Candidate Privacy Notice

1. Who we are

CapitalRecruiters OÜ, trading as Capital Recruiters, is the controller responsible for the personal data processed in connection with the recruitment activities described in this notice.

Registry code: 14627398
Registered address: Tuukri tn 19-315, Kesklinna linnaosa, Tallinn, Harju maakond, 10120, Estonia
Privacy contact: pr@capitalrecruiters.com

This notice applies to candidates whom we contact, candidates who contact us or apply for opportunities, and individuals whose professional information we consider for recruitment activities carried out by CapitalRecruiters OÜ.

2. What information we use and where it comes from

Depending on our interaction with you, we may process your name, contact details, professional profile links, CV, employment history, qualifications, skills, languages, location, work preferences, availability, remuneration expectations and other information relevant to potential employment opportunities.

We may also process recruitment correspondence, interview notes, assessments, recruitment status, relevant feedback received during recruitment processes, and records of your instructions, preferences and permissions.

We obtain information directly from you and from professional sources such as LinkedIn, recruitment platforms, referrals, publicly available professional profiles and other sources reasonably used for professional recruitment.

Where relevant to an opportunity, we may ask about your ability or authorisation to work in the applicable country.

Please avoid providing identity-document copies, health information or other sensitive personal information unless it is necessary for a particular recruitment process. Where special-category personal data is processed, we do so only where there is an applicable legal basis under data-protection law.

Where an interview is recorded with your agreement, the information processed may also include the audio or video recording, transcript and resulting interview notes.

3. Why we use your information

We use personal data to:

• identify and contact potential candidates;
• discuss current and future employment opportunities;
• assess professional experience, qualifications and suitability against role requirements;
• arrange and conduct interviews;
• communicate with candidates throughout recruitment processes;
• prepare candidate profiles and assessments;
• present candidates to prospective employers with the candidate’s confirmation;
• maintain relevant recruitment history;
• identify potentially suitable candidates for future opportunities;
• avoid repetitive or inappropriate outreach;
• administer and improve our recruitment processes;
• handle complaints, data-protection requests and legal matters.

For sourcing, contacting, assessing and maintaining professional candidate records, we generally rely on our legitimate interests under Article 6(1)(f) GDPR in providing recruitment services, maintaining a professional talent network and helping employers identify suitable professionals.

We consider whether the processing is necessary for these purposes and whether our interests are overridden by your interests, rights or reasonable expectations.

Where we request your consent for a particular activity, including optional recording of an interview, we rely on Article 6(1)(a) GDPR for that activity. You may withdraw your consent at any time without affecting processing lawfully carried out before withdrawal.

We may also process information where necessary to comply with legal obligations under Article 6(1)(c) GDPR or, where appropriate, to establish, exercise or defend legal claims on the basis of our legitimate interests.

Providing professional information is generally voluntary. However, without sufficient information we may be unable to assess your suitability for an opportunity or present your candidacy.

Sending us a CV or communicating with us does not constitute blanket consent for unrelated uses of your personal information.

4. Interviews, assessments and AI-assisted tools

Before recording an interview, we explain that the interview will be recorded and may be transcribed or analysed, and we ask for your agreement. You may decline the recording.

Recordings and transcripts may be used to prepare and verify interview notes and to support an accurate assessment of your professional experience against relevant role requirements.

We may use software tools, including artificial intelligence, to structure professional information, summarise CVs or interviews, compare experience with role requirements, prepare draft assessments and generate indicative suitability ratings.

Such processing may constitute profiling within the meaning of the GDPR.

These tools assist our recruiters rather than replace their professional judgement. Recruiters review relevant source information and exercise their own judgement when deciding whether a candidate should progress in a recruitment process.

We do not make recruitment decisions producing legal or similarly significant effects solely through automated processing.

You may ask us to correct inaccurate information or review an assessment where you believe it is based on inaccurate or incomplete information.

5. Who receives your information

Your personal information may be accessible to recruiters, account managers and other persons working on relevant recruitment processes on behalf of CapitalRecruiters OÜ.

We also use service providers supporting our recruitment activities, including providers of:

• applicant tracking and recruitment management systems;
• email and business communications;
• cloud storage and collaboration services;
• video interviewing and online meetings;
• transcription and note-taking tools;
• AI-assisted processing;
• website hosting;
• IT and technical support.

These providers receive access only to information relevant to the services they provide.

Before presenting your identifiable profile or CV to a prospective employer, we identify the employer and seek your confirmation for that submission.

