Candidate Privacy Notice

This notice explains how Kalsnava Distillery processes the personal data of people who apply for our vacancies on this website or send us a CV in another way.

1. Controller

SIA "Kalsnavas elevators" (trading as Kalsnava Distillery), reg. No. 40003875945, Rūpnīcas iela 15, Jaunkalsnava, Kalsnavas pagasts, Madonas novads, LV-4860, Latvia. For questions about data processing write to [email protected].

2. What data we process

• Identification and contact details: name, surname, e-mail, phone number (required).
• Application documents: CV (required) and cover letter (optional), including the information on education, experience and skills they contain.
• Additional comments you add to your application (optional).
• Data created during selection: interview notes, results of test tasks, the decision.
• Your consents: confirmation of this notice and, if given, consent to 2-year storage.
• Technical data: a pseudonymised value of your IP address, browser name and time of submission.

Please do not send sensitive data (health, religious beliefs, ethnic origin etc.), a photo or your personal identity number — they are not needed for selection.

3. Purposes and legal basis

• Assessing your application, contacting you and arranging interviews — steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)).
• Considering you for other open or future vacancies — your separate, optional consent (Art. 6(1)(a)).
• Defending our rights if a selection decision is challenged, and protecting the form against bots — our legitimate interests (Art. 6(1)(f)).
• Concluding an employment contract with the selected candidate — contract and the Latvian Labour Law (Art. 6(1)(b) and (c)).

Providing data is voluntary, but without the required fields and a CV we cannot assess your application.

4. Where we get data from

You provide the data yourself — in the application form, by e-mail or at an interview. We ask former employers for references only with your knowledge and only from people you name. We do not search for information about you on social media.

5. Who can access your data

Only recruitment staff and the manager of the hiring team see your application. We do not sell personal data. We use service providers who process data only on our instructions:

• the hosting provider of the website and database in the European Union;
• Google (Gmail / Google Workspace) — delivering the application notification to the recruitment mailbox;
• Cloudflare (Turnstile) — checking that a person, not a bot, fills in the form.

Public authorities may receive data where required by law.

6. Transfers outside the EU/EEA

Google and Cloudflare may process data outside the European Economic Area, including in the USA. Such transfers are based on the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

7. How long we keep data

• Without consent to 2-year storage — 6 months after submission; the application and files are then deleted automatically.
• With consent to storage for other vacancies — 2 years after submission or until you withdraw consent.
• If you are hired — the data becomes part of your personnel file and is kept as required by law.

The period takes into account Article 34 of the Latvian Labour Law: a candidate may bring a claim for discrimination within three months after a refusal. If a claim is brought, we keep the data until the case is closed.

8. Your rights

You have the right to obtain information about your data and a copy of it, to request rectification or erasure, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent at any time without affecting the lawfulness of earlier processing.

Write to [email protected] from the e-mail address you used in your application. We will reply within one month. You may lodge a complaint with the Data State Inspectorate of Latvia (www.dvi.gov.lv).

9. Automated decisions

We do not use automated decision-making or profiling. Every application is reviewed by a person.

10. How we protect your data

• Applications are transmitted encrypted (HTTPS).
• Only authorised staff with a personal account and two-factor authentication can access applications and CVs.
• Uploaded files are never published, and every CV download is logged.
• We check file types and do not accept files with executable content.

11. Bot protection and cookies

The application form uses Cloudflare Turnstile, which processes technical signals (IP address, browser data) only to tell people from bots. This website does not use analytics, advertising or other tracking cookies.

12. Changes

We may update this notice. The current version is always available on this page with the date of the last change.