Data Privacy Policy

UAB "Eor Baltic", with the registered office in Stumbrų 26B-34, Vilnius, Lithuania, is a Data Controller (hereinafter referred to as "EOR Baltic" or "we") who determines which personal data must be collected from the Data Subjects and the purposes and means of collecting personal data.

Scope of Applicability

This Data Privacy Policy applies when EOR Baltic processes personal data of following data subject categories:

• Users of our webpage (the "Site").
• Representatives of potential and existing business partners, clients, and vendors.
• Job candidates to whom we provide employment-related opportunities and services.
• Personal data of employees engaged through our Employer of Record (EOR) services is processed in accordance with a separate Employee Privacy Notice, which is provided directly to employees as part of the employment process.

1. What Do We Mean by 'Personal Information' or 'Personal Data'?

The General Data Protection Regulation (hereinafter "Regulation") defines personal data as follows:

Any information relating to an identified or identifiable natural person; 'identifiable natural person' means a natural person who can be identified, directly or indirectly, by reference to an identifier, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

When this Data Privacy Policy refers to Personal Data, it refers to the definition in the Regulation.

Special categories of personal data

The processing of special categories of personal data means the processing of personal data that reveals racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

We only process special categories of Personal Data where this is necessary to comply with our legal obligations.

2. What Personal Information We Collect, On What Purpose and On What Legal Grounds?

We may collect Personal Data about you in variety of ways, such as through our Site and social media channels; at our events; through phone; through job applications; in connection with recruitment and employment processes or in connection with our interactions with clients and vendors, whereas categories of personal data collected depend on the nature of the relationship.

3. The Use of Legitimate Interest

The Data Controller may process Personal Data for certain legitimate business purposes, which includes all the following:

• to identify and prevent fraud.
• to enhance security of our network and information systems.
• for marketing purposes.
• to enhance, modify, personalize, or otherwise improve our services.
• for investigations and dispute resolution.

Whenever we process Personal Data for these purposes, we will ensure that we keep your rights in high regard and take account of these rights. You have the right to object to such processing, and if you wish to do so, please submit your request by email: info@eorbaltic.com

4. How Do We Protect Your Personal Data?

We maintain technical and organisational measures designed to protect the Personal Data we collect against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use.

Such measures are designed to provide an appropriate level of security taking account, on one hand, the technical state of the art and, on the other hand, the sensitivity of the personal data and the evaluation of potential risks. To provide the appropriate security and confidentiality of Personal Data, we apply to the following non-exhaustive list of measures:

• Encryption of data at rest and in transit using industry standard encryption algorithms with appropriate key lengths.
• Strong user authentication and role-based access controls.
• Network monitoring solutions with events logging.
• Hardened network infrastructure.
• Measures for ensuring physical security of locations at which personal data are processed.
• Incident management policy and processes.
• Periodic vulnerability and penetration testing.
• Certification/assurance of processes and products.
• Periodic employee privacy and security training and awareness program.
• Third party privacy and security assessments.
• Robust data processing and confidentiality agreements.
• Organizational measures for ensuring data minimization, purpose limitation, retention, data quality and accountability.

5. International Data Transfers

As we cooperate with natural and legal persons in many different jurisdictions, we may need to transfer your Personal Data to countries outside of the country in which the information was originally collected. Some of these countries may not have the same data protection laws as the country in which you initially provided the Personal Data. When such transfers take place, we will protect that data as described in this Data Privacy Policy.

If you are in the European Economic Area, Switzerland, or the United Kingdom, we ensure transfers to countries not currently granted adequacy agreements take place only based on:

1. 1. Standard Contractual Clauses (SCCs) adopted by the European Commission, along with the mandatory adoption provisions required for the UK and Switzerland to the extent the processing involves UK or Swiss residents.
2. 2. A legally binding and enforceable instrument between public authorities or bodies.
3. 3. Binding corporate rules (BCR).

Where transfers rely on SCCs, transfers will only take place after a transfer impact assessment is conducted of:

1. 1. The legal practices of the recipient country relating to access to data;
2. 2. The technical and organizational measures adopted to protect the data; and
3. 3. The nature of the processing to ensure purpose limitation and data minimization.

