LOTOS E&P Norge privacy notice (download .pdf)

RECRUITING DATA PRIVACY NOTICE

1. INTRODUCTION

LOTOS Exploration and Production Norge AS (“LOTOS”, the “Company” or “we”)., respects and protects the data privacy of those applying for employment with our company. The purpose of this notice is to explain when, why and how we process personal data about persons that have applied for or otherwise expressed an interest in employment with LOTOS, or that we for other reasons consider recruiting (jointly hereinafter “job applicants”).
This notice also serves as a binding instruction on anyone processing personal data on behalf of LOTOS. No job applicant personal data shall be processed on behalf of LOTOS unless in compliance with this document.

2. WHO IS RESPONSIBLE? CONTACT DETAILS

The “controller” that is responsible for LOTOS’s processing of the job applicants’ data is LOTOS Exploration and Production Norge AS.
If you have questions or requests related to our processing of your personal data, please contact us at: recruitment.norway@lotosupstream.no or directly jacek.wroblewski@lotosupstream.no.

3. WHAT TYPES OF PERSONAL DATA ABOUT JOB APPLICANTS DO WE PROCESS?

3.1 General
LOTOS will only process personal data about job applicants that we an objective and legitimate need for as part of the recruitment process.
3.2 Examples of categories of personal data the Company may process
LOTOS collects, processes, and uses the following categories of personal data about job applicants in connection with recruiting activities (collectively, "Recruiting Data"):

• Identification data, such as your name, User ID and password (if you apply via our recruiting website), citizenship, and date of birth;
• Contact details, such as your home addresses, telephone numbers, and email addresses;
• Recruitment-related information, such as information regarding previous work experience (including references from previous employers), qualifications and work history, educational background, language skills, professional skills and talents, professional memberships, community involvement, geographic mobility interests, reports from external recruitment firms (where applicable) and results from personality tests or equivalent tests (where applicable), and any other information you have provided in your job application;
• Interview notes; including notes about information you have provided in interviews with us and observations and assessments made, and
• Communication details, such as email content

3.3 Sensitive data
Wherever possible, the Company will seek to avoid processing special categories of personal data (sensitive data) about job applicants but may do so when necessary in special cases:
- We may process data which a job applicant has provided to the Company voluntarily, such as information about political posts, religion or trade union membership.
- We may process health data about a job applicant when this is necessary in relation to performance of the duties associated with the post, in accordance with applicable laws. We may in special cases require medical examination of job applicants when required or allowed by applicable laws.
3.4 Special provisions on criminal convictions and offences
Data concerning criminal convictions and offences will in general not be processed. In particular cases, and when allowed by applicable laws, certificates of good conduct may be obtained from the police.
3.5 The sources of the personal data
The data we process will primarily be provided to the Company by the job applicant through the job application or job interviews. In some cases, the Company may collect personal data about a job applicant from other sources, such as references, previous employers and colleagues, public authorities, schools, publicly accessible information sources such as the Internet and public social media profiles, or, where permitted by law/regulations, certificates of good conduct or credit report. We will may not collect data on job applicants from private social media profiles.

4. THE PURPOSE OF PROCESSING – WHAT THE DATA ARE USED FOR

Personal data about job applicants will be processed by the Company for the following purposes:

• Recruiting activities; including administering the recruitment process, making a hiring decision (including assessing qualification and tracking candidates during the application process, and carrying out interviews), and completing the hiring process in case you should be offered and accept a position with the Company (including activities related to on-boarding and the new hire process)
• Complying with applicable laws and employment-related requirements along with the administration of those requirements, such as employment and immigration laws.
• Communication with the job applicant, within the Company group, and/or with third parties.
• Responding to and complying with requests and legal demands from regulators or other authorities.

