01.Types of data collected
1.1 Data Controller
The data controller responsible for processing personal data is Depowise OÜ, registry code 16379409, located at Harju maakond, Tallinn, Kesklinna linnaosa, Liivalaia tn 36, 10132.
1.2 Types of Personal Data
Personal data is collected and processed only to the extent necessary for recruitment, hiring decisions, and related administrative purposes.
| Type of Personal Data | Purpose of processing | Legal basis |
|---|---|---|
| Identification and contact data (name, address, phone, email) | Communicate about applications, schedule interviews, and maintain candidate records. | Consent; legitimate interest (efficient recruitment communication). |
| Application documents (CV, cover letter, references, certificates, portfolios) | Assess qualifications, experience, and suitability for a specific role. | Pre-contractual necessity; legitimate interest. |
| Interview notes and assessment results | Evaluate performance and suitability for the role and ensure fair recruitment decisions. | Legitimate interest; pre-contractual necessity. |
| Work eligibility and background data (right-to-work information, identity verification) | Verify legal employment eligibility and prevent unlawful hiring. | Legal obligation; legitimate interest. |
| Optional demographic or diversity data (voluntarily provided) | Promote diversity, inclusion, and equal-opportunity initiatives. | Consent. |
| Publicly available professional data (LinkedIn profile, professional websites) | Validate professional background and experience where relevant to the role. | Legitimate interest. |
| Communication history (emails, messages, notes during the process) | Manage correspondence and ensure a transparent recruitment process. | Legitimate interest; consent (if extended communication after the process). |
| Recruitment metrics and statistical data (aggregated, non-identifiable) | Analyse and improve recruitment processes and diversity outcomes. | Legitimate interest. |
Sensitive personal data (health, ethnicity, criminal records) is not collected unless legally required and directly relevant to the position, with heightened safeguards applied.
02.Consent and extended consent
2.1 Initial Consent
Submitting an application constitutes consent to process personal data for recruitment purposes related to the specific position applied for.
2.2 Extended Consent
Applicants may grant extended consent for data retention for 24 months to be considered for future job openings. This consent is requested in the application form and may be withdrawn at any time by contacting dpo@depowise.com.
03.Data retention
3.1 Data retention policy
| Scenario | Retention period |
|---|---|
| Lack of initial consent (application not consented for processing) | 30 days |
| Lack of extended consent (application withdrawn or job opening closed) | 30 days |
| Extended consent provided | 24 months |
After the retention period expires, personal data will be securely deleted.
When applications are deleted
- All personally identifiable information (CVs, contact details, communications) is permanently erased from systems.
- Only aggregated, anonymised statistics (total number of applications, diversity metrics) may be retained for internal reporting.
Deletion standards
All deletions are performed securely and irreversibly in accordance with industry standards.
Extended retention
Data may be retained beyond stated periods when:
- Required by applicable employment or anti-discrimination laws,
- Necessary for the establishment, exercise, or defence of legal claims,
- Required for audit or record-keeping obligations.
Once these obligations end, data will be securely deleted or anonymised.
04.Data sharing and recipients
4.1 Data sharing practices
Data may be shared only where necessary and in accordance with this policy. Typical recipients include:
- Internal teams such as HR, hiring managers, and interviewers.
- Third-party service providers (data processors) supporting the recruitment process, including recruitment platforms and applicant tracking systems.
4.2 Data processing agreements
All third parties act under written Data Processing Agreements (DPAs) ensuring compliance with GDPR and data security obligations. Personal data is not sold or shared for marketing or unrelated purposes.
05.Data security and your rights
5.1 Security measures
Appropriate technical and organisational measures protect personal data, including:
- Encryption of data in transit and at rest,
- Secure access controls and authentication systems,
- Role-based access limitation for HR and hiring staff,
- Regular audits and security reviews,
- Staff training in data protection and confidentiality,
- Procedures for timely breach detection and response.
Affected individuals will be notified of personal data breaches where legally required.
5.2 Individual rights
You have the right to:
- Access personal data,
- Rectify incorrect or incomplete data,
- Withdraw consent at any time,
- Request deletion of data (“right to be forgotten”),
- Object to processing based on legitimate interests,
- Request data portability.
5.3 Exercising rights
To exercise any rights described in this policy, contact dpo@depowise.com.
5.4 Complaint procedures
If processing of personal data infringes your rights, you may lodge a complaint with the Data Protection Inspectorate (Andmekaitse Inspektsioon) or seek remedy before a competent court. Contact details are available at www.aki.ee.