Subject to the terms of Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of individuals with regard to the processing of personal data (the “GDPR”), UAB Gi Group Lithuania (hereinafter referred to as the "Controller"), part of the Gi Group Holding group (hereinafter referred to as the “Group”), wish to provide you with information on the purposes, means and areas of communication and disclosure of personal data, provided by data subjects of legal age.
1. PROCESSING ACTIVITIES PURPOSES AND LEGAL BASES
1.1. Your data shall be obtained in the following ways:
- when registering in the personal area of the website (“MyGigroup”, “MyGrafton”)
- by e-mail
- through our agents/recruitment consultants of Gi Group/Grafton.
- through external websites or social networks
1.2. Your data is processed for the purposes of registering in MyGigroup/MyGrafton.
1.3. The legal basis applicable to the processing of your personal data for the purposes described in point 1.2 is the performance of a contract with the Controller, pursuant to Article 6(1)(b) GDPR.
1.4. Your data will be processed if you apply for a specific vacancy notice and when submitting a spontaneous job application for the purpose of searching for and selecting candidates, and more precisely for the following purposes:
- your employment as a temporary worker in our client company
- your direct hiring in a third-party company
- your direct hiring at the Controller
1.5. The legal basis applicable to the processing of your personal data for the purposes described in point 1.4 is to take steps at the request of the data subject prior to entering a contract, pursuant to Article 6(1)(b) GDPR.
1.6. Your data can be processed for all the research and selection of personnel, by sending you job offer(s) in line with your profile to guarantee you a job placement.
1.7. The legal basis applicable to the processing of your personal data for the purposes referred to in point 1.6 is your consent pursuant to art. 6 (1)(a) of the GDPR.
1.8. Your data may also be processed for the purposes of establishing, exercising or defending our rights in legal proceedings.
1.9. The legal basis for the processing of your personal data for the purposes described in point 1.8 are our legitimate interests under Article 6(1)(f) GDPR.
The legal basis for the processing of the special categories of your personal data (if any) for the same purposes is the establishment, exercise or protection of a right in legal proceedings pursuant to Article 9(2)(f) GDPR.
2. ADDITIONAL PROCESSING PURPOSES AND LEGAL BASES
2.1. Subject to your express consent (Article 6(1)(a) GDPR), your data may also be processed for the following additional purposes:
a. providing information and sending promotional messages on the services offered by the Controller or statistical research and research and/or market research, through traditional (by post and telephone calls via operator) and automated contact methods (e-mail, text message, multimedia message and instant messaging systems)
b. providing information and sending promotional messages on the services offered by other companies in the Group (such as training initiatives, career development, vocational training, support for transmission, search and recruitment and search for managers), and statistical surveys and surveys and/or market research, through traditional (by mail and telephone calls through an operator) and automated contact methods (e-mail, text message, multimedia message and instant messaging systems)
2.2. Nevertheless, consent to the processing of your personal data for the purposes described in point 2.1. above is given entirely at your discretion. Therefore, if you refuse to consent to the processing for the said purposes, your data will only be processed for the purposes described in point 1 above.
3. CATEGORIES OF DATA PROCESSED, DATA SOURCES AND PROCESSING OF SPECIAL CATEGORIES OF DATA
3.1. By way of example, the Controller will receive the following common categories of personal data: personal name, middle name (if any), surname, password, date of birth, PIN, ID card number, postal address, e-mail address and contact phone number, educational qualifications, service experience and any other additional information completed by you in your CV and/or provided during an interview at one of our branches.
3.2. Controller will receive the data in question from you and/or from websites operated by third parties or from social networks through which the Controller publish vacancies (on behalf of their clients or on their own account).
3.3. If you apply for an advertisement or apply for a job at your request, you will be given the opportunity to declare that you have a physical or mental disability and whether you fall into a “protected category” in the data collection forms contained on the website or during a telephone interview or interview conducted at one of our branches. This information forms part of the special categories of data pursuant to Article 9 GDPR and will be processed in accordance with the current legal framework. The data will also be used, with your consent, in specific “protected category” searches for roles specifically requested for the completion of the “disability quotas” assigned to employers by the Ministry of Labour and Social Policies.
3.4. The legal basis for the processing of special categories of your data described in point 1.2 is your explicit consent in accordance with Article 9(2)(a) GDPR.
If you do not give your consent, it will not be possible to process the data of the “protected category” in which you fall.
3.5. Please do not include in your CV any special categories of personal data (personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic data or biometric data for the sole purpose of identifying an individual, or data on your health, sexual life or sexual orientation).
