Information about processing of personal data during the recruitment process

General questions


Who is processing your personal data?

Your personal data are processed by a controller – AS PNB Banka (hereinafter – the Bank).

Bank’s contact information – address: Riga, 11 Raiņa Boulevard, LV-1050, e-mail: personnel@pnbbanka.eu; phone: 67011577.

Data Protection Officer – address: Riga, 11 Raiņa Boulevard, LV-1050, e-mail: dati@pnbbanka.eu; phone: 67011410.

 

How does the Bank ensure the lawfulness of the processing of your personal data?

Your personal data are being processed based on the European Union General Data Protection Regulation, Law of the Republic of Latvia on the Processing of Personal Data, special legal provisions included in various laws and regulations of the European Union and the Republic of Latvia (e.g. Labour Law, Credit Institutions Law, Law on the Prevention of Money Laundering and Terrorism Financing), Bank’s Data Processing Policy in Respect Employees and Candidates, Bank’s Data Processing Regulations in Respect Employees and Candidates and other Bank’s regulatory documents.

The laws and regulations provide for that the Bank is entitled to process your personal data only if (i) the Bank has established in advance the purposes of processing of your personal data, (ii) the Bank has established in advance the amount of your personal data required to accomplish the pre-determined purposes, (iii) the Bank has a legal basis to process your personal data and (iv) has provided you with the information on your rights with regard to the processing of personal data.

The Bank processes your personal data according to the standard procedure of the recruitment process based on the following:

(a) consideration of legitimate interests of the Bank;

(b) necessity to fulfil a legal obligation applicable to the Bank;

(c) taking measures at your request prior to conclusion of an agreement you are a party to;

(d) your consent to the processing of your personal data for one or several specific purposes.

In cases when the Bank has a legitimate concern to process your personal data, based on observance of the Bank’s legal interests, your personal data are processed taking into account your interests or fundamental rights and freedoms, which require the protection of personal data.

Requirements of the laws and regulations oblige the Bank to process the special categories of data according to special procedure – i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership; genetic data and biometric data, obtained to perform unique identification of a natural person, health data or data concerning sex life or sexual orientation of the individual, as well as data on convictions and offences or related security measures. The Bank has the right to obtain and process the special categories of data only with your consent, except for the cases when the laws and regulations directly allow or oblige the Bank to obtain and process such personal data. In the cases above, the Bank will process the special categories of data based on the following:

(a) significant public interests arising from the laws and regulations of the European Union or the Republic of Latvia that are proportionate to the purpose pursued, considering the essence of the data protection rights and providing for appropriate and specific measures for the protection of your fundamental rights and interests;

(b) the necessity to establish, exercise or defend the legitimate requirements.

 

Please see below the purposes, legal basis and the Bank’s legitimate interests in the processing of your personal data:

 

Reasons why the Bank processes your personal data: Legal basis of the processing of your personal data: The Bank’s legitimate interests in processing your personal data:

Provision of the recruitment process

  • to manage during the recruitment process the legal relationship with the candidate;
  • to implement the recruitment activities;
  • to communicate during the recruitment process with the candidate or the provider of the reference he/she has indicated.
  • legitimate interests of the Bank or a third party;
  • implementation of measures prior to conclusion of an agreement;
  • fulfilment of a legal obligation applicable to the Bank;
  • candidate’s consent.
  • obtaining, collecting, analysing and assessment of the information regarding suitability of the candidate for the vacancies;
  • maintaining accurate and updated information in the Bank’s information systems, data bases and registers;
  • obtaining your consent when it is required by the Bank to communicate during the recruitment process with you or the providers of references you have indicated;
  • ensuring the effectiveness when the Bank carries out its legal or contractual obligations.

Improvement of the recruitment process

  • to monitor how the Bank works with the candidates or how the service providers work on the instruction of the Bank while providing the Bank the services for provision of the recruitment process;
  • to select new ways that would allow the Bank to effectively implement the recruitment process.
  • implementation of measures prior to the conclusion of an agreement;
  • legitimate interests of the Bank or a third party;
  • fulfilment of a legal obligation applicable to the Bank.
  • improvement of the existing recruitment process of the Bank, as well as development and introduction of new recruitment processes;
  • ensuring the effectiveness when the Bank carries out its legal or contractual obligations.

