Recruitment Privacy Policy

This Policy was updated: 19 October 2026

In this Recruitment Privacy Policy (hereinafter - Policy), we present in detail how Creditonline Ltd, the legal entity code 301867534, address Laisvės al. 82, LT-44250 Kaunas (hereinafter referred to as the Company) manages personal data of job candidates. This Policy sets out:

what recruitment-related personal data we collect about our internal and external job candidates;
how and for what purposes we process such recruitment-related personal data, including the right to share it with Associated Companies¹ for the same recruitment purpose (e.g., to suggest a relevant job opportunity);
how long do we keep your personal data;
other information relevant to you.

Please note that this Policy may change without notice. The latest version is always available on the Company's website www.creditonline.eu/recruitment-privacy-policy.

1. What personal data we collect about job candidates and for what purposes?

In order to select a suitable candidate for an open job vacancy, we collect the following personal data of candidates:

name, surname;
place of residence or place of residence;
e-mail address and / or telephone number;
information on the candidate's work experience (names of employers, period of work, duties, responsibilities and (or) achievements);
information about the candidate's education and qualification;
information on language proficiency and other competences required for the performance of the position in question;
a summary of the interview with the candidate and the results, feedback and insights from the person who selected the selection;
other volunteers' information in a CV, a motivation letter or other candidate documents (e.g. recommendations, feedback). If the candidate chooses to submit such data, they will be processed in the same way as the applicant's personal data requested by the Company.

Special categories of personal data (e.g. health information, information about criminal records) can only be collected if it is necessary for selection in a job position and only to the extent necessary and permitted by applicable law.

The company may also collect candidates' personal data relating to qualifications, professional abilities and business characteristics from the former employer, after informing the candidate about it, and from the existing employer only with the consent of the candidate.

In order to reach out to you with future job possibilities (hereinafter – Administration of the Candidate Database), we collect the following candidates' personal data:

name, surname;
place of residence or place of residence;
e-mail address and / or telephone number;
information on the candidate's work experience (names of employers, period of work, duties, responsibilities and (or) achievements);
information about the candidate's education and qualification;
information on language proficiency and other competences required for the performance of the position in question;
a summary of the interview with the candidate and the results, feedback and insights from the person who selected the selection;
other information in a CV, a motivation letter or other candidate documents (e.g. recommendations, feedback). If the candidate chooses to submit such data, it will be processed in the same way as the candidate’s personal data requested by the Company.

In order for Associated Companies to select a suitable candidate, to reach out to you with future job possibilities (Joint Administration of the Candidate Database), we collect the following candidates' personal data:

name, surname;
place of residence or place of residence;
e-mail address and / or telephone number;
information on the candidate's work experience (names of employers, period of work, duties, responsibilities and (or) achievements);
information about the candidate's education and qualification;
information on language proficiency and other competences required for the performance of the position in question;
a summary of the interview with the candidate and the results, feedback and insights from the person who selected the selection;
other information in a CV, a motivation letter or other candidate documents (e.g. recommendations, feedback). If the candidate chooses to submit such data, it will be processed in the same way as the candidate’s personal data requested by the Company.

2. How long do we keep your data?

In order to select a suitable candidate for a job, we collect the data:

with the consent of the candidate, upon submission of employment documents (Article 6 (1) (a) of the Regulation);
having a legitimate interest in selecting a suitable candidate for a job (Article 6 (1) (f) of the Regulation).

We store the data for 3 months after the deadline for submission of applications.

For the purpose of administering the Candidate Database, we collect data:

with the consent of the candidate (Article 6 (1) (a) of the Regulation).

For the purpose of joint administration of the Candidate Database with Associated Companies, we collect data:

having a legitimate interest in selecting a suitable candidate for a job by Associated Companies (Article 6 (1) (f) of the Regulation).

In both cases we store the data for 3 years from the moment of inclusion of the data into the Candidate Database (this term is calculated from the date of consent for inclusion in the database or from the moment the data is submitted, if the data are transmitted later than the consent is obtained).

Please note that the candidate has the right at any time to withdraw the consent for the inclusion of personal data in the company's database of candidates. You can do this by emailing us via personalas@creditonline.eu.

3. How do we obtain your personal data?

We obtain personal data of the job candidates:

directly from the candidates themselves, when they are submitted to us in the form of a CV, a motivation letter or other documents;
from the Public Employment Service, agencies providing recruitment, intermediation or selection services, recruitment portals (e.g., Upwork, CV online, CV bank) or specialized social networks (e.g., LinkedIn), via jointly (with Associated Companies) accessed Candidate Database. In all these cases, the Company presumes that the candidate is properly informed about the processing of his / her personal data and the transfer of such data to the Company and has given his consent to perform such activities to the relevant entity providing the abovementioned services.

4. Disclosure of personal data

Personal data of job candidates may be disclosed to the competent state supervisory and law enforcement authorities only in cases where this is required by the legislation applicable to the Company, or in cases and manner provided for by law, in order to enforce or defend the Company’s rights, and to assert or defend legal claims.

In addition to personal data access by Associated Companies, the following data recipients and data processors may also have access to the personal data of job candidates:

IT service providers who maintain and support Company's IT infrastructure (e.g., email system, servers, etc.);
Hiring software service providers (e.g., Recruitee) acting as data processors;
Electronic communication service providers;
Recruitment service providers;
Companies that provide auditing, legal or other services only to the extent necessary for the performance of their functions.

5. Rights of the job candidates

In accordance with the applicable international and national legislation regulating the protection of personal data, every candidate whose personal data are processed by the Company has the following rights:

to request for confirmation as to whether the Company processes data relating to the job candidate and, if it does, to request access to the processed data and other related information;
to request the rectification or, depending on the purposes of the processing of personal data, the completion of incomplete personal data;
to request the erasure of information held by the Company about a candidate if the Company is using it unlawfully or in other circumstances specified in applicable law (e.g. the legal basis for the processing has ceased to exist);
to request the restriction of the processing of personal data where the accuracy of the data is in question or the processing is objected to, or where the erasure of unlawfully processed, personal data is objected to, or where the data are necessary for the establishment, exercise or defence of legal claims;
to refuse to give consent or to withdraw prior consent to the processing of the job candidate's personal data where such processing is based on consent;
to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her – transfer of data to Associated Companies; Article 21 of the GDPR further applies;
to file a complaint to the State Data Protection Inspectorate (see https://vdai.lrv.lt);
to request the transfer of personal data of the job candidate to another data controller.

6. How can you exercise your rights?

All requests for the exercise of data subject rights should be made by job candidates in writing:

by e-mail personalas@creditonline.eu or
postal correspondence to Lvivo st. 105A, LT-08104, Vilnius.

Upon receipt of a data subject request, the Company must verify the identity of the data subject and therefore has the right to ask for additional proof of identity, such as personal identity document.

Responses to data subject requests shall be provided no later than 30 calendar days from the date of receipt of such request and all other documents necessary for the preparation of the response.

7. Data controller’s details

Creditonline, Ltd
Legal entity code: 301867534
Registered address: Laisvės al. 82, LT-44250 Kaunas
Email address for contact: personalas@creditonline.eu

¹ Associated Companies:

LITIT, Ltd, the legal entity code 306711133, address Lvivo st. 105A-101, LT-08104 Vilnius.
Reiz Tech, Ltd, the legal entity code 300067863, address Lvivo st. 105A-101, LT-08104 Vilnius.