Baltic Workboats AS Personal Data Processing Principles
INTRODUCTION
These personal data processing principles describe how Baltic Workboats AS (registry code 10657801, address Saare county, Saaremaa municipality, Nasva small borough, Sadama tee 26, 93872, hereinafter “Baltic Workboats” or “we”) processes your personal data when you contact us to receive a service, use our website, conclude a contract with us, or apply for a job with us. Please read these terms carefully, and if you have any specifying questions about how we process your personal data, or if you wish to submit requests to us to exercise your rights accompanying the processing of your personal data, please contact us using the contact details provided in the “Contact” section below.
1. DEFINITIONS
– “GDPR” – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
– “Personal data” – Any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
– “Applicable law” – All valid legislative acts of the European Union and all valid legislative acts of the Republic of Estonia, including, but not limited to, the national implementing acts of the GDPR.
– “Data subject” – A natural person who contacts or has contacted Baltic Workboats to receive a service.
– “Processing” – Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
– “Data controller” – A natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of these personal data processing conditions, the data controller is Baltic Workboats AS.
– “Data processor” – A natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.
– “Cookies” – Small text files that are stored on your device (computer, smartphone) upon visiting our website, to ensure the proper functioning of the site, security, and to collect statistical information.
2. GENERAL PROVISIONS
2.1. The conditions of personal data processing apply when you contact Baltic Workboats to receive a service or in connection with submitting an inquiry, visit our website, conclude a contract with us, or participate in our recruitment process.
2.2. The personal data processing principles describe the general principles of personal data processing established by Baltic Workboats.
2.3. Baltic Workboats takes seriously its obligation to process personal data lawfully and in accordance with applicable law. The most important legislative acts that Baltic Workboats bases its personal data processing on are the Personal Data Protection Act, the GDPR, and the European Union Artificial Intelligence Act (AI Act).
3. COLLECTION OF PERSONAL DATA
3.1. If you contact Baltic Workboats with an inquiry, we process your personal data to respond to and process your inquiry, in which case we only process the personal data that you have voluntarily disclosed to us (e.g., e-mail address, name, content of the inquiry).
3.2. If you conclude a contract with Baltic Workboats, we process your personal data to the extent necessary for the performance of the contract concluded with you or for the preparation of the contract.
3.3. If you visit our website (www.bwb.ee), we process data concerning your visit to the website (for example, data about the web browser and operating system, including the date and time of the visit, the use of website functions, information about the website through which you arrived at our website).
3.3.1. Use of cookies: Our website uses the CookieYes platform to manage cookie preferences. We collect data through the following categories of cookies:
– Strictly necessary cookies (Necessary): These are always active and necessary to ensure the basic functions and security of the website (e.g., Cloudflare and Google reCAPTCHA cookies __cf_bm, _GRECAPTCHA, rc::a, rc::b used to repel malicious bots and spam, and the cookieyes-consent cookie intended for saving your cookie preferences). They do not store directly identifiable personal information.
– Functional cookies (Functional): Help perform certain functionalities, for example, sharing website content on social media platforms or enabling third-party functionalities (e.g., the Calendly cookie _cfuvid used for managing appointments).
– Analytical cookies (Analytics): These are used only with your prior consent. They help us understand how visitors use the website, providing information on the number of visitors, bounce rate, and traffic sources (e.g., Google Analytics cookies _ga and _ga_*).
– Performance and advertisement cookies (Performance & Advertisement): Currently, no marketing tracking cookies are used on the Baltic Workboats website.
3.4. Baltic Workboats uses security cameras on its company territory to protect persons and property. Therefore, if you enter our territory, you must consider that your image may be recorded. There are information signs regarding the use of cameras in the areas where cameras are used.
3.5. In the recruitment process, we collect and process your personal data with the aim of assessing your suitability for a vacant position. The collected data includes identification and contact details (name, personal identification code, contacts) as well as information regarding education and work experience (CV, motivation letter, diplomas, portfolios). We may also collect information from referees listed in your CV (provided you have given them consent to transmit the data) and perform background checks from public sources. Providing this data is a prerequisite for concluding an employment contract.
4. LEGAL BASES FOR PROCESSING PERSONAL DATA
4.1. For the provision of services and products and the performance of contracts, we process personal data on the basis of Article 6(1)(b) of the GDPR.
4.2. If you have given us separate consent to process your personal data, we will process your personal data on the basis of the consent given by you, in which case the legal basis for processing personal data is your consent under Article 6(1)(a) of the GDPR. In such a case, we process your personal data for the purposes specified in the consent and to the extent indicated in the consent. If you have given us consent to process your personal data, you have the right to withdraw the consent given to us at any time.
4.3. We may also process personal data in the case of a legitimate interest of Baltic Workboats, for example, for statistical purposes or for the purpose of managing customer relations, but also for the purpose of ensuring security, in which case the legal basis for processing personal data is Article 6(1)(f) of the GDPR. The legal basis for the use of security cameras is our legitimate interest in ensuring the safety of employees and visitors on the company’s territory and protecting the company’s property. In any case, we process personal data provided that your interests as a data subject and the interference with the data subject’s private life do not override the legitimate interest of Baltic Workboats.
