Personal data protection rules for candidates

 

Important information about how we collect, use and store information about Candidates (including Candidates for members of the Supervisory Council) and relatives of Candidates (including members of the Supervisory Council)

 

1. What these Personal Data Protection Rules mean for candidates?

In these Personal data protection rules for candidates (the Rules), we provide you with the information on how the Public Limited Liability Company Šiaulių bankas (legal entity code 112025254, registered office at 149 Tilžės Str., Šiauliai) (the Bank) handles your personal data received:

Hereinafter, all the persons whose data is processed by the Bank in accordance with the applicable legislation, including the General Data Protection Regulation (the GDPR) are called Persons.

2. What is personal data?

Personal data is any information collected by the Bank about a Person that can be used to identify a person and is stored electronically or otherwise.

3. Personal data processed during staff selection (for the purpose of evaluating Candidates)

3.1. Selection of Candidates for Staff (evaluation)

The data listed below is collected on Candidates for Staff and, where explicitly mentioned, on their relatives.

What data do we collect?

What legal basis allows you to collect this information about me?[1]

Who do we pass the data to? (data controllers)

How long we store data?

Name, surname

GDPR, art. 6 (1) (a), GDPR, art. 6 (1) (b)
 

Sodra, STI, various national registers (Bankruptcy Register, Real Estate Register, Loan Risk Database, Credit Bureau Information System, Arrest Register)

Until the end of the selection process without concluding an employment contract with the candidate / while the selection process is in progress (applies to CV), until the end of the employment relationship (applies to the Candidate's questionnaire, Candidate's consent to receive information - data obtained from current / former employer), 10 years after termination of employment (applies to criminal record)

Personal ID number

Identity document information

Marital status

We do not transfer (only the CVs of the Candidates for the members of the Board of the Bank and the information of the identity document are transferred to the Bank of Lithuania / European Central Bank

Address (place of residence)

Telephone number

E-mail

CV information (education, language skills, professional development, former jobs, personal qualities)

Data on immediate relatives (degree of kinship, name, surname, year of birth, place of work, position)

Information of private interests (name, surname, connection)

Individual employment, assignment, agency agreements with insurance companies or other companies

Information in a public space

Other information on appropriate qualifications and good repute, sufficient experience and skills to perform own duties, avoidance of conflicts of interest

Criminal record (applicable to the position of financial broker)

GDPR, art. 10, GDPR, art. 6 (1) (c),

the Law on Markets in Financial Instruments, the Law on Banks, art. 34 (10, 12), Provisions on the organisation of internal control and risk assessment (management) of the Bank of Lithuania, art. 8.3

Disability details (certificate number)

GDPR, art. 6 (1) (c), GDPR, art. 9 (2) (b)

Data obtained from existing employer

GDPR, art. 6 (1) (a)

Data obtained from former employer

GDPR, art. 6 (1) (f) (legitimate interest in verifying the suitability of the candidacy)

 

[1] GDPR, art. 6 (1) (a): you express your consent; (b): we carry out an employment or other contract concluded with you, (c): data is necessary to fulfil a legal obligation, (f):  there is a legitimate interest of the Bank or another person.

3.2 Selection of Candidates for Trainees

What data do we collect?

What legal basis allows you to collect this information about me?[1]

Who do we pass the data to? (data controllers)

How long we store data?

Name, surname

GDPR, art.  6 (1) (a), GDPR, art. 6 (1) (b)
 

We do not transfer

Without concluding an internship agreement with the candidate before the end of the selection process / when the selection process is in progress (applicable for CV)

Address (place of residence)

Telephone number

E-mail

CV information (education, language skills, professional development, former jobs, personal qualities)

 

3.3. Selection of candidates for the members of the Supervisory Council  

The data listed below is collected on the Candidates for the members of the Supervisory Council and, when clearly identified, on their relatives. In order to implement the requirements of legal acts, the Bank of Lithuania / European Central Bank will need to be provided the following information about you:

What data do we collect?

What legal basis allows you to collect this information about me?[1]

Who do we pass the data to? (data controllers)

How long we store data?

CV information (education, language skills, professional development, former jobs, personal qualities)

GDPR, art. 6 (1) (a), GDPR, art. 6 (1) (b)

Bank of Lithuania, European Central Bank

In the absence of an employment contract with the candidate before the end of the selection process/when the selection process is in progress

 

4. Conclusion of the contract

4.1. Conclusion of an employment contract / Implementation of an employment relationship

What data do we collect?

What legal basis allows you to collect this information about me?[1]

Who do we pass the data to? (data controllers)

How long we store data?

Name surname

GDPR, art. 6 (1) (b), GDPR, art. 6 (1) (c)

Sodra

50 years after the end of the contract

Personal ID number

Commencement of duties

Type of contract

Telephone number

We do not transfer

E-mail

Address (place of residence)

Position

Work functions

Wage

Trial period

Other information specified in the employment contract

Information on the document certifying education (educational institution, degree of education, etc.)

10 years after employment relationship

Name(s), surname(s), personal ID number(s) of minor(s) (if child (children) raring  alone, information of evidencing document)

Medical certificate / medical booklet / other documents certifying the state of health (disability, etc.)

Driving license (if required for work functions)

We do not keep

 

5. Information on the Candidates (including Candidates for the members of the Supervisory Council) and their relatives, how the Bank processes personal data

5.1. Ensuring the legal requirements for Candidates (including Candidates for the members of the Supervisory Council)

More detailed information for Candidates (including Candidates for members of the Supervisory Council) on the processing of their data is provided in the Bank's internal information documents after concluding employment or other contracts.

