Candidate Privacy Notice

MentorMate, LLC., headquartered in the U.S., and its group companies, (“MentorMate”, “we”, “us”, “our” or the “Company”) provides this Candidate Privacy Notice (the “Notice”) as part of its continuous effort to comply with the EU General Data Protection Regulation (“GDPR”) and commitment to protecting the privacy of individuals. 

Contact person at MentorMate regarding personal data: Eleonora Georgieva, contact email [email protected].

The purpose of this Notice is to explain which personal data is collected, used, and disclosed by MentorMate and our group companies during the recruitment and application processes, whether online or offline by job applicants (“candidates“) and/or internship opportunities, or in a potential enrollment in our training programs (the “Training Programs“), the reasons why we use and share such data, how long we keep it, what your rights are and how you can exercise them. We request from you to take some time to read this Candidate Notice in full and acknowledge your understanding of the information herein.

1.Personal data we collect 

1.1. In relation to your candidacy for employment at MentorMate:

MentorMate will be the controller of your data for the purposes of your application, administration, resource management, etc. We can also use local hiring entities (agencies). We will process candidates’ personal information for recruitment purposes.

Personal data categories:

When applying for a job with us, you need to provide us with some particular information about you so that we can assess whether you meet the requirements for the position and whether you are the most suitable candidate for it. Information submitted to MentorMate (online or offline) for review should only include information relevant to job qualifications and employment history, e.g., names, address, e-mail, phone number, prior employment, relevant positions and dates, significant accomplishments, education, degrees or certifications obtained, dates and issuing institutions, and other relevant awards or achievements. Usually, such information is provided via a CV or a resume of yours. Further, we may ask you for additional information during the different phases of the recruitment process, such as interviews, completion of tests, etc.

During the hiring process, we may obtain information about you from publicly available sources or from third parties including references, background check suppliers, and the like, to the extent allowable by law. We take steps to confirm that the information we receive from these third parties has been collected with your consent or that these parties are otherwise legally permitted to disclose your personal information to us. We explicitly emphasize that such background checks are not carried out by MentorMate Bulgaria Ltd. unless (accidentally) they are imposed in strictly limited and legally permitted cases.

During the application process, we collect and process personal information in connection with your application, including educational, work, and employment history, contact details, job qualifications, references, and previous jobs. You also may choose to provide us with additional information in your CV, employment, and work references, and related information. 

We do not request sensitive personal information in connection with recruiting. However, sensitive information might be voluntarily shared by you in your CV, even if it is not required or requested by us. Sensitive personal information includes, for example, government-issued personal identification number, information relating to a person’s race or ethnic origin, or any other information deemed sensitive under applicable data protection laws. Where permitted by law and to the extent applicable, we may carry out background and/or criminal checks to determine your suitability for an open position at MentorMate.

Sources of personal information:

  • MentorMate will collect information mostly from you. We will ask you to provide personal information about yourself at your discretion via a CV or a resume to process your application. However, some information may be explicitly required by us to complete an evaluation of your application.
  • Additionally, we may collect certain information from you during your visit to our websites. Please see our Privacy Policy with this respect. 
  • Further, you may choose to provide us with access to certain publicly available personal information stored by third parties (such as LinkedIn).
  • We may also collect information from third parties who are lawfully entitled to share your information with us, as explicitly explained hereinabove. For the use of such information, when it is not from public sources and requires your prior consent, we will not process such information or contact such third parties before we have your explicit written consent.

Use of information:

We use your personal information to process and evaluate your application, assess your skills, qualifications, and suitability for hiring, carry out verification checks, make hiring decisions, prepare a job offer and benefits packages, and maintain accurate and up-to-date recruiting records. Additionally, we can use the information to communicate with you about e.g., job and scholarship opportunities, manage and improve our recruiting and hiring processes and conduct reference and background checks to the permitted extent.

We may need a part of the information to keep records related to our hiring processes, subject to your consent, as described hereunder.

Finally, your data may be used to comply with MentorMate’s legal, regulatory, and corporate governance requirements.

Sharing information:

We will share your personal information internally and, where necessary, with service providers, agents, and other third parties (such as local hiring entities and recruiters, consultants, analytics providers, attorneys, and background checking services in connection with recruiting, where and to the extent it is legally permissible). We may share your information with our subsidiaries, or other affiliated or merged companies of MentorMate (е.g. Tietoevry Oyj, a company incorporated under the laws of Finland, with company number 0101138-5), and such information will only be shared in connection with your recruitment and employment.

In specific narrow cases and only if necessary to resolve any issues or disputes, it is possible for your personal information to be provided to our advisors (such as lawyers, outsourced HR consultants, etc.).