4.4. Baltic Workboats does not make automated individual decisions or perform profiling in recruitment or other processes in accordance with Article 22 of the GDPR. The entire recruitment process and the final decision on the candidate’s suitability is made 100% by a human (recruitment team). As a supporting tool, we may use paid and secure business client versions of large language models (e.g., OpenAI, Gemini) for the text analysis of recruitment documents (e.g., CVs). When using these solutions, the service providers act solely as our data processors, and the data processing agreements (DPA) concluded with them ensure that the entered personal data is kept securely and is not used for training public artificial intelligence models.
5. TRANSMISSION OF PERSONAL DATA AND USE OF DATA PROCESSORS
5.1. Baltic Workboats does not transmit your personal data to third parties, except when having a lawful right to do so under applicable law.
5.2. Under applicable law, Baltic Workboats has the right to use data processors for the processing of personal data. Baltic Workboats’ data processors, who in limited cases may process the personal data of our clients or candidates, include, for example, Baltic Workboats’ IT service providers (e.g., server service providers, IT software developers), recruitment software providers, security service providers, and providers of similar services.
5.3. Baltic Workboats uses as data processors only those cooperation partners who have undertaken the obligation to process personal data in accordance with these personal data processing principles and applicable law (including ensuring that the data is not subjected to unauthorized use for training AI models).
5.4. Some of our data processors or their servers may be located outside the European Economic Area (EEA), for example, in the United States (including service providers such as Google, Cloudflare, OpenAI). In such cases, we ensure that the transmission of personal data takes place strictly in accordance with GDPR requirements. We implement appropriate measures for data protection, relying, for example, on the European Commission’s adequacy decision (for the US, the Data Privacy Framework) or using standard data protection clauses (SCC) approved by the European Commission.
6. RETENTION OF PERSONAL DATA
6.1. Baltic Workboats does not retain personal data for longer than is necessary based on the purpose of the personal data processing or applicable law.
6.2. For the retention of inquiries, we rely on the limitation period arising from a transaction as stipulated in § 146 subsection 1 of the General Part of the Civil Code Act and retain data related to your inquiries for up to 3 years.
6.3. For the retention of data related to contracts, we rely on the limitation period arising from a transaction as stipulated in § 146 subsection 4 and retain data related to your contract for up to 10 years.
6.4. On the basis of the Accounting Act, we retain accounting documents for 7 years.
6.5. We typically retain security camera recordings for 3 weeks, except when a recording related to a specific security incident needs to be retained longer for the purpose of investigating the incident.
6.6. We retain the personal data (CV and other documents) of candidates who participated in the recruitment process but were not selected for 1 year from the end of the respective competition to resolve potential disputes. With the explicit consent of the candidate, we may retain personal data for an agreed period longer to offer you participation in other competitions in the future.
6.7. If you wish to receive more detailed information about the retention periods of personal data related to you, please contact us using the contact details provided in the “Contact” section below.
7. YOUR RIGHTS AS A DATA SUBJECT
7.1. You have all the rights arising from applicable law for a data subject in the processing of your personal data.
7.2. You have, among others, the following rights in the processing of personal data:
7.2.1. Right of access: You have the right to ask at any time whether Baltic Workboats has personal data about you or not and to receive information about which personal data Baltic Workboats processes about you;
7.2.2. Right to rectification of personal data: You have the right to request Baltic Workboats to specify or rectify your personal data if it is inadequate, incomplete, or incorrect;
7.2.3. Right to object: You have the right to submit objections to Baltic Workboats regarding the processing of your personal data, for example, when the use of personal data is based on the legitimate interest of Baltic Workboats;
7.2.4. Right to request the erasure of personal data: You have the right to request the erasure of personal data, for example, when personal data is processed on the basis of your consent and you have withdrawn your consent;
7.2.5. Right to restrict processing: You have the right to demand that Baltic Workboats restricts the processing of your personal data on the basis of applicable law, for example, if Baltic Workboats no longer needs your personal data for processing purposes or if you have objected to the processing of personal data;
7.2.6. Right to withdraw consent given for the processing of personal data: if the processing of personal data is based on your given consent, you have the right to withdraw the consent given to Baltic Workboats at any time;
7.2.7. Right to data portability: You have the right to receive the personal data from Baltic Workboats that you yourself have submitted to Baltic Workboats and which are processed on the basis of your consent or for the performance of a contract concluded with you, in writing or in a commonly used electronic format, and, if technically feasible, to require that Baltic Workboats transmit this data to a third-party service provider;
7.2.8. Right to lodge a complaint: If you find that your rights have been violated during the processing of your personal data, you have the right to turn to the Data Protection Inspectorate or a court with a claim or complaint.
7.3. The rights regarding the processing of personal data listed in this chapter for you are not absolute rights. In certain cases, the rights of other data subjects or the legal obligations of Baltic Workboats may restrict the data subject’s rights.
7.4. To exercise the rights accompanying the processing of personal data or to submit requests related to the processing of personal data, please contact us using the contact details provided in the “Contact” section below.
8. SECURITY OF PERSONAL DATA
8.1. Baltic Workboats commits to ensuring the security of personal data processing with the aim of protecting personal data against unintentional or unauthorized processing, disclosure, or destruction.
8.2. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons arising from processing, Baltic Workboats implements appropriate technical and organisational measures to ensure the security of personal data during processing.
9. CONTACT
9.1. In case of questions related to the processing of personal data or to submit requests related to the processing of personal data, please contact Baltic Workboats at the contact details below.
Baltic Workboats contact details are:
Baltic Workboats AS
E-mail: contact@bwb.ee
Phone: +372 452 1140
Address: Sadama 26, Nasva 93872 Saaremaa, Estonia
