Candidate Privacy Notice

We prepared this Candidate Privacy Notice (the "Notice") to explain how we at ENEBA (the brand under which UAB Helis Play and its corporate group operate, “ENEBA”) collect, store, use, share, disclose, and transfer the personal data (the “Personal Data”, “Data”) of job and internship candidates and applicants (collectively, "Candidates", "you") in connection with our application and recruitment processes.

We process your Personal Data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), the Lithuanian Law on Legal Protection of Personal Data, and other applicable data protection laws.

We may update this Notice from time to time. Any updates will be published here, together with the date the change was made.

If you have any questions about this Notice or about your privacy, please contact us at privacy@eneba.com

Data Controller

UAB Helis Play is the controller responsible for processing your Personal Data: legal entity code 304923415, registered address Gynėjų g. 4-333, LT-01109 Vilnius, Lithuania.

1. Why do we collect Data about you?

We are always looking for bright minds. If that's you, we encourage you to apply and join our team - and we may also actively search public professional platforms to identify potential candidates, and reach out to you directly if we believe you could be a good fit, even before you've applied.

We process your Personal Data when: you apply to an open position at ENEBA; you fill in an online form; you contact us by phone, email, in person, or otherwise; or you reach us through a recruitment agency or other third party. We also process your data, and may contact you directly, when we identify your publicly available professional background as relevant to a role, or when someone refers you to us.

We use this data for recruitment purposes - to assess your suitability for a role and, where appropriate, to make you a job offer.

2. What Data do we collect?

To assess your candidacy, we collect, use, and store the following categories of Personal Data, to the extent necessary for the purposes described above:

Your name and surname
Contact information (such as phone number and email address, and, where you include it in your CV or otherwise provide it, your home or office address)
Information you submit with your application (including your CV, cover letter, and any attachments)
Your employment and education history, skills, work experience, and references (including language proficiency, diplomas and certifications, additional training, current workplace and employment history, previous job positions, and tasks performed)
Work permit or visa information, if applicable to you
Any prior employer obligations (such as signed non-disclosure or non-compete agreements)
Desired salary, willingness to relocate, and other job preferences
Information you have made publicly available, such as your education and work experience (for example, on LinkedIn, GitHub, or a personal website), to the extent relevant to considering you for a role
Any internal notes, assessments, or automated scores regarding your suitability for a role, including those generated using AI tools that review your CV, application materials, or interview transcripts
Interview details and the outcome of any recruitment exercises you complete
Any special needs, health condition, or accommodation request that you choose to disclose in connection with the recruitment process
If you are referred to us by someone else, the information that person provides about you

When applying, please do not include Data that is not relevant to assessing your candidacy - for example, your personal identification number, or sensitive data such as health data, family relationships, or political views.

3. Why are we legally allowed to collect your Data?

We process your Personal Data on the following legal grounds:

Steps taken at your request prior to entering into a contract. When you apply for a specific position, we process your data because doing so is necessary to assess your application and to take the steps you have requested towards a potential employment contract with the relevant ENEBA group entity (Article 6(1)(b) GDPR).
Legitimate interest. When we identify your publicly available professional background as relevant to an open role, or when someone refers you to us, we process your data - including to contact you about the opportunity - on the basis of our legitimate interest in identifying and engaging suitable candidates, which you may object to at any time (Article 6(1)(f) GDPR).
Consent. If you agree to be considered for future opportunities beyond the role you applied for, we retain and process your data on the basis of your consent, which you may withdraw at any time without affecting the processing of your current application. We never ask for special categories of data (such as health information) during recruitment; if you choose to provide it anyway, we process it only on the basis of your explicit consent (Article 6(1)(a) GDPR).

4. Which Data do you have to provide, and why?

You are not legally required to provide us with any Data. However, if you do not provide your CV and Data about your experience and skills necessary for us to assess your suitability, we may be unable to process your application.

5. Where do we get your Data from?

Generally, we collect Data directly from you, when you respond to our job ads or communicate with one of our recruiters. In some cases, we also obtain Data from:

Our employees, through referrals
LinkedIn and other professional networking or collaboration platforms, which we may proactively search to identify candidates - where we collect Data from your social media profile, we make sure it is relevant to the role, on the basis of our legitimate interest in identifying and engaging suitable candidates
Publicly available profiles such as GitHub, Stack Overflow, or Behance, to the extent relevant to an available position
Third parties connected to your professional life, such as references supplied by former employers, colleagues, or people who know you.

6. Do we share your Data with other entities?

Recruitment is administered by UAB Helis Play on behalf of the ENEBA group. Staff and hiring managers at other ENEBA group entities may access and review your Personal Data as part of this process, acting under UAB Helis Play's direction.

Beyond this, we share your Data with other entities only where necessary, and only for the recruitment purposes described above.

We use service providers to process your Personal Data on our behalf - for example, our applicant tracking system, email service providers, cloud-based document storage, and other IT infrastructure providers. These providers may access your Personal Data only to the extent necessary to deliver their services, and we require them to protect your data and to sign data processing agreements in line with applicable legal requirements.

7. Do we disclose your Data outside the European Economic Area?

In most cases, we process and store your Personal Data within the European Union and the European Economic Area. We prioritise hosting data with providers based in the EU, even where a service provider is US-based. Only where necessary do we transfer your data outside the EU/EEA, and only where an adequate level of protection is ensured - including through Standard Contractual Clauses adopted by the European Commission, or another valid transfer mechanism.

You can find a copy of the Standard Contractual Clauses at: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc/standard-contractual-clauses-international-transfers_en

8. How long do we keep your Data?

We store your Personal Data throughout the recruitment process for the position applied for and, if your application is unsuccessful, for a further 6 months after the outcome - to be able to establish, exercise, or defend legal claims relating to the recruitment process - after which it is deleted.
If we identify you through sourcing and you do not respond or apply, we store your Personal Data for up to 6 months from when we identified you, after which it is deleted. If you respond or apply within that period, the retention period above applies instead.
If you are selected and sign an employment contract, we will retain your Personal Data in the manner and for the period applicable to staff data at the ENEBA group entity that employs you, details of which will be provided to you at the time the agreement is concluded.
If you have agreed to be considered for future job opportunities, we store your Personal Data for up to three (3) years.

9. Do we use automated decision-making?

We may use artificial intelligence (AI) tools to assist us at various stages of the recruitment process. This can include, for example, helping us efficiently review applications, identify candidates whose skills and experience align with job requirements, analyse interview responses, or schedule interviews. These tools support our recruiters and help us manage a high volume of applications. Whether and how these tools are used varies depending on the role and the recruitment process. Where they are used, the results may influence whether you are shortlisted, interviewed, or offered a position.

10. What privacy-related rights do you have?

The GDPR and other applicable laws give you certain rights, subject to specific procedures and exceptions. Where these apply, you can exercise the following rights by contacting us at privacy@eneba.com :

To obtain confirmation of whether we are processing your Personal Data
To access your Personal Data and information about how it is processed
To have inaccurate data corrected
To request deletion of your data, where it has been processed unlawfully or another legal ground for deletion applies
To request that we restrict processing of your data - for example, if you dispute its accuracy, object to its processing, or need it preserved to establish, exercise, or defend a legal claim
To receive your Personal Data in a portable format, or have it transferred to another controller - this applies to data you provided to us that we process on the basis of a contract or your consent