4. DATA RETENTION PERIOD
4.1. In the event of data processing for the purposes of registration to the myGiGroup/MyGrafton personal area and search and selection referred to in paragraph 1, the data shall be entered into the company database and kept for 30 months from their entry or from your last interaction with the Site (access, updating of data, or uploading of your curriculum vitae), unless you wish to consent to a further period of retention of your data, which you will be asked to express before the expiry of the aforesaid term.
4.2. When processing data for purposes related to the establishment, exercise or protection of a legal right as described in point 1, the data are entered into a historical record and kept for the duration of the litigation, until the time limits for appeal actions are exhausted.
4.3. When processing data for the additional purposes described in point 2, the data will be entered into the company database and stored for the period specified in point 4.1 or until you withdraw your consent.
4.4. Upon expiry of the storage periods above, the data will be destroyed or converted to an anonymous format.
5. NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF THE REFUSAL TO PROVIDE
5.1. The provision of the data marked with an asterisk in the registration form for MyGigroup/MyWyser is necessary to enable the Controller to complete your registration as described in point 1. If you refuse to provide the requested data, the Controller will not be able to complete your registration on the website.
5.2. The provision of the data marked with an asterisk in the data collection form contained on the website or at the request of the agencies is necessary to enable the Controller to carry out the search and selection process described in point 1. If you refuse to provide the requested data, the Controller will not be able to consider your application.
5.3. The provision of the data described in point 2 is optional. If you refuse to provide the data or do not give your consent, this will have no impact on your registration on the website and will not prevent the Controller from performing the search and selection process.
6. RECIPIENTS OF THE DATA
6.1. Your data may only be processed by employees of departments of the Controller who are authorized to do so to fulfil the above-mentioned purposes. The staff in question have received appropriate operating instructions in relation to the tasks they will perform.
6.2. The Controller may forward your personal data to the following parties to fulfil the objectives described in point 1 above:
- Clients companies or clients organizations
- Ministry of Labour, labour agencies and labour inspections
- Public authorities in relation to active employment policies or measures
- Legal advisors
6.3. In addition, your personal data may be processed by external parties, explicitly designated for data processors who perform for the Controller:
- website management and maintenance services
- management and maintenance services of the candidate database
- data archiving services
- messaging services
- services related to market research
6.4. The updated list of recipients can be obtained from our registered office or by sending a letter by e-mail to lt.privacy@gigroup.com.
6.5. Personal data provided by applicants will not be disclosed.
7. TRANSMISSION OF DATA OUTSIDE THE EEA
Your personal data are processed by the Controller inside the European Economic Area (EEA) and are not disclosed. If necessary, for technical or operational reasons, the Controller might transfer your Personal Data to countries outside the EEA, for which there are adequacy decisions of the European Commission or based on the appropriate safeguards (e.g., Standard Contractual Clauses), or specific derogations provided by Regulation.
8. RIGHTS OF THE DATA SUBJECTS
8.1. Data subjects are granted the rights set forth in Articles 15 to 22 of the GDPR, where applicable.
8.2. In particular, data subjects may request the Controllers:
- to access and receive a copy of their personal data, and other supplementary information
- to have inaccurate personal data rectified, or completed if it is incomplete
- in certain circumstances, to have personal data erased
- in certain circumstances, to request the restriction or suppression of their personal data
- to object to the processing of the data necessary for the legitimate pursuit of the interests of the controllers or for direct marketing.
8.3. If the conditions for the transmission of the data pursuant to Article 20 GDPR are fulfilled, data subjects shall also have the right to obtain the data provided to the Controllers in a structured general use format read by an automatic device and, where technically feasible, to transmit the data to another controller without hindrance.
8.4. These rights may be exercised in writing by e-mail to the following address: lt.privacy@gigroup.com.
8.5. Data Subjects shall have the right to bring claims before the relevant supervisory authority (in their country of residence or work, or in the country where the infringement took place).
9. WITHDRAWAL OF CONSENT
9.1. Data Subjects shall have the right to withdraw the consents given at any time by writing to the e-mail lt.privacy@gigroup.com.
9.2. The withdrawal of consent shall not affect the legitimate nature of the processing based on the consent given by you prior to the withdrawal.
10. CONTACT DETAILS OF THE DATA CONTROLLER
The Data Controller is UAB Gi Group Lithuania, with registered office at Klaipėdos g. 7A, Vilnius, e-mail: lt.privacy@gigroup.com.
11. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)
The Data Protection Officer [DPO] can be contacted at the following addresses:
e-mail dpo@gigroup.com; Piazza IV Novembre n. 5, 20124 Milan, Italy.