Management of the recruitment process

  • to perform activities, following from the recruitment process – to manage the stages of the process, including communication with different structural units of the Bank, to collect and provide various information;
  • to obtain and collect various information that facilitate implementation of the recruitment process;
  • to perform activities related to drafting an agreement with the candidate.
  • implementation of measures prior to the conclusion of an agreement;
  • legitimate interests of the Bank or a third party;
  • fulfilment of a legal obligation applicable to the Bank.
  • ensuring the effectiveness when the Bank carries out its legal or contractual obligations;
  • ensuring the compliance of the Bank’s operation according to the provisions and recommendations of supervisory authorities.
  •  

Security and risk management

  • to identify, investigate and report on crimes, as well as to try to prevent them;
  • to manage the Bank’s risks;
  • to comply with the laws and regulations and other regulatory framework applicable to the Bank;
  • to respond to complaints and try to settle them;
  • to be able to defend the interests of the Bank in legal proceedings.
  • implementation of measures prior to the conclusion of an agreement;
  • legitimate interests of the Bank or a third party;
  • fulfilment of a legal obligation applicable to the Bank.
  • development and improvement of the functionality of operations performed by the Bank to prevent crimes, as well as development and improvement of the fulfilment of legal obligations related to such operations;
  • ensuring the compliance of the Bank’s operation according to the provisions and recommendations of supervisory authorities;
  • ensuring of effectiveness when the Bank carries out its legal or contractual obligations;
  • implementing the activities, related to eventual submission of a claim to the court or effecting defence in legal proceedings.

Management of the processing of special categories of data

  • to carry out activities related to substantial public interest.
  • by using the data from the Punishment Register, the Bank helps to prevent risks, that might be related to illegal activities and fraudulent conduct.
  • to carry out activities related to compliance with regulatory requirements of supervisory authorities.
  • by using the special categories of data, the Bank demonstrates and confirms that during the recruitment process it has correctly assessed your conformance to the requirements of the post;
  • by transferring the special categories of data to supervisory authorities, the Bank allows and enables them to verify whether it has acted correctly (legally).
  • to carry out activities for establishing, exercising or defending legitimate requirements.
  • by using the special categories of data, the Bank exercises and defends its legitimate requirements.
  • to carry out activities that are based on the client’s consent.
  • by inviting you to give consent to the use of the special categories of data in cases when the Bank’s activities derive from your consent to process the personal data.

 

What are your personal data the Bank processes?

To allow the Bank to ensure its clients the continuing high quality of financial and other services it provides, the Bank’s employees should meet the requirements set in respect of the professional qualification, knowledge, experience and personal qualities. Conformance to the set requirements is initially assessed during the recruitment process during which the Bank uses various types of personal data. The personal data processed by the Bank are grouped into categories to allow the Bank to manage them in the most efficient way and to allow you to see the amount of the information about candidates managed by the Bank. The Bank does not use all personal data in the same way – some types of personal data are suitable for assessment of the candidate’s professional knowledge, while others – for assessment of the candidate’s personal qualities or for fulfilment of legal obligations applicable to the Bank. At the same time, the Bank guarantees to the candidates that the personal data, managed by the Bank, are being processed according to the highest security standards regarding the processing of personal data.

 

Categories of personal data  Описание

Basic (identification) data

Name, surname, identity number, date of birth, picture, contact information, etc.

Records of candidates’ professional activity

Documents (information) certifying the education and professional qualification (training), notes of job interviews, CVs, application forms, references, assessments, etc.

Data of E-communication and telecommunication

Flow data, location data, identification information, etc.

Special categories of data

Information about convictions and offences, etc.

Data obtained when fulfilling legal obligations

Information obtained at the request of the public authorities, etc.

 

How does the Bank obtain your personal data?

(1) Personal data provided to the Bank by yourself:

  • When you apply for a recruitment competition – from your application, the letter of motivation, CV (description of your professional background) and the enclosed documents;
  • When you contact the Bank and talk to the Bank’s recruitment specialists by phone or meet and talk to the Bank’s recruitment specialists at the places of job interviews, incl. records of telephone conversations or notes made by the Bank’s recruitment specialists during the meeting and, where appropriate, from video recording devices;
  • when you use the Bank’s website, mobile phone applications, online conversations, etc.;
  • from your e-mails and mails or courier parcels;
  • from your applications, proposals and other documents you submitted;

(2) Personal data obtained by the Bank from third parties (incl. external data bases):

  • recruitment service providers, e.g. SIA CV-Online Latvia;
  • social media (e.g. by clicking one of our ads in Facebook or Google);
  • public and other registers;
  • Bank’s representatives, mediators, contractors and other third parties engaged in the processing of personal data on behalf or at the direction of the Bank.

IMPORTANT: This is a reference to the persons and institutions that the Bank uses to help the Bank, for instance, with the maintenance of IT infrastructure, as well as which advise it on the development and improvement possibilities of the recruitment process.

