Candidate Privacy Policy
CANDIDATE PRIVACY POLICY
Personal Data Processing Policy for Job Candidates
INTRODUCTION
This Policy has been developed in accordance with the EU General Data Protection Regulation 2016/679 (GDPR) and other applicable data protection law.
Boilte respects every candidate's right to privacy and to the protection of their personal data. We guarantee that all information you provide while your application is being considered is processed in full compliance with applicable data protection legislation and is used exclusively for recruitment purposes.
This Policy explains what data we collect, why we do it, how we protect it, and what rights you have in relation to your personal data.
SECTION 1. PERSONAL DATA OPERATOR
1.1. Operator
Boilte LLC (hereinafter — the "Operator," "Boilte," "we," "us").
1.2. Contact Information
| Parameter | Value |
|---|---|
| careers@boilte.com | |
| Website | www.boilte.com |
1.3. Data Protection Officer
We have appointed a person responsible for organizing the processing of personal data. You can contact them at: info@boilte.com (with the note "For the Data Protection Officer").
SECTION 2. PURPOSES AND LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
Your personal data is processed for the following purposes:
| No. | Purpose of Processing | Data Categories | Legal Basis (GDPR) |
|---|---|---|---|
| 1 | Reviewing your application for a vacant position | Full name, contact details, position applied for, link to a CV or professional profile, cover message | GDPR Art. 6(1)(b) (steps prior to entering into a contract) |
| 2 | Organizing interviews, professional testing and assessment | Interview and assessment notes, test results | GDPR Art. 6(1)(b) (steps prior to entering into a contract) |
| 3 | Building a talent pool for future vacancies | Full name, contact details, professional experience | GDPR Art. 6(1)(a) (consent) |
| 4 | Interaction with recruitment agencies and job platforms | Application data, professional profile data | GDPR Art. 6(1)(a) (consent) |
| 5 | Keeping a record of recruitment decisions in order to defend against possible claims | Application data, correspondence | GDPR Art. 6(1)(f) (legitimate interest) |
SECTION 3. CATEGORIES OF PERSONAL DATA PROCESSED
We process the following categories of candidates' personal data:
3.1. Data Provided in an Application:
- Full name;
- Contact details (phone number, email address);
- Position applied for;
- Link to a CV or professional profile (for example, LinkedIn), if you provide one;
- Cover message, if you provide one.
3.2. Data Contained in a CV or Received During Selection:
- Information about education, work experience, professional skills and qualifications;
- Information about foreign language proficiency;
- Photograph, if you include one in your CV;
- Interview and assessment notes.
Important: we do not ask candidates for special categories of data (health information, racial or ethnic origin, political opinions, religious beliefs) and do not require them at any stage of selection. If you provide such data on your own initiative, we process it only with your explicit consent (GDPR Art. 9(2)(a)) or delete it.
At the application stage we do not ask for identity document details, date of birth, residential address or marital status.
SECTION 4. METHODS OF COLLECTING PERSONAL DATA
Candidates' personal data is collected by the following methods:
| No. | Collection Method | Description |
|---|---|---|
| 1 | Direct Provision | The application form on our website, email or messengers. The website form asks for a link to your CV and does not accept file uploads. |
| 2 | Receipt from Job Platforms | A CV that you have made publicly available on a professional platform (LinkedIn and similar). |
| 3 | Receipt from Recruitment Agencies | Information from recruiting companies with which Boilte cooperates, where you have authorized them to pass it on. |
| 4 | Conducting Interviews | Information you give during interviews (including video interviews) and professional testing. |
SECTION 5. LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
Processing of candidates' personal data is carried out on the following legal grounds:
| Legal Basis | Description |
|---|---|
| Steps prior to entering into a contract (GDPR Art. 6(1)(b)) | Reviewing your application for a specific vacancy, interviews and assessment |
| Consent (GDPR Art. 6(1)(a)) | Keeping your data in the talent pool after the selection for a specific vacancy is closed, and passing it to recruitment agencies |
| Explicit consent (GDPR Art. 9(2)(a)) | Any special categories of data you provide on your own initiative |
| Legitimate interest (GDPR Art. 6(1)(f)) | Keeping a record of recruitment decisions in order to defend against possible claims |
Where processing is based on consent, you may withdraw it at any time (GDPR Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out before it.