If we are in the process of transforming or restructuring our business, we may also provide your personal information to a narrow circle of stakeholders in this regard, if strictly necessary.

We might be obliged to provide your personal information to competent public authorities or other persons when required by law.

1.2. In relation to application/enrollment in Training Programs

Personal data categories:

All personal data we collect and process in relation to your application and potential enrollment in the Training Program includes the following personal data categories:

  1.  General Information: full name, personal identification number, address, contact details, photo image;
  2.  Application data: information collected during the application process, data from CVs, application forms, cover letters and similar documents, level of education (diplomas, certificates, etc.), previous work experience (if any), qualifications and skills, references; 
  3.  Information relating to your participation in the Training Program: attendance at the Training Program and its separate phases, performance evaluation (including test results and evaluation of practical tasks assigned in the course of the Training Program);
  4.  Access rights and security: identifiers and/or credentials assigned by the Company to allow you access to training materials; 
  5.  Other information you decide to voluntarily provide to us: e.g. about your motivation to participate in the Training Program, hobbies, personal/family status, etc.;
  6.  Financial information: details of the amount of the Scholarship, if eligible, and bank account details;
  7.  Special categories of personal data – we do not process requests or collect any special categories of personal data in relation to your application and enrollment in the Training Program. In limited cases, we may process some special categories of data (sensitive data) in the course of your participation in the Training Program only where such processing is required by legal obligation or based on your explicit prior consent. 

The provision of the above personal data categories is not statutory required. However, failure to provide this information may affect your ability to apply and enroll in the Training Program, as well the performance of our obligations towards you in this regard (e.g. management and/or administration of your participation in the Training Program). In some cases, this may ultimately make it impossible for us to approve your application and/or continue maintaining your enrollment in the Training Program. Where this is the case, we will in advance inform you of the consequences from your refusal to provide the relevant personal data.

Purposes:

Any personal data provided by you in the course of the application process for the Training Program and your enrollment term with us will be processed for the following purposes: 

  • reviewing and assessing your application for the Training Program; 
  • maintaining our relationship with you during the application process, including by calling you and inviting you to an interview, etc.;
  • improving our application process;
  • verifying your information and running our internal compliance checks;
  • marketing our business and business development; 
  • upon your enrollment in the Training Program – for the purpose of administration and management of your participation in the Training Program;
  • for security and protection of our organization, IT networks, and Company information;
  • communicating with you and informing you about career opportunities (if we have your consent to include you in our database for future recruitment processes).

We will also process and retain your personal data to the extent necessary to fulfil other legitimate interests which we may have as the organisers of the Training Program, such as: (i) to defend our rights in any legal, administrative, or court proceedings; (ii) to protect our legitimate interest in case of internal or external investigations of suspected or actual breach of law; (iii) to ensure compliance with our regulatory obligations: e.g. preventing fraud, terrorism, anti-money laundering rules, complying with financial regulatory rules as well as mandatory internal or external audits, or requests from the state authorities and other competent bodies.

If in future we would need to process your personal data for a purpose other than the above, we will provide you with information on that purpose and any other relevant information. Where necessary, we will seek your consent before processing your personal data for other purposes.

2. Legal basis 

2.1. In relation to job candidacy for employment

Legal basis:

The processing of the personal information provided by you and further verified by us is based on our legitimate interest in selecting the most successful and reliable candidate for the position, in accordance with the exceptional specifics of our activity.

If we choose you for the vacant position, we will conclude a contract with you. Some of the information provided by you may serve us precisely for the purposes of the conclusion of the labour/civil contract.

In rare cases, if for a vacant position, we need more specific information (proportional to the job description), such as health-related information, information collected from your former employers, and other information for which we do not have other ground for processing, this will be possible only if we receive your explicit consent to collect it. If you do not agree, such data will not be processed and will not be relevant to your application.

You will not be subject to profiling and/or decisions that will have a significant impact on you based solely on automated decision-making.

2.2. In relation to application and potential enrollment in Training Program:

Legal basis:

We will process your personal data based on the following legal grounds:

– fulfilment of a contract with you or for the implementation of pre-contractual measures that take place at your request (Article 6 (1) (b) GDPR); and/or 

– our legitimate interests (Article 6 (1) letter (f) GDPR), including: (i) to ensure that our organization, IT networks, and information are secure and (ii) to protect our interest and rights in event of investigated, suspected, or actual violations of law. 

– your consent to the processing of your personal data for one or more specific purposes (Article 6 (1) (a) GDPR).

If we rely on your consent as a legal basis for processing your data, you may withdraw your consent at any time by submitting a Withdrawal Request to the following e-mail: [email protected] or by declaring that in the consent link you have received from the company. As of the receipt of your Withdrawal, any personal data to which the Withdrawal refers would be deleted from our files and records.