Confirmation relating to one employer or opportunity does not constitute permission to circulate your CV generally or submit it to unrelated employers.

Prospective employers generally process candidate information as separate controllers for their own recruitment purposes and are responsible for their own data-protection obligations.

Where necessary and legally justified, information may also be disclosed to professional advisers, courts, regulators, law-enforcement bodies or other competent public authorities.

6. International processing and transfers

Capital Recruiters operates internationally.

Our recruitment activities may involve recruiters or contractors working within the European Economic Area and in Ukraine, international clients, and technology providers operating in different countries.

Depending on the recruitment process and services used, personal data may therefore be accessed or processed outside the European Economic Area, including in the United States or other countries in which relevant service providers operate.

Where a transfer of personal data outside the European Economic Area is subject to Chapter V of the GDPR, the applicable transfer mechanism depends on the recipient and destination country.

Such mechanisms may include a European Commission adequacy decision, appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or another transfer mechanism permitted by applicable data-protection law.

You may contact us at pr@capitalrecruiters.com to request information about recipients, destination countries and the safeguards relevant to transfers of your personal data, including information on how to obtain a copy of applicable safeguards where required by law.

7. How long we keep your information

We retain relevant candidate profiles, CVs, recruitment correspondence, interview notes, assessments, relevant recruitment feedback and other necessary candidate records for up to five years after our last substantive recruitment interaction with you, unless the information is no longer needed sooner.

A substantive recruitment interaction may include, for example:

• a recruitment discussion;
• an interview;
• an updated CV or professional profile provided by you;
• discussion of a new opportunity;
• communication about your professional preferences or availability;
• another meaningful interaction relating to recruitment.

Where we have not had a substantive interaction with you, the five-year period runs from the date on which the relevant information was collected.

An unanswered outreach message, an internal administrative update to your profile or a data-protection request does not, by itself, restart the five-year retention period.

We retain relevant recruitment history because suitable opportunities may arise several years after our first interaction with a candidate. Previous recruitment history may also help us understand earlier interactions and assessments, avoid repetitive or inappropriate outreach and determine whether a future opportunity may be relevant.

Interview recordings and full transcripts are retained for a shorter period than the general candidate record and only for as long as reasonably necessary to prepare, verify and support the relevant interview assessment. They are deleted when they are no longer reasonably required for that purpose, unless a specific and documented reason justifies further retention.

Necessary written interview notes and assessments form part of the candidate record and may be retained under the five-year rule described above.

Certain information may be retained for longer where necessary to comply with a specific legal obligation, investigate or handle an ongoing complaint, or establish, exercise or defend legal claims. Any such extended retention is limited to information necessary for that particular purpose.

Where you ask us not to contact you about recruitment opportunities, we may retain the minimum identifying information necessary to ensure that your instruction is respected.

Information that is no longer required is deleted or anonymised so that you are no longer identifiable.

8. Your rights

Depending on the circumstances and applicable law, you may have the right to:

• request confirmation as to whether we process your personal data;
• access your personal data and obtain a copy;
• request correction of inaccurate or incomplete information;
• request erasure of your personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain personal data in a portable format where the right to data portability applies;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent supervisory authority.

You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interests, including related profiling.

Where you validly object, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

You may also ask us at any time to stop contacting you about recruitment opportunities.

Where processing is based on consent, withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact:

pr@capitalrecruiters.com

You may also use the communication channel through which you normally communicate with us. No special form is required.

Where we have reasonable doubts about the identity of the person making a request, we may ask for additional information necessary to verify identity.

We respond to data-protection requests without undue delay and normally within one month, subject to extensions and exceptions permitted by applicable law.

9. Complaints

You may raise any data-protection concern directly with us at:

pr@capitalrecruiters.com

You also have the right to lodge a complaint with a competent data-protection supervisory authority.

The supervisory authority in Estonia is:

Andmekaitse Inspektsioon
Estonian Data Protection Inspectorate

You may also have the right to complain to the supervisory authority in the EU or EEA country of your habitual residence, place of work or the place where you believe an infringement occurred.

You are not required to contact us before exercising your right to lodge a complaint with a supervisory authority.

10. Changes to this notice

We may update this Candidate Privacy Notice when our recruitment activities, technologies, service providers or legal obligations change.

Where required by applicable law, we will provide additional notice about material changes.

This notice concerns personal data processed in connection with candidate recruitment activities carried out by CapitalRecruiters OÜ. It does not replace separate information that may apply to website cookies, analytics, clients, employees or other processing activities outside the scope of this notice.