SECTION 6. TERMS OF PROCESSING AND STORAGE OF PERSONAL DATA
| Category of Candidates | Storage Period |
|---|---|
| Candidates who submitted a CV but were not selected | 6 months from the date of receiving the CV |
| Candidates with whom interviews were conducted | 1 year from the date of the last response from the candidate |
| Candidates included in the talent pool (subject to separate consent) | 3 years from the date of obtaining consent, with the possibility of extension with your renewed consent |
| Candidates hired for a position | Data is transferred to the employee's personal file and retained in accordance with applicable employment law |
Upon expiry of the specified periods personal data is deleted, unless a longer retention period is required by applicable law.
SECTION 7. PROCEDURE FOR DESTRUCTION OF PERSONAL DATA
Personal data is destroyed in a manner that excludes any possibility of its subsequent restoration or use:
- Electronic records are erased or overwritten;
- Paper media are shredded;
- The fact of destruction is recorded internally.
SECTION 8. LIST OF ACTIONS WITH PERSONAL DATA
We carry out the following operations with candidates' personal data: collection, recording, organization, storage, rectification, retrieval, use, disclosure to the recipients listed in Section 9, restriction, erasure and destruction.
Processing is carried out both with and without the use of automated means. We do not take decisions based solely on automated processing, including profiling (GDPR Art. 22): every recruitment decision is taken by a person.
To ensure information security we use access control, encrypted data transfer, antivirus software and firewalls.
SECTION 9. TRANSFER OF PERSONAL DATA TO THIRD PARTIES
9.1. Recipients of Data
| Recipient | Purpose of Transfer |
|---|---|
| Company Departments | Organizing interviews and evaluating the candidate |
| Recruitment Agencies | Interaction with recruiting companies, with the candidate's consent |
| External Assessors | Conducting professional testing, with the candidate's separate consent |
| Service Providers | Hosting and email services, acting on our behalf under a data processing agreement |
| Public Authorities | Upon a lawful request within their authority |
We do not sell candidates' personal data and do not transfer it for third-party advertising purposes.
9.2. Transfers Outside the European Economic Area
Some of the services we use to review applications are located outside the European Economic Area, so your data may be transferred to a third country. Such transfers are carried out only on the basis of appropriate safeguards — an adequacy decision of the European Commission or the EU Standard Contractual Clauses — together with technical measures: encrypted data transfer and restricted access. You may request details of the safeguards at info@boilte.com.
SECTION 10. RIGHTS OF PERSONAL DATA SUBJECTS
10.1. Your Rights under the GDPR:
- The right of access (Art. 15);
- The right to rectification (Art. 16);
- The right to erasure, the "right to be forgotten" (Art. 17);
- The right to restriction of processing (Art. 18);
- The right to data portability (Art. 20);
- The right to object (Art. 21);
- The right to withdraw consent (Art. 7(3));
- The right to lodge a complaint with a supervisory authority (Art. 77).
10.2. Procedure for Exercising Rights
To exercise your rights, send a request to careers@boilte.com or info@boilte.com. The request should contain:
- Your full name;
- Contact details for a reply;
- The substance of the request;
- The preferred method of reply.
We reply within one month of receiving the request. Where the request is complex, or where several requests have been received, this period may be extended by up to two further months; we will inform you of the extension and its reasons (GDPR Art. 12(3)).
SECTION 11. WITHDRAWAL OF CONSENT
The candidate has the right to withdraw their consent to the processing of personal data at any time by sending a notice to careers@boilte.com.
Consequences of Withdrawal:
- Review of the candidate's application will be terminated;
- The candidate's personal data will be deleted, except where its retention is required by law or necessary to defend against claims;
- The candidate will be removed from the talent pool.
SECTION 12. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY
Each candidate has the right to lodge a complaint with the competent data protection supervisory authority — the national Data Protection Authority at the place of residence, place of work or place of the alleged infringement (GDPR Art. 77).
SECTION 13. CONTACT INFORMATION
For any questions related to the processing of candidates' personal data, you can contact:
| Contact | Information |
|---|---|
| Recruitment | careers@boilte.com |
| For the Data Protection Officer | info@boilte.com (with the note "For the Data Protection Officer") |
SECTION 14. FINAL PROVISIONS
14.1. Entry into Force
This Policy comes into force from the moment of its publication and is valid indefinitely until replaced by a new version.
14.2. Current Version
The current version of the Policy is always available on the Boilte website.
14.3. Amendments
We have the right to make changes to this Policy. The new version of the Policy comes into force from the moment it is posted on the website.