Last update: 2025-11-25
1. General provisions
1.1. The present privacy policy of candidates for employees (“Policy”) is intended for persons applying for employees in the company Cyber upgrade, UAB, legal entity code: 306422641, address Laičių g. 92, Laičiai, LT-21342, Elektrėnai, Lithuania, e-mail: privacy@copla.com, phone No.: +370 650 72202 ( “Copla’s” or “we”).
1.2. The present Policy determines the main purposes and bases for the processing of personal data of candidates for employees (“Candidates”), including their data storage, the rights of Candidates related to the processing of personal data and other aspects of personal data processing, when we or with the help of third parties carry out selections for vacant positions in Copla’s.
1.3. When processing the personal data of the Candidates, Copla’s follows the Regulation (EU) 2016/697 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“GDPR”), the Labour Code of the Republic of Lithuania (“Labour Code”), the Law on Legal Protection of Personal Data of the Republic of Lithuania (“Law”), other legislation regulating the processing of personal data and the present Policy.
1.4. Unless provided otherwise, the definitions used in the Policy are understood the same as they are defined in GDPR, the Labour Code, the Law or in other applicable legislation and the internal documents of Copla’s.
1.5. When processing the personal data of the Candidates, we adhere to the principles of legality, fairness, transparency, purpose limitation, data volume reduction, data accuracy and storage limitation. We also establish security measures and procedures in our activities to protect the personal data of the Candidates from unauthorized access, disclosure, loss, alteration, destruction or other unauthorized processing.
2. Purposes of processing the personal data of the Candidates
2.1. We process the personal data of the Candidates for the following purposes:
| organization of selection for a specific vacant position of Copla’s: | for this purpose, we process the personal data of the Candidates who have expressed their wish to apply for a specific job position in Copla’s. |
| organization of future selections for vacant job positions in Copla’s: | for this purpose, we can process the personal data of the Candidates who have expressed their wish to participate in future selections for future job positions in Copla’s. |
3. Basis of processing the personal data of the Candidates
3.1. For the purposes specified in the present Policy, the personal data of the Candidates is processed on the basis of consent:
3.1.1. the consent to process the personal data of the Candidate for the purpose of organizing a specific selection for a vacant job position in Copla’s (Clause 2.1 (a) of the Policy) can be expressed after the Candidate voluntarily submits their curriculum vitae (CV), motivation letter or other information about themselves to us or to third parties we use;
3.1.2. the consent to process the personal data of the Candidate for the purpose of future selections for vacant job positions (organized in the future) in Copla’s (Clause 2.1 (b) of the Policy) is clearly and unambiguously granted to Copla’s itself (for example, after the end of a specific selection, the Candidate expresses his/her consent for Copla’s to continue processing his/her data for the purpose of organizing future selections for job positions).
3.2. The personal data of Candidates may be processed for purposes other than those specified above in the present Policy only on the basis of the individual consent of the Candidate (except for cases where certain processing of the personal data of Candidates is necessary for the fulfilment of the requirements of the applicable legislation).
4. Categories of processed personal data of the Candidates
4.1. For the purposes specified in Clause 2.1 of the Policy, we can process the following personal data of the Candidates:
4.1.1. personal identification data: name, surname, date of birth or personal code, if the latter is indicated by the Candidate;
4.1.2. contact data: residence address, correspondence address (if different from the permanent place of residence), phone number, email address;
4.1.3. qualification and experience data: information about the work experience of the Candidate (workplace, work period, duties, responsibilities and (or) achievements), information about the education of the Candidate (educational institution, period of study, acquired education and (or) qualification), information about the qualification improvement (completed trainings, acquired certificates), information about language skills, skills in information technology, driving skills, other competencies, other information provided by the Candidate in the curriculum vitae (CV), cover letter or other application documents;
4.1.4. references and feedback from employers: the person referring the Candidate or providing feedback, his/her contact details, the content of the reference or feedback;
4.1.5. candidate assessment information: summary of the interview with the Candidate, insights and opinions of the person(s) conducting the selection, the results of the Candidate’s testing (if applicable);
4.1.6. data on conviction and criminal acts, in cases if we are required to collect such data by legislation;
4.1.7. other information that the Candidate provides on his/her own initiative in questionnaires, applications or other communication with the Candidate.
