PERSONAL DATA PROCESSING INFORMATION NOTICE ON LINKEDIN PAGES SMARTREE

Effective from May 25, 2018

In this document, you can find information regarding the following topics:

1. WHO WE ARE
2. CONTACT INFORMATION
3. WHAT DATA WE PROCESS ABOUT YOU
4. HOW WE SHARE INFORMATION
5. TRANSFERS OF INFORMATION OUTSIDE THE EUROPEAN UNION YOUR RIGHTS

1. WHO WE ARE

Smartree Hrtech SRL is a company headquartered in Bucharest, at Expo Business Park, Strada Aviator Popisteanu, no. 54A, Building 2, 4th floor, Sector 1, registered at the Trade Register under no. J40/6894/2020, fiscal code 42674725 (hereinafter referred to as “Smartree”, “we” or any similar term). As administrators of our LinkedIn page (hereinafter referred to as “our page”) together with LinkedIn Ireland Unlimited Company (“LinkedIn Ireland”), located at Wilton Place, Dublin 2, Ireland, the provider of the LinkedIn professional social platform, we collect and process various categories of personal data from you as a user of our LinkedIn page: www.linkedin.com/company/smartree-romania, which, in accordance with European Union data protection legislation, makes both us and LinkedIn joint data controllers for such data. Details regarding the essence of personal data processing can be found here.

This Personal Data Processing Information Notice describes our practices regarding the collection and use of your personal data following your interaction with our LinkedIn page. Please read this Information Notice carefully to understand how we process your personal data.

We reserve the right to modify, whenever we deem appropriate, our data protection practices and to update or modify this Information Notice at any time. For this reason, we encourage you to check this Information Notice periodically. This Information Notice is updated as of the date indicated at the top of the document. We will handle your personal data in accordance with the Information Notice under which the data was collected, unless we have your consent to treat it otherwise.

For the collection and processing of your data separately by LinkedIn, over which we have no control, please consult LinkedIn’s policy, available at: LinkedIn Privacy Policy.

2. CONTACT INFORMATION

Please address your questions regarding data protection and any requests to exercise your rights to the following contact information of our personal data protection officer: dpo@smartree.com. We will investigate and try to resolve any complaints or requests related to your rights. If you are not satisfied with the response, you can file a complaint with the National Authority for the Supervision of Personal Data Processing, whose contact information is listed below, in section 6.

3. WHAT DATA WE PROCESS ABOUT YOU

On our page, we process the following personal data:

If you interact with our page’s content (like, share), we can view your public profile and the action taken.
If you comment on a post on the page, we have access to your public profile as well as the content and date of the comment.

When you follow or interact with our page, LinkedIn processes certain personal data about you, based on which they provide us with aggregated statistics. The data we have access to does not include personal data directly but is limited to:

The number of followers and their demographic distribution (industry, city, and country)
The number of views distributed by days
Aggregated demographic data: occupation, country, region, seniority, industry, company size
The number of views for life pages
Number of clicks, impressions (number of content displays on the page), likes, comments, shares.

When we customize the audience for our posts or advertising campaigns on LinkedIn, we can set professional and geographical categories that may include you (e.g., human resources professionals from Romania). When we post recruitment ads on LinkedIn, depending on the criteria set by us, LinkedIn provides us with a list of people who, according to its algorithms, match our criteria. These individuals are included in the list without our involvement, but only if they have enabled the Open Candidates option, which allows you to signal recruiters that you are interested in job offers. Additionally, our recruitment staff may search LinkedIn for profiles that meet our needs, in which case we will seek to respect the Open Candidates option. If the option is enabled, we will be able to save your profile and contact you directly. If you see our recruitment ad on LinkedIn and submit your application, we will receive all the data you provide (CV and cover letter, if attached, as well as your LinkedIn profile). Further processing of this data after the submission of your application through LinkedIn is subject to our recruitment information notice, the link to which is found in the recruitment ad.

Furthermore, when we use LinkedIn to promote recruitment ads (Job postings), we can customize the audience of these ads by setting the industries we want to target. LinkedIn provides us with aggregated statistics related to the job posting (Job traffic details), which include the following data about those interacting with our ad: the company they work for, number of views of the ad, number of views with the intention to apply (view to apply rate), number of clicks, and applications. LinkedIn automatically provides us (without our control) with suggestions for suitable candidates, which means we have access to the data you choose to share during the recruitment process.