What data do we collect?

What legal basis allows you to collect this information about me?[1]

Who do we pass the data to? (data controllers)

How long we store data?

Details of the Candidate's (including Candidates for the members of the Supervisory Council) close relatives (degree of kinship, name, surname, year of birth, place of employment, position)

GDPR, art. 6 (1) (c), GDPR, art. 6 (1) (f) (The Bank's legitimate interest in ensuring compliance with legal requirements when specific data for the performance of a legal obligation are not precisely listed in legal acts) the Law on Banks, art. 34 (10, 12), Provisions on the organisation of internal control and risk assessment (management) of the Bank of Lithuania, p. 8.3, p. 8.7.

Valuation provisions of the CEOs and persons performing key functions of financial market participants supervised by the Bank of Lithuania, p. 42 p.

We do not transfer

Until the end of the selection process without concluding employment or other contract with the Candidate / while the selection process is in progress, 10 years after the end of the employment relationship or holding the position

 

5.2. Other cases when the Bank processes data on the members of the Bank's Board, members of the Supervisory Council and their relatives

Why do you collect information about me?

What information do you collect about me?

What legal basis allows you to collect this information about me?

Who do you pass on information about me to? (data controllers)

How long do you keep this information about me?

Control of trading in financial instruments

Name, surname, surname given at birth, personal identification number, date of birth, personal and work telephone number, address, controlled companies.

Data on immediate relatives (relationship, name, surname, year of birth or personal identification number, controlled enterprises, positions held).

GDPR, art. 6 (1) (c), Market Abuse Regulation, art. 18, 19

The Bank of Lithuania

 

5 years from the updating of the lists and from the submission of the notifications

Name, surname, financial instruments transaction information.

Nasdaq

Ensuring the requirements for internal lending and lending to persons related to the Bank

Name, surname, personal identification number and (or) date of birth, address, telephone number, e-mail address, controlled companies, number of shares held, position held.

Data on immediate relatives (relationship, name, surname, year of birth or personal identification number, controlled companies, number of shares held, position held), transaction information.

GDPR, art. 6 (1) (c). the Law on Banks, art. 52, 53,

the Law on Corporate Tax, art. 40.

Bank of Lithuania (PRDB), Bank of Lithuania during inspections

It is stored for 10 years

6. Receipt and disclosure of data

We receive your data from you, your relatives, companies operating job advertisement portals, various state and non-state registers and institutions, the public space.

We may disclose information about you to our employees, intermediaries, service providers such as IT, accounting services or subcontractors if reasonably necessary for those purposes as set out in these Rules.

In addition, we may disclose information about you:

Except as provided for in these Rules, we do not share your personal data with any third parties [2].

The list of recipients or categories of recipients specified in the Rules is subject to change, so if you wish to receive personal data processing information, please contact us at the details specified in art. 11 of these Rules.

If these Rules specify, as the legal basis for data processing, GDPR, art.6 (2) (b) (performance of the contract) or GDPR, art. 6 (2) (c) (fulfilment of a legal obligation), the specified processed data is necessary to achieve the stated purposes.


[2] The following are considered as third countries: Member States of the European Union and the European Economic Area

7. Your rights

In this section, we provide information about your rights in relation to our processing of your personal data and the cases in which you may exercise these rights. If you would like more information about your rights or to exercise them, please contact us at the details listed in point 11 of these Rules.

The Bank will provide you with information on the actions taken upon receipt of your request for the exercise of your rights without undue delay, but no later than within 1 (one) month from the receipt of the request. Depending on the complexity of the request and the number of request received, the said term may be extended for another 2 (two) months. In this case, we will inform you within 1 (one) month from the receipt of the request about such extension and the reasons for it. The Bank will refuse to exercise your rights only in cases provided by law.

8. Complaints

If you believe that your rights as a person are and / or may be violated, please contact us immediately at the contacts specified in Clause 11 of these Rules. We ensure that upon receipt of your complaint, we will contact you within a reasonable time and inform you of the progress of the complaint investigation and, subsequently, of the results.

If you are not satisfied with the results of the investigation, you will be able to submit a complaint to the supervisory authority, the State Data Protection Inspectorate (www.vdai.lrv.lt).

9. Responsibility

You are responsible for the confidentiality of the data you provide and for ensuring that the data you provide to us is accurate, correct and complete. If the data provided by you changes, you must immediately inform us by e-mail. In no event will we be liable for any damages incurred by you as a result of you providing incorrect or incomplete personal data or not informing us of any changes thereto.

10. Changes to the Rules

We may update or change these Rules at any time. Such updated or amended Rules will be effective upon posting on our website. You should check them from time to time to make sure you are happy with the current version of the Rules.

After updating the Rules, we will inform you about what we consider to be material changes by posting them on the website.

11. Our contact details

If you have any questions, requests or comments regarding these Rules, the processing of personal data, complaints or other issues related to the protection of personal data in the Bank, please contact at the following contact details:

Public Limited Liability Company Šiaulių bankas
Tilžės str. 149, 76348 Šiauliai
E-mail:: kc@sb.lt
Telephone: 1813 (+370 37 301 337 when calling from abroad)

or

Data Protection Officer:
duomenuapsauga@sb.lt