  • Providers of references, former employers;
  • Public (incl. law enforcement) authorities.

 

For how long does the Bank retains your personal data?

According to the general procedure, the Bank is entitled to retain your personal data for 2 years as from completion of the recruitment competition (i.e., including the term for announcement of the competition results), unless the laws and regulations prescribe for other personal data retention period. The Bank complies with the general retention period for client’s personal data:

  • to respond to inquiries or complaints, or demonstrate that the Bank has fulfilled its obligations towards you in good faith;
  • to conduct the Bank’s in-house researches;
  • to meet the requirements of the laws and regulations that provide for storage of various types of documentary information.
IMPORTANT: Various categories of data (including categories of documents, containing personal data) may have the retention period that is less than 2 years. Upon expiry of the retention period your personal data are destroyed in a secure way.
 
 

What are the possible consequences if you choose not to provide your personal data (or any other information) upon the Bank’s request?

The Bank might need to obtain your personal data (or any other information) in accordance with the requirements of the laws and regulations, or to enable the Bank to conclude an agreement with you. If you choose not to provide the information (incl. personal data), requested by the Bank, it may limit the Bank’s possibilities to assess your conformance to the requirements of the vacancy, or delay or preclude the Bank from fulfilling legal obligation applicable thereto according to the requirements of the laws and regulations. 
 
IMPORTANT: The Bank may request you to submit information that it finds suitable for the purposes other than serving the Bank’s legitimate interests, fulfilling legal obligations applicable to the Bank or carrying out measures prior to conclusion of an agreement. If in such cases the Bank requests you to provide information about yourself, the Bank will inform you in advance regarding the purposes of processing of your personal data and will explain separately whether it is mandatory for you to provide these additional personal data (or any other information) and how it will affect the delivery of service to you.
 

What are your rights in relation to the processing of your personal data?

You have the following rights:
(a) to access your personal data and forward them
  • you are entitled to obtain additional information about the processing of your personal data irrespective of what type of information you already possess;
  • you are entitled to receive an electronic copy of your personal data being processed by the Bank.
IMPORTANT: The Bank is not obliged to provide a candidate with copies of the documents at the Bank’s disposal, and the Bank does not provide a candidate with the information that contains data of a third party.
  • The Bank may provide you with an electronic copy of your personal data, which you may use repeatedly, including submitting it by yourself to other institutions or request the Bank to forward it;
(b) to amend or delete your personal data
  • you may amend your personal data if they have changed or you have grounds to believe that your personal data processed by the Bank are not accurate;
IMPORTANT: The candidate is liable for accuracy, precision and veracity of his/her personal data (or another information) provided. The Bank is not entitled to amend at its discretion the candidate’s personal data, as well as the Bank is not entitled to search at its discretion the personal data of candidate in third parties’ databases with the aim to maintain the Bank’s databases accurate and updated.
  • You are entitled to request the Bank to delete your personal data, and the Bank will do in case the Bank no longer needs these personal data for the purposes, for which the data have been collected or otherwise processed.
IMPORTANT: The Bank will not be able to delete the candidate’s personal data if the laws and regulations provide for a legal obligation to retain such personal data or the Bank’s legitimate interests are more important than the candidate’s rights infringed by non-deletion of the personal data.
 
(c) to restrict the processing of your personal data
  • you are entitled to request the Bank to restrict the processing of your personal data (or restrict certain processing activities), which means that the Bank could only retain and process your personal data to establish, exercise or defend the Bank’s legitimate requirements. You are entitled to restrict the processing of your personal data if (i) they are not accurate, (ii) they are being processed unlawfully but you do not want to delete them, (iii) their processing is no longer required but you want to establish, exercise or defend your legitimate requirements, (iv) you have already exercised your right to object to the processing of your personal data but you are expecting the Bank’s assessment whether the Bank is entitled to further process your personal data based on the Bank or third party’s legitimate interests.
IMPORTANT: By exercising your rights to restrict processing of your personal data, processing of your personal data during the recruitment process may be temporarily restricted, i.e. the Bank might become unable to assess your conformance to the requirements of the vacancy and make the decision. 
 
(d) to object to the processing of your personal data
  • you are may object to the processing of your personal data if such processing is based on serving the Bank’s or third party’s legitimate interests, while your rights, interests and freedoms are more important than the legitimate interests of the Bank or third party.
 

Does the Bank process your personal data for marketing purposes, in particular, to prepare commercial offers for you?

The Bank does not use your personal data or any other information (including information about other persons, obtained during the recruitment process) for marketing (direct marketing) purposes.
 

