Privacy policy - Barona Eestonia

1. Introduction

This is an overview of how we process personal data in connection with the services we provide (recruitment, temporary staffing and personnel management). We comply with the requirements of the European General Data Protection Regulation (GDPR) and national laws in our operations.

In certain cases, the data controller of personal data may also be our customer, i.e. a company who is an employer and uses Barona’s services to recruit employees. In this case, the terms and conditions for the processing of personal data set by the employer also apply. Barona is the data processor and follows the instructions of the employer as the data controller in the processing of personal data among other things.

For some of the activities and processing of related personal data, the data controller is also Barona Eesti OÜ, Kotka 26, Tallinn, Estonia. These cases include recording the interest of candidates and potential candidates in a certain type of position, managing employment relationships related to temporary employment and administering the Barona website.

2. How do we process your personal data?

Barona collects personal data from you and, if necessary, from public sources, such as official registers.

In addition, in order to maintain and improve the quality of its services, Barona keeps information about your interest in applying for a job if you consent to it. As a general rule, we do not store detailed application data for longer than is necessary to provide the service, and we collect the data required for the application process anew each time.

3. What personal data do we process and why?

Activity	Personal data	Objective	Basis for processing
Applying for open positions	Name, e-mail, personal identification code, information in the CV, information provided by the candidate, language skills, education level, work experience	Receiving applications	Legitimate interest
Carrying out the application process	Information collected during the recruitment process, such as video interviews, interview notes and recommendations, communication with the candidate	Selecting suitable candidates	Legitimate interest
Referring a candidate for testing at the employer’s request	Data processing based on the service provider conducting the testing	Finding a suitable candidate for a vacant position	Legitimate interest
Retaining data after the application process for the purpose of resolving potential disputes	Details and documents related to the application	Application data are retained for the period of the legal right to object (1 year)	Legitimate interest
Registry queries	Credit and criminal records	Protecting the employer’s interests according to the needs of the position	Legal obligation, legitimate interest, consent
Recording the job search interest of the candidate/potential candidate	Name, type of position	Maintaining and improving the quality of Barona’s services	Consent
Temporary staffing (the employment contract is entered into with Barona who carries out all related administration and data processing). The service is provided for a Barona customer	All application process data + data related to the employment contract, accounting data, calculation of working time, salary data, leave and sick days, possible special needs, union membership	Employment contract management and provision of temporary staffing services	Legal obligation, contract
Online behaviour of website visitors	Browser information, IP address, analytical cookies	Optimisation of the user experience of the website visitor	Consent
Newsletters and marketing offers	Name, email	Marketing	Consent

4. Transfer of personal data

We only share your personal data with a specific employer and, if necessary, with a partner who carries out tests as part of the employment agency service. We also use the software of our partner (Recrur) to manage our services. Partners have access to some of your personal data in order to provide the relevant service. They have no right to use your personal data for other purposes or to store them for longer than is necessary to provide the service.

In the event of legal obligations, we also transfer your data to state and supervisory authorities, such as tax authorities, social insurance, data protection agencies, the police and courts.

Our employees have access to your personal data to the extent necessary for the performance of their duties.

With whom and for which purpose do we share personal data?

Categories of recipients	Purpose of transfer
Service providers	We cooperate with service providers who offer the additional services required for the functioning of Barona’s comprehensive solution. We also cooperate with providers of technical solutions and related security, such as IT service partners.
Testing	We use service providers who are tasked with testing the potential employee’s personality and abilities.

International transfer

Some of our data processing is done using cloud solutions. This means that some of the data may also be transferred outside the European Union in certain cases. In such cases, we ensure that the transfer of data complies with the applicable data protection rules and laws and that contractual, technical and organisational measures are in place.

5. Ensuring security of personal data

In order to ensure the security of all data, we use technical and organisational security measures. We ensure the protection of your personal data against intentional or unintentional destruction, alteration, unauthorised access or any other form of unlawful processing.

Security measures include: authentication and access management; passwords and needs-based access to data; secure network design; data loss prevention and other continuously updated security measures.

6. Storage and deletion of personal data

The retention periods of personal data depend on the purpose and legal basis of their processing. For example, we may be subject to a legal or contractual obligation to retain data for a certain period of time. It may also be based on your and our legitimate interest or your consent.

Consent-based data processing ends when you withdraw your consent.

Under the Accounting Act, we are obliged to store accounting data (transaction documents) for seven years from the end of the current financial year.

In order to resolve any disputes that may arise under the Equal Treatment Act, we store application data for 1 year.

According to the Employment Contracts Act, we are obliged to store the employment contract and related personal data for 10 years after the end of the employment relationship.

If you have any specific questions about the retention of personal data, you can contact us using the details below.

7. Individual rights

According to the Data Protection Regulation, you have certain rights in relation to the processing of personal data. Please note that in some cases you will need to contact the data controller, who may not be Barona, in order to exercise these rights.

Right of access. You have the right to know who processes personal data, how it is processed, from which sources and which data they process.

Transfer of data. You have the right to request that the personal data collected about you be transmitted in a machine-readable form to another service provider whose services you wish to use in the future, for example.

Right to erasure/right to be forgotten. You have the right to request the erasure of your personal data if you no longer wish to have them processed and the data processor has no legitimate reason to use the data.

Right to restriction of processing/objecting. You have the right to restrict and prohibit the processing of your personal data under certain conditions. You also have the right to object to the processing of your data on the basis of a legitimate interest if you have a compelling reason.

Rectification of data. You always have the right to correct or complete personal data if they are inaccurate and if the inaccuracy may affect you.

Right to withdraw consent. If you have consented to the processing of your personal data, you have the right to withdraw your consent at any time.

To exercise the above rights related to the processing of personal data, please contact us at info@barona.ee. We will get back to you within 30 days. If your enquiry concerns personal data whose controller we are not, we will forward your enquiry to the actual data controller.

Other important information

Newsletters and direct marketing

We will send you newsletters and selected marketing offers if you have given us your consent to do so. You can withdraw your consent at any time. The opt-out link is usually included in the message, but you also have the option to withdraw your consent by contacting us. We may also use social media tools to advertise our services. Since social media platforms are treated as independent controllers, their privacy policies also apply to the processing of your personal data in this respect. Consequently, the terms and conditions of the consents of these service providers must also be taken into account.

Dispute resolution

If you have any questions about the processing of personal data, please contact us at info@barona.ee. You have the right to submit a complaint to the Estonian Data Protection Inspectorate at info@aki.ee.

The privacy notice was last updated in February 2025.