5. How do we obtain the personal data of Candidates?
5.1. The personal data of Candidates is obtained from:
5.1.1. directly from the Candidates, by sending a CV and (or) motivation letter and providing other information by e-mail or presenting themselves otherwise to Copla’s;
5.1.2. other persons with whom Copla’s has contractual relations (for instance, entities providing job search, selection and (or) mediation services, for instance, from the Employment Service of the Republic of Lithuania, employment agencies and (or) career portals, career social networks (“LinkedIn”)). In this case, we take the position that the Candidate has received all the necessary information about the processing of his/her data and has given his/her consent to the processing of the personal data of the Candidate to the relevant entity providing such services that also includes the right to provide the data of the Candidate to potential employers (including us) by enabling such potential employers to process the personal data of the Candidate during selection for a vacant job position and evaluating the candidacy of the Candidate;
5.1.3. we can obtain certain information about the Candidates from third persons, for instance, the persons referring the Candidate, current or future employers. However, we will only collect such information if we have a legal basis to do so, for instance, if the Candidate consents to contact the current employer of the Candidate and (or) another person and we will inform the Candidate prior to contacting the former employer.
6. Storage period of personal data
6.1. The personal data of the Candidates is stored as long as the ongoing selection for a vacant job position in Copla’s is valid, but no more than 6 (six) months.
6.2. After the selection for a vacant job position in Copla’s is over, the personal data of the Candidates is stored for no longer than 1 (one) year with the Candidate’s consent. If the Candidate revokes the consent earlier, his/her personal data is deleted without waiting for the period of 1 (one) year to expire.
6.3. The personal data of the Candidates can be stored longer than provided in clauses 6.1 and 6.2 of this Policy when:
6.3.1. there are reasonable suspicions of an illegal act that is the subject of an investigation;
6.3.2. the personal data of the Candidate is necessary for the proper resolution of the dispute or complaint;
6.3.3. in case of other grounds provided in legislation.
6.4. In any case, we may store the consent given by the Candidate and proof of it for a longer period, if necessary, to be able to defend ourselves against requirements, claims or lawsuits brought against us.
7. Assurance of security of personal data
7.1. We implement various technical and organizational security measures to ensure the security of personal data of the Candidates and prevent illegal or accidental destruction, alteration, disclosure, as well as any other unauthorized data processing. These measures include various hardware and software, additional agreements with used service providers, internal rules related to personal data protection and other measures.
7.2. The transmission of information via electronic means of communication (for instance, e-mail, mobile phone, etc.) may be less secure in individual cases for reasons beyond our control of the technical or organizational measures chosen by us. Therefore, to ensure the security of your confidential personal data, we do not recommend to provide us with information through various less secure and (or) electronic systems that are not used by us.
8. Recipients of the personal data of the Candidate and countries where we process the personal data
8.1. We can transfer the personal data of Candidates for processing to third parties who help us carry out the selection of Candidates for the employees of Copla’s or who provide us with services related to the selection for the proposed job positions, evaluation of Candidates and internal administration, for instance, selection assessment partners, database administrators, etc.
8.2. The personal data of the Candidates may also be provided to competent authorities, law enforcement agencies, public administration entities, but only upon their request and only when required in accordance with applicable legislation or in the cases and procedures provided for by legislation to defend the rights of Copla’s and fulfil its obligations to declare, file and defend legal claims.
8.3. By understanding our obligation to process personal data in strict accordance with the applicable requirements, we use only those service providers who have implemented/undertake to implement appropriate technical and organizational security measures and we ensure that the said service providers comply with appropriate personal data protection, security and confidentiality obligations established in a written contract.
8.4. We process and store the personal data of the Candidates in the territory of the European Union and the European Economic Area. We do not transfer any personal data of Candidates to third countries or international organizations that are not in the European Union and the European Economic Area.