Does the Bank process your personal data, taking automated individual decisions?

The Bank does not use in the recruitment process any automated systems to make decisions regarding you.

 

Whom your personal data may be transferred to?

During the recruitment process your personal data are processed by recruitment specialists of the Personnel Department of PNB Group. The Bank has not entrusted assessment of the candidates during the recruitment process to any external organisations, therefore your personal data (incl. any other information) are processed exclusively by the Bank. However the Bank may have to transfer the candidate’s personal data at the request of the public authorities to fulfil the legal obligation applicable to the Bank (for example to supervisory authorities).

The Bank may transfer your personal data (incl. any other information):

  • to companies of the Bank’s group, in case you have applied to a vacancy specifically in any of the companies of the Bank’s group;
  • to public authorities – depending on the legal obligation the Bank must fulfil.

IMPORTANT: The Bank processes the candidate’s personal data in various information systems, technical maintenance of which, commissioned by the Bank, may be performed by outsourcers - controllers, attracted by the bank. Likewise, the announcements of vacancy competitions (advertisements) are published on the portal www.cv.lv, maintained by SIA CV-ONLINE Latvia.

 

Are your personal data being communicated beyond the European Union or the European Economic Area?

The Bank does not during the recruitment process communicate your personal data (incl. information on you) beyond the European Union or the European Economic Area.

 

Which of the Bank's regulatory documents regulate the processing of your personal data?

The processing of your personal data is regulated and your rights relating to the protection and legality of processing of personal data are ensured by:

  • the Bank’s Data Processing Policy in Respect Employees and Candidates (in force since 25 May 2018);
  • the Bank’s Data Processing Regulations in Respect Employees and Candidates (in force since 25 May 2018).

 

Are you entitled to submit an application, a proposal or complaint?

The Bank is a responsible controller of your personal data. To demonstrate that the Bank performs a lawful, fair and transparent processing of your personal data, the Bank has created and maintains a system of accountability that is based on the following:

(a) timely informing of candidates about the processing of personal data and exercising of the candidates’ access rights;

(b) assessment of the impact of the processing of personal data if the planned activities related to the processing of personal data might put at high risk your rights and freedoms, as well as on the registration of personal data proceedings activities;

(c) timely detection and comprehensive investigation of safety incidents related to the protection of personal data, as well as reporting on personal data breaches to the Data State Inspectorate and candidates;

(d) implementation of transparent cooperation with the service providers that ensure processing of candidates’ personal data, commissioned by the Bank;

(e) regular training of the Bank’s employees and assessment of the lawfulness of personal data processing and conformity of the personal data protection system.


However, if you have any suggestions or objections regarding the processing of personal data performed by the Bank, or you want to exercise you rights in respect processing of your personal data, you are entitled to submit to the Bank a suggestion, feedback, application or complaint. You may submit an application or complaint in a way that is most convenient for you:

  • by sending an electronic document to the e-mail address of the Personnel Department of PNB Group personnel@pnbbanka.eu, ensuring that the application is signed in compliance with the relevant legal requirements in the sphere of preparation of electronic documents;
  • in person in paper format at the Bank’s customer service centre in Riga, 11 Raiņa Boulevard, ensuring that the application is signed;
  • by mail (incl. delivery by courier) in paper format to the Bank’s correspondence address in Riga, 11 Raiņa Boulevard, LV-1050, ensuring that the application is signed.


IMPORTANT: If you submit a complaint, the complaint will be considered by the Bank’s Data Protection Committee. The Bank’s Data Protection Committee is a permanent collegial body that has been established pursuant to the decision of the Board of the Bank and in its operation is governed by the Bank’s regulatory documents, valid laws and regulations of the Republic of Latvia, valid binding legislation (regulations, directives, decisions, case-law) of the European Union, recommendations of the Data State Inspectorate, guidelines, recommendations and best practice of the European Data Protection Board, best practice of the Finance Latvia Association, rules and recommendations of the Financial and Capital Market Commission.


Moreover, you are entitled to file a complaint to the Data State Inspectorate regarding the compliance of the processing of personal data performed by the Bank with the requirements of the laws and regulations in the field of protection of data of natural persons. A complaint to the Data State Inspectorate may be filed by:

  • placing it in the mail box of the Data State Inspectorate in Riga, 11/13 Blaumaņa Street, 1st storey;
  • sending it electronically (according to Section 1(2) of the Electronic Documents Law, signed with a secure electronic signature) to the e-mail address info@dvi.gov.lv;
  • sending it by mail to the address: 11/13-15 Blaumaņa Street, Riga, LV-1011.

Yours faithfully

AS PNB Banka