5. THE LEGAL BASIS FOR PROCESSING

5.1 Non-sensitive personal data
Legal basis for the processing of personal data may be found in Article 6(1)(f) of the General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679 http://eur-lex.europa.eu/eli/reg/2016/679/oj (balancing of interests). The purpose pursued by the Company in this context is that set out in section 3 above.
5.2 Special categories of personal data
As regards special categories of personal data (sensitive data), legal basis for processing may be found in Article 9(2)(b) of the GDPR, when such processing serves the purpose of enabling the Company to exercise its rights and carry out its obligations in the field of employment, social security and social protection law. Legal basis for the processing of such data may also be found in Article 9(2)(e) of the GDPR if it involves data which have manifestly been made public by the data subject, and in Article 9(2)(f) when processing is necessary for the establishment, exercise or defence of a legal claim.
5.3 Consent
Normally, the Company’s processing of personal data related to job applicants is not based on consent. Ordinarily, therefore, no such consent will be requested from job applicants. However, consent may be obtained and used in special cases where consent is needed and can be deemed to have been given voluntarily. Potential examples include when the Company obtains consent for the retention of the job application of an unsuccessful candidate who is nevertheless regarded as an interesting prospect for future opportunities. Such consent may also be obtained when the Company receives job applications that are not linked to a specific position, but where it may be relevant to store the job application for prospective engagements.

6. RECIPIENTS AND ACCESS RESTRICTIONS

The personal data will subject to access restrictions, and only distributed to a limited group of recipients. Access to personal data about to our job applicants is thus as a starting point limited to the persons involved in the recruitment process on the Company’s behalf. If the data is not connected to a specific recruitment process, the processing of the personal data relating to the job applicant will be restricted to the HR department. In particular cases, our IT and legal department, and external resources such as our data processors and external recruitment agencies may be given access. The data may also be shared with the authorities upon request.

7. USE OF PROCESSORS AND TRANSFERS ABROAD

The Company may use suppliers (processors) to assist with the processing of personal data about the job applicants. This may occur, for example, where the IT function or the back-up storage of Company data are outsourced to external suppliers. The Company may also, provided there is legal basis for this, transfer the personal data abroad, including to non-EU/EEA countries whose data protection laws do not provide the same level of data protection as in Norway and the EU/EEA. The typical reasons for such transfers include the use of external data storage services. The legal basis for this will be EU Model Contracts, Privacy Shield certification or other recognized legal basis.
Personal data may be transferred to other legal entities within the LOTOS group, in the same or in other countries, and the recipient company may be acting as either controller or a processor. Such transmissions may be due to group centralisation of functions such as HR, accounting and legal services, or because the management of the group, and thus indirectly the Company, is performed from abroad.
An overview of the Company’s use of processors and transfers of personal data abroad is information is available for our job applicants upon request.

8. STORAGE LIMITATIONS – FOR HOW LONG DO WE RETAIN THE DATA?

Personal data related to job applicants will only be stored for as long as necessary for the purpose of the processing, and will then be erased.
Once the recruitment process has ended, the Company will, as a main rule, delete the personal data related to those job applicants that has not received a job offer. This will routinely be done within 3 months after the position has been filled, unless an unsuccessful applicant has asked questions or made objections that necessitate longer storage of the information.
In some situations, it may be appropriate and practical to store personal data from unsuccessful candidates that are regarded as an interesting prospect for future opportunities, or when the company receives open applications. In such situations, the Company will obtain consent from the job applicant as described in section 5.3 above. The personal data relating to such candidates may be stored for up to 12 months after consent is contained

9. THE RIGHTS OF THE JOB APPLICANTS AS DATA SUBJECTS

The data protection laws grants certain rights to job applicants in their capacity as data subjects. As a data subject, you have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request restriction of processing of your personal data; (v) request data portability; (vi) object to the processing of your personal data. If the processing of the personal data is based on consent, the job applicant has the right to withdraw the consent at any time with future effect. The job applicant also has the right to lodge a complaint with the local data protection/surveillance authority. Further details of these rights can be found in chapter III of the GDPR. To exercise your rights please contact us at the contact point stated in section 2 above.