To manage your individual LinkedIn data rights in the context of recruitment on LinkedIn, you can consult LinkedIn’s settings section. The data that can be collected and processed through LinkedIn for this customization is determined by LinkedIn without our involvement. These data are collected and processed by LinkedIn, but we only have access to the classifications already established by LinkedIn. For more information on this collection and processing, please read LinkedIn’s privacy policy at LinkedIn Privacy Policy.

These data are processed in our legitimate interest to promote our brand and activity and to be able to prove, if necessary, our correspondence with you through post comments. Regarding the processing of job application data, processing is done in our legitimate interest to fill vacant positions in our organization. The data is kept for the entire duration that our page is active, except for the data processed in the context of recruitment, which is subject to the dedicated information notice and the associated processing period. You should understand that all this data is available at any time to LinkedIn, as the platform owner (and consequently, as the controller of your personal data). For details on LinkedIn’s data processing, please access its privacy notice at LinkedIn Privacy Policy.

We do not use your data to send you marketing communications unless you expressly opt-in for such communication. Even in such cases, we ensure that you have a simple option to unsubscribe (withdraw your consent) at any time, either within the communication itself or by contacting us as indicated in Section 2. Regarding LinkedIn-managed commercial communications, you have a set of options that you can configure through the means provided by LinkedIn. Providing personal data is not mandatory, and you can individually set LinkedIn’s access rights to your data. However, you should understand that, within the limits of this filter available to you, LinkedIn operates uniformly across all pages and users, so if you interact with our page (which you can choose not to do), we will automatically have access to certain data about you, as outlined above. To manage your individual LinkedIn data rights, you can consult the LinkedIn settings section LinkedIn Privacy Policy.

4. HOW WE SHARE INFORMATION

We will only disclose your personal data for the purposes and to the third parties described below. We will take appropriate measures to ensure that your personal data is processed, secured, and transferred in compliance with legal requirements. Regarding information sharing by LinkedIn, please consult LinkedIn’s policy at LinkedIn Privacy Policy.

4.1 Disclosure of Data to Third Parties

We will share the necessary portion of your personal data only when required and only with the following categories of third parties:

(a) LinkedIn, which is a joint data controller of your personal data;
(b) Third-party entities that may administer the page (e.g., marketing agencies);
(c) Other entities such as public authorities and institutions, accountants, auditors, lawyers, and other professional advisors, where their activity requires knowledge of this information, or where the law requires us to disclose it;
(d) Companies that provide us with products and services (processors), such as IT system providers and related support service providers, telecommunications providers, backup and disaster recovery services, and IT security services.

Additionally, we will disclose your personal information to third parties:

(a) If you request or give us your consent to do so;
(b) To individuals who can demonstrate they have the legal authority to act on your behalf;
(c) In case of page transfer, which may occur in our legitimate interest of expanding or developing our business, such as:*
(i) In the event of a business transfer (if we sell part of our business or certain assets) related to the page you follow, the buyer will take over the page along with your data;
(ii) If Smartree (or a substantial part of its assets) is acquired by a third party, in which case our LinkedIn pages will be among the assets transferred.

(d) If we are obligated to disclose your personal data to comply with a legal obligation, any legal request from government or executive authorities, or as necessary to meet national security or law enforcement requirements or to prevent illegal activities;
(e) To respond to any claims, protect our rights or the rights of a third party, protect the safety of any person, or prevent illegal activity; or
(f) To protect the rights, property, or safety of Smartree, its employees, customers, suppliers, or other individuals.

LinkedIn may also disclose your personal data to third parties without our involvement or control, which you can learn about by reading LinkedIn’s privacy policy at LinkedIn Privacy Policy.

Some of these recipients may use your data in countries outside the European Economic Area (EEA).

Please refer to section 5 below for more details on this topic.