9. Rights of Candidates, as data subjects, and their implementation procedure
9.1. You as Candidate and as a data Subject, have the following rights:
9.1.1. right to be informed and to have access to personal data:
You have the right to receive information about the processing of your personal data in a transparent, intelligible, and easily accessible form, using clear and plain language. This is provided for in this Policy. If any part of this Policy is not clear to you, please contact us using the contact details specified in clause 1.1 of this Policy. You also have the right to receive Copla’s confirmation as to whether the data relating to you is processed and, if such data is processed, you have the right to access your personal data and the following information:
In addition, you have the right to receive a copy of the personal data that we have about you. We have the right to charge a reasonable fee based on administrative costs for any additional copies requested by you.
9.1.2. right to have personal data rectified:
You have the right to request that Copla’s correct inaccurate or incomplete personal data about you. You are responsible for ensuring that the data you provide to us is accurate, correct, and complete. If the data you provide changes, you must notify us immediately by amending the relevant data in the registration form or, if the data is not specified in the registration form, by notifying us about it by email. In no event will we be liable for any damage caused to you because you have indicated incorrect or incomplete personal data or have not informed us of changes.
9.1.3. right to erasure (“right to be forgotten”):
You have the right to request us to erase or delete your personal data if there is no reasonable reason why we should continue to process it if personal data is no longer necessary for the purposes for which it was collected or processed or if you withdraw your consent on the basis of which the personal data was processed and there is no other legal basis for processing it or on other grounds set out in Article 17 of the GDPR. Please note that in order to ensure the security of information systems and personal data, Copla’s makes personal data backup copies. We will then delete or remove your personal data, except for the data from such backup copies, within the terms specified below. If, before the expiry of the term specified in this paragraph, we are forced to restore the backup copy containing your personal data, we will immediately delete such data and will not use it for any other purpose. Please note that Article 17(3) of the GDPR provides for exemptions to the cases above, where the data must be processed. If any such exceptions are valid in your case, we will inform you accordingly.
9.1.4. the right to restrict the processing of personal data:
You have the right to request Copla’s to restrict (or suspend) the processing of your personal data if:
After restricting the processing of personal data, such personal data may be processed (except for its storage) only with your consent or only for the purpose of the establishment, exercise, or defense of legal claims, protection of the rights of another natural or legal person or for reasons of important public interest.
9.1.5. right to data portability:
You have the right to receive your personal data provided by Copla’s, in a structured common machine-readable format, as well as the right to transfer this data to another controller, provided that:
You also have the right to request that Copla’s transfer your personal data directly to another controller if it is technically possible.
9.1.6. right to object:
You have the right to object at any time to the processing of your personal data for the purpose of public interest or the legitimate interest of Copla’s. In this case, Copla’s will no longer process your personal data unless we can prove the legitimate grounds on which your personal data is processed and which are more important than your interests, rights, and freedoms, or if this is necessary to establish, exercise, or defend a legal claim. When personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for this purpose and it will no longer be processed for this purpose.
9.1.7. right to withdraw consent:
If your personal data is processed on the basis of your consent, you have the right to withdraw such consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent prior to its withdrawal.
9.1.8. right to file a complaint with supervisory authority:
If you believe that the processing of your personal data violates the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement. The supervisory authority in Lithuania is the State Data Protection Inspectorate, address: L. Sapiegos str. 17, 10312 Vilnius, Lithuania, email: ada@ada.lt, website: https://vdai.lrv.lt/. Before submitting a complaint to the supervisory authority, we would appreciate it if you would contact us and explain your concerns to us. We will make maximum efforts to resolve your question expeditiously and carefully.
Copla’s will examine your request to exercise the rights of the data subject within 1 month. This period may be extended, if necessary, for a further period of 2 months, taking into account the complexity and number of requests. In this case, Copla’s will notify you of any such extension within 1 month of receipt of the request, together with the reasons for the delay. If upon the receipt of a request, complaint, or claim, we have suspicions regarding your identity, we have the right to request additional information necessary to confirm your identity.
9.2. In addition, please note that the above rights of data subjects may be restricted in order to ensure the prevention, investigation, detection or prosecution of criminal offences or the enforcement of criminal sanctions, including the protection against and prevention of threats to public security, public safety, and in the cases of restriction of rights as set out in Article 23 of the GDPR.
10. Updates of Policy
10.1. We have the right to update or change this Policy at any time. Such an updated or amended Policy will enter into force upon its publication at our website. If substantial changes to this Policy are made, this will also be communicated.
