This document describes our policies and practices regarding collection and use of your personal data when you apply for a position within our companies, and describes your rights. More specifically, you will find below:

• What data we collect about you;

• How we use and how we generally process these data;

• The grounds for our data processing;

• To whom we communicate these data;

• Data storage method. 

Please carefully read this notification to understand how we process your personal data.  

 

How we collect and use (process) your personal data 

1.1 At Yellow Tree we collect and use any of the following data about you, and in this section we will refer to this as "personal data". 

1. CV/biography information: information included in your application and CV/biography or information otherwise provided to us by you in this context, such as: full name, address, email address, telephone number, previous employers, professional qualifications, references, career and skills analysis, training, departmental changes, performance details and adaptation to requirements. 

We will use this data to take steps (at your request) before signing the employment contract, such as contacting you for interviews.

 

1. Results of identification and eligibility checks, such as corporate holdings database checks, possible personal bankruptcy checks, media and social media source checks, and litigation public information checks.

We use the above data in our legitimate interest to assess the candidate's suitability, as well as to confirm information from CVs, biographies and cover letters, as well as to obtain letters of recommendation and to carry out background checks. We also have an interest in ensuring the honor and good reputation of our future employees, so we may check a candidate's image in the press and on social media, what is the tone and direction of public social media posts (of for example, we do not tolerate hate speech, discrimination and racism), as well as if that candidate is involved in any litigation that may harm our reputation, if that candidate is involved in any competing business, etc. We do not process sensitive data (such as health data) as part of these checks, but we may unintentionally find information about criminal convictions where this information is public (such as listed on the court portal).

 

1. We may conduct tests and collect personality profiling information through dedicated employees and specialist consultants bound by confidentiality obligations. We do not use this data to automatically make decisions about you; any decision regarding your employment at Yellow Tree is made by our employees.  

 

1. Images related to the video surveillance system on the premises - we use this data to carry out security checks, in our legitimate interest to ensure the security of the premises, property and people on our premises.

 

1.2 Source of personal data.  

 

Some of the personal data processed is provided directly by you, and other information is obtained indirectly from third parties, such as recruitment agencies and public sources (e.g. LinkedIn, Trade Register, court portal).

 

2. To whom we disclose personal data 

2.1 Sharing Data within Yellow Tree  

Your personal data may be shared with any other company that is a member of our group if we consider this to be in our legitimate interest for internal administrative purposes (e.g. data storage, CRM) or for auditing and monitoring of our processes internal.   

We may also share your personal data with companies in our group if they provide us with products and services, such as IT systems, HR services and employee monitoring.   

Access to your personal data is limited only to those employees who need that information for professional purposes, which may include superiors and others appointed by them to perform tasks, as well as employees in the HR, IT departments, security and financial.

 

2.2 Disclosure of Data to Third Parties 

We will disclose the necessary part of your personal data only to the extent necessary and only to the following categories of third parties:  

(a) regulatory authorities, accountants, auditors, lawyers or other external experts, if their activity requires this information; 

(b) companies that provide us with products and services, such as:  

(i) human resources services, such as pre-employment screening and employee monitoring activities; 

(ii) recruitment agencies; 

(iii) IT system providers and related support service providers, including email archiving, telecommunications service providers, backup and disaster recovery, IT security services and other outsourced service providers.

We may disclose your personal data to third parties in the following situations: 

(c) If you request or give us your consent to do so; 

(d) To persons who can demonstrate that they have the legal authority to act on your behalf; 

(e) Where it is in our legitimate interest to do so to administer, expand or develop the business: 

(i) in the event of a business transfer (we are selling part of the business or certain assets) related to the job you are applying for, we may disclose your data to the potential buyer of those business activities or assets to ensure that that business continues; 

(ii) if Yellow Tree (or a substantial part of its assets) is acquired by a third party, in which case personal data held by Yellow Tree will constitute one of the transferred assets;

(f) where we are required to disclose your personal data to comply with a legal obligation, any legal request from government or executive authorities, and as may become necessary to meet certain national security or law enforcement requirements of the law or to prevent certain illegal activities;  

(g) to respond to any claims, to protect our rights or those of a third party, to protect the safety of any person, or to prevent any illegal activity; or  

(h) to protect the rights, property or safety of Yellow Tree, its employees, its customers, suppliers or others.  

Some of these recipients (including our affiliates) may use your data in countries outside the European Economic Area. Please see section 5 below for more details on this topic.

 

2.3. Restrictions on the use of personal data by recipients 

Third parties to whom we provide your personal information under paragraphs a), b) and e) above are limited (by law and by contract) in how they can use your personal information for the specific purposes they we identified them. We will always ensure that any third parties to whom we voluntarily disclose your personal information are subject to confidentiality and security obligations in accordance with this disclosure notice and applicable law (for the avoidance of doubt, this may not apply where disclosure is not our decision, such as the situations mentioned in par. c), d), f), g) and h) above. 