4.2 Restrictions on the Use of Personal Information by Recipients

The third parties to whom we provide your personal data, as specified above, are limited (by law and by contract) regarding how they can use your personal data for the specific purposes we have identified. We will always ensure that any third parties with whom we share your personal data are subject to confidentiality and security obligations in line with this Information Notice and applicable laws. However, for the avoidance of doubt, this provision does not apply where the disclosure is not our decision, including in the case of processing performed by LinkedIn. Except as detailed above, we will not disclose any of your personal data to a third party without informing you.

5. TRANSFERS OF DATA OUTSIDE THE EUROPEAN UNION

As a general rule, we do not transfer your data to recipients outside the European Union. However, if this happens, we will take appropriate measures to ensure that the recipient adequately protects your personal information, such as entering into standard contractual clauses approved by the European Commission, and we will update this Information Notice accordingly.

Additionally, LinkedIn may transfer your data outside the European Union, about which we encourage you to consult LinkedIn’s privacy policy.

6. YOUR RIGHTS

As a data subject, you have specific legal rights regarding the personal data we collect from you. Smartree will respect your rights and respond appropriately to your requests.

Although we are joint data controllers with LinkedIn, there is no real joint data processing between us and LinkedIn, meaning that we can only manage your requests regarding the processing performed by us. If you want to exercise any of your rights concerning LinkedIn, please contact LinkedIn as indicated in its policy.

Your rights include the following:

a. The right to withdraw consent:

If you have given your consent for the processing of your personal data, you may withdraw your consent at any time.

b. The right of access:

You may request information about the personal data we hold about you, including information about the categories of data we hold or control, what it is used for, the source from which we collected it if obtained indirectly, and to whom it is disclosed, if applicable. We will provide you with a copy of your personal data upon request. If you request multiple copies of your personal data, we may charge a reasonable fee based on administrative costs. You also have the right to information about the safeguards we apply to the transfer of your personal data to a country outside the EU and EEA if we transfer your data to such a country.

c. The right to rectification:

You may obtain the rectification of personal data that we process about you. We make reasonable efforts to ensure that the personal data we hold and continuously use is accurate, complete, up-to-date, and relevant, based on the most recent information available to us.

d. The right to restriction:

You may obtain from us the restriction of the processing of your personal data if:

You contest the accuracy of your personal data, for the period necessary for us to verify the accuracy;
The processing is unlawful, and you request the restriction of processing rather than the deletion of your personal data;
We no longer need your personal data, but you request it for establishing, exercising, or defending legal claims; or
You object to the processing while we verify if our legitimate grounds override your rights.
e. The right to portability:

You have the right to receive your personal data that you have provided to us, and, where technically feasible, to request that we transmit your personal data (that you have provided) to another organization. These two rights apply if the following conditions are met:

We process your personal data through automated means,
Our processing is based on your consent or necessary for the performance of a contract to which you are a party;
The transmission does not negatively affect the rights and freedoms of others.
f. The right to erasure:

You have the right to request the deletion of your personal data that we process about you. We must comply with this request if we process your personal data unless the data is necessary:

For exercising the right of freedom of expression and information;
To comply with a legal obligation;
For public interest purposes, scientific, historical research, or statistical purposes; or
To establish, exercise, or defend legal claims.
g. The right to object:

You may object at any time to the processing of your personal data on grounds relating to your particular situation, provided the processing is not based on your consent but on our legitimate interests or those of a third party. In this case, we will no longer process your personal data unless:

We can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms; or
The processing is necessary for establishing, exercising, or defending legal claims.

If you object to processing, please specify whether you also want your personal data to be deleted; otherwise, we will only restrict it. You may always object to the processing of your personal data for direct marketing purposes, regardless of the reason. If marketing is based on your consent, you can withdraw your consent.

We will try to fulfill your request within 30 days. This period may be extended for specific reasons related to the specific legal right or complexity of your request. In any case, if this period is extended, we will inform you about the extension and the reasons for it.

h. Right to file a complaint:

If you are not satisfied with how we process your data, we prefer that you contact us directly so we can resolve your issue. However, you may also contact the National Supervisory Authority for Personal Data Processing through its website (www.dataprotection.ro) or write to:

The National Supervisory Authority for Personal Data Processing
B-dul G-ral. Gheorghe Magheru 28-30,
Sector 1, Postal Code 010336,
Bucharest, Romania
Phone: +40.318.059.211
Email: anspdcp@dataprotection.ro