6. Links to External Tools and Resources

We may provide links to external third-party websites operated by organizations not affiliated with EOR Baltic. We do not disclose your personal information to organizations operating such linked third-party websites and we do not review or endorse, and are not responsible for, the privacy practices of these organizations. We encourage you to read the privacy policy of each website that you visit. This Data Privacy Policy applies solely to information collected by EOR Baltic.

7. What Information Do We Disclose?

We do not disclose Personal Data that we collect about you, except as described in this Privacy Data Policy or in separate notices provided in connection with activities.

• Your Personal Data will be shared internally with our team of recruiters, and where applicable, with our clients involved in the recruitment process.
• We may also disclose a portion of your Personal Data with our subsidiaries and affiliated EOR Baltic companies for administrative, legal or compliance purposes.
• With others with whom we work, such as job placement consultants and subcontractors, to find you a job.

In addition, we may disclose Personal Data about you on the following basis:

• To law enforcement authorities or other government officials based on a lawful disclosure request.
• If we are required to do so by law or legal process.
• When we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

We will disclose a portion of your Personal Data with vendors who perform services on our behalf based on our instructions to make our services available to you. We ensure this data is minimized to what is necessary to perform the specific services instructed. We ensure vendor due diligence takes place to assess their privacy and security measures for protecting your data. We also ensure that data processing agreements are in place with vendors, with robust requirements stipulating the technical and organizational measure we require them to comply with when handling your personal data.

We do not authorise vendors to use or disclose the information, except as necessary to perform services on our behalf or comply with legal requirements. Your Personal Data will never be sold, rented, distributed, or made available to vendors for their own commercial purposes, including for their direct marketing purposes.

We also reserve the right to transfer Personal Data we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a reorganization, dissolution, or liquidation).

8. How Long is Your Personal Data Processed?

We retain collected Personal Data in our systems in a way that enables data subjects to be identified for no longer than is necessary for the purpose for which the data were collected or for which data are additionally processed. We determine the specific period considering the following:

• The need to retain collected Personal Data to provide the services requested by the data subject.
• The need to protect the legitimate interests described under the objectives of the controller.
• The existence of specific legal obligations that make the processing and retention of Personal Data necessary for specific periods.

To comply with applicable statutory retention laws, the data will be kept as follows:

• If you visit our Site, your data will be kept as long as stated in the Cookie Notice.
• If you are a representative of a vendor, we will keep information for maximum 11 years after the end of the contract termination.
• If we are providing any type of services to your company, we will keep information for maximum 11 years after the end of contract termination.

Personal Data may be kept for longer than stated above only if it is required to meet our legal or regulatory responsibilities, for example, establishing, exercising, or defending legal claims or compliance cases.

10. Privacy Rights Requests by Authorized Parties

You may designate an authorized representative to exercise your rights on your behalf. If an authorized representative submits a request on your behalf, they must also submit a document signed by you that authorizes your representative to submit the request on your behalf. In addition, we may ask that both you, and your representative, follow the applicable process described above for identity verification.

11. Data Processing related to Minors

We respect the privacy of children. Our Sites and services are not typically designed for, or targeted to, children. If you are under the age of 16 you should not send any information about yourself or your contact details through our Sites.

If you are a parent or guardian, please contact us if you believe we may have collected information from your child, and we will review and take appropriate action.

12. EOR Baltic Non-Discrimination Policy

Users of our Sites and services will not be subject to discriminatory treatment for exercising their privacy rights.

Please bear in mind that exercising some rights, like erasure, consent withdrawal or your right to object, may affect our ability to carry out and deliver some, or all, of the services you are eligible for.

13. Updates To Our Data Privacy Policy

This Data Privacy Policy (including any addenda) may be updated periodically to reflect changes in our privacy practices, to comply with applicable legal updates or to make the information clearer to you.

We encourage you to frequently check this page for any changes. You can always check the top of this page to see when this privacy policy was last updated.

If we make changes that have a substantial impact on how we process your personal data, we will communicate this on our websites.