and may request the removal of personal data from the Company’s database. This request should be sent to the Company’s e-mail at hello@orbio.world.

4. Sources of receiving personal data

Candidate’s personal data listed above is obtained:

• directly from the Candidate’s themselves, when submitted in the CV, cover letter or other application document sent via the Company’s e-mail;
• from the Employment Service of the Republic of Lithuania, employment agencies that are providing recruitment services, online jobseekers platforms, specialized social networks (e. g., LinkedIn) or other platforms (e. g., CV bankas, CV online). In each of these cases, the Company presumes that the Candidate has been adequately informed about the processing of their personal data and the transfer of this data to the Company, and has provided their consent to the respective service provider for these actions to be carried out.

5. Transfer of personal data

The personal data of Candidate’s may be disclosed to competent state supervisory and/or law enforcement authorities only when required by applicable laws and regulations applicable to the Company, or as provided for by law, in order to ensure or defend the rights of the Company, and to assert or defend legal claims.

Access to the personal data of Candidate’s processed by the Company may also be provided to the following data recipients and data processors:

• IT service providers responsible for managing and maintaining the Company’s e-mail system and servers;
• electronic communication and/or communication services provider;
• recruitment services provider;
• audit, legal or other service providers to the extent necessary for the providers to perform their functions.

6. Rights of the candidates

In accordance with the GDPR and other laws regulating the protection of personal data, each Candidate, whose personal data is being processed by the Company, has the following rights:

• to request for confirmation as to whether the Company processes data relating to the Candidate and, if it does, to request access to the processed data and other related information;
• to request the rectification or, depending on the purposes of the processing of Personal Data, the completion of incomplete Personal Data;
• to request the erasure of information held by the Company about a candidate if the Company is using it unlawfully or in other circumstances specified in applicable law (e.g. the legal basis for the processing has ceased to exist);
• to request the restriction of the processing of Personal Data where the accuracy of the data is in question or the processing is objected to, or where the erasure of unlawfully processed Personal Data is objected to, or where the data are necessary for the establishment, exercise or defence of legal claims;
• to refuse to give consent or withdraw prior consent to the processing of the Candidate's Personal Data where such processing is based on consent;
• to file a complaint to the State Data Protection Inspectorate (see https://vdai.lrv.lt);
• to request the transfer to another controller of those Personal Data of the Candidate whose processing is based on the Candidate's consent.

7. Procedure of processing the requests

Candidates should make all requests for the exercise of their personal data rights in writing:

• by contacting via e-mail hello@orbio.world, or
• by postal correspondence to K. Donelaičio 60, LT-44248, Kaunas, Lithuania.

Upon receiving a request for the exercise of rights, the Company must verify the identity of the data subject, and therefore has the right to request the submission of personal identity-confirming documents.

Responses to data subjects’ requests should be provided no later than within 30 calendar days from the date of receiving such request (including all the necessary documents related to the preparation of the response).