Except as detailed above, we will never disclose or transfer any of your personal data to any third party without notifying you or, where applicable, obtaining your prior consent.

 

3. Retention of personal data 

Your personal data is kept only as long as necessary to fulfill the purposes for which that information is processed. At the date of this document, personal data is kept for the following periods that we consider reasonably necessary: 

(a) Personal data of candidates who do not become employees - for 2 years from the end of the recruitment stage; 

(b) Footage taken from surveillance cameras is kept for 30 days from the date of recording, unless an incident is recorded, in which case footage of those incidents is kept for 5 years. We do this in our legitimate interest to enable us to ascertain, exercise and defend our claims or those of a third party; 

The personal data of candidates who become employees is held as part of employee data, and subject to our policy on the processing of employee data.  

If you require further information about how long your personal data is kept, please contact us (see section 8 below).

 

4. Your rights 

4.1 Your rights in relation to your personal data.  

(a) You can request access to the personal data we hold about you. You can also request information about the following: the purpose of the processing; categories of personal data processed; who else but Yellow Tree could have received the data from us; what was the source of the information (if you did not provide it to us directly); and how long that data will be kept.  

(b) You have the right to have your data in our possession corrected (corrected) if it is inaccurate.  

(c) You may also request the deletion of the data or the termination of the processing activity thereof, subject to certain exceptions.  

(d) You may also request the cessation of data processing if this is based on a legitimate interest, subject to certain exceptions. 

(e) You have the right to ask us to transfer the data we process about you based on your consent or in the performance of a contract to you or, if technically feasible, directly to another controller. 

(f) If you are not satisfied with the way we process your data or with the response received to a request in relation to your personal data, you have the right to lodge a complaint with the competent data protection authority. This is either the authority in your state of residence within the European Union (if this is not Romania), or the National Authority for the Supervision of Personal Data Processing, http://dataprotection.ro/ or https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02016R0679-20160504&qid=1532348683434 

4.2 Additional information. applications

(a) If you would like further information about the above rights or if you wish to exercise any of these rights, please contact us (see section 8 below).  

(b) We will consider all such requests and provide you with a response within a reasonable time (no more than one month, which we may extend by a further two months if your request is complex). However, please note that there are exceptions to some of the rights mentioned. If your request is denied, Yellow Tree will provide you with an explanation as to why your request was denied. 

(c) If any exception applies, we will notify you of this at the time we respond to your request. Before responding to any request made by you, we may ask you for certain information necessary to confirm your identity.   

(d) If you have questions about how we process your data. 

(e) If you have any further questions or wish to make a complaint, please contact us (see section 8 below).

 

5. Transfer of personal data outside the European Union 

5.1 Personal information may be processed by our staff operating outside the European Economic Area (European Union, Iceland, Norway and Liechtenstein), as well as by other agents, members of our group or third parties, for the purposes mentioned in section 1.1. You can find further details about the recipients of your personal data in section 2.  

5.2 Where we provide any personal data about you to members of our group or proxy outside the EEA, we will take appropriate steps to ensure that the recipient adequately protects your personal information in accordance with the provisions of this Privacy Notice information.  These measures include: 

(a) in the case of US-based service providers, the conclusion of standard clauses approved by the European Commission or the provider's adherence to the Privacy Shield (details are available at https://www.privacyshield.gov/welcome);  

(b) in the case of service providers based in other countries outside the EEA, we will enter into standard clauses approved by the European Commission. 

5.3 To request more details about the measures taken to protect your personal data in the cases mentioned above, you can contact us at any time (see section 8 below).

 

6. Security 

6.1 Yellow Tree is committed to protecting personal information against any loss, misuse, disclosure, alteration, unavailability, unauthorized access and destruction, and takes all reasonable steps to ensure the confidentiality of personal information, including by using appropriate measures of an organizational nature and technique. Among the measures of an organizational nature, we consider controlling physical access to our headquarters, training our staff, and keeping paper documents in locked rooms.  Measures of a technical nature include the use of encryption, password protection of access to our systems and the use of anti-virus software. 

6.2 In the process of providing personal data to us, your personal information may be transferred over the Internet. Although we make every effort to protect the personal data you provide us, the exchange of information between us and you over an Internet connection is not 100% secure. Therefore, we cannot guarantee the security of your personal information that you transmit to us over the Internet, and therefore such transmission is at your own risk. Once we have received your personal information, we will use strict procedures and security methods to prevent unauthorized access to this information.

 

7. Changes regarding the information note  

This notice may be amended whenever we deem necessary. Any changes made to this notice will be displayed on the same web page but will not be notified to you by email.

 

8. Additional questions or complaints 

8.1 If you have any further questions or wish to make a complaint about how we collect, use or store your personal information or if you wish to exercise any of the rights you have in relation to the data you, please contact: Yellow Tree

8.2 We will try to resolve any such complaint or request regarding your rights. If you are not satisfied with the response received, you may also submit a complaint to your national Data Protection Authority.