We do not apply automated decision making, including profiling with respect to your personal data.

3. Retention and deletion of personal data related to job candidacy for employment and personal data related to Training Programs

We will retain personal information as long as it is needed to fulfill the purposes outlined in this Notice, unless a longer retention period is required or permitted by law (such as tax, legal, accounting, or other purposes). We may also retain your information in accordance with applicable law to consider you for other job opportunities, if you provide us with an explicit consent, unless you have told us that you do not wish us so. To the extent permitted or required by law, we may delete data at any time.

When we have no ongoing legitimate business need to process your personal information, we will delete it or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives or for technical reasons), then we will securely store your personal information and implement appropriate measures to prevent any further processing until deletion is possible.

With respect to MentorMate, please note that the information used for our recruitment process and information provided for applying for participation in Training Programs shall be stored by us for a period of 6 months after the last action at the end of the certain procedure (job application/Training Program application).

Subject to your explicit consent, we may further retain your personal data collected during the recruitment process and/or process for application for Training Program in our talent database for a period of 3 years for the purposes of providing you with information about new job openings at MentorMate that we consider suitable for your qualifications and informing you for new Training Programs that you might be interested in.

After the said periods we will erase and destroy all information in accordance with the law unless you have expressed your explicit consent that we may keep it for a longer period of time. You can always withdraw your consent and we will immediately delete your information. 

In case you are appointed, all the information that will not be used for the conclusion of a labour/civil contract with you will be deleted.

4. Data protection rights

In accordance with applicable laws, you have the following rights:

  • To access: you can obtain information relating to the processing of your personal data and a copy of such Personal Data;
  • To rectify: where you consider that your personal data are inaccurate or incomplete, you can require that such personal data be modified accordingly;
  • To erase: you can require the deletion of your personal data, to the extent permitted by law and to the extent the exceptions under Art. 17, para 3 of the GDPR do not apply;
  • To restrict: you can request the restriction of the processing of your personal data;
  • To require data portability: where legally applicable, you have the right to have the personal data you have provided to us be returned to you or, where technically feasible, transferred to a third party;
  • To withdraw your consent at any time, where the personal data you have provided to us are processed based on consent, as this withdrawal does not impede the lawfulness of the processing on the basis of your consent before it has been withdrawn;

By submitting information through our site, you may additionally click on and consent to receive information from our talent acquisition team. Please note that by clicking “unsubscribe” in any email communications we send you, or by submitting a request using our contact form on the website https://mentormate.com/, you can easily opt out of this additional information we may send you. You can object against the processing of personal data you have provided to us, which we process based on art. 6 of the GDPR (to protect our legitimate interest), as well as when such personal data are processed for the purposes of direct marketing. In case your objection is reasonable, the personal data you have provided to us will no longer be processed;

  • To limit the processing in case: the accuracy of the personal data is contested within a term which allows us to verify their accuracy; the data processing is unlawful, but you do not want to have the personal data you have provided to us deleted, but instead request the restriction of its use; we no longer need these personal data (for the purposes they have been collected), but you require such personal data for the establishment, exercise or defense of legal claims; you have objected to the processing of your personal data pursuant Art. 21, para 1 of the GDPR pending the verification whether our legitimate grounds override the interests of the data subject.
  • To lodge a complaint, allowing you or the data subject at any time, at your own discretion, to file a complaint before the competent supervisory authority. The competent supervisory authority in Bulgaria is the Bulgarian Commission on Personal Data Protection.

5. Security and confidentiality

We maintain (and require our service providers to maintain) appropriate organizational and technical measures designed to protect the security and confidentiality of any personal information we process. These measures include physical access controls, encryption, Internet firewalls, intrusion detection and network monitoring depending on the nature of the information and the scope of processing. Our staff who may have access to personal information are required to keep that information confidential.

6. International transfers

Personal information may be transferred, stored, and processed by us and our service providers, partners and affiliates in countries other than where your personal information was collected and other than where you reside, including the United States and other countries whose data protection laws may be different than the laws of your country but only to countries that provide an adequate level of personal data protection (similar to the one in the EU and EEA). When we transfer information to the USA, the transfer is subject to appropriate additional safeguards which ensure adequate Data protection in the USA (eg, concluded contract/s with approved standard contractual clauses). Where non-EU jurisdictions are not cleared by adequacy decisions of the European Commission, transfers thereto would be conducted only based on implemented Standard Contractual Clauses, approved by the European Commission for external providers (available here and here) or following the requirements set forth in Articles 44-49 of the GDPR. We protect your personal information in accordance with this Notice wherever it is processed and will take appropriate steps to protect your personal information in accordance with this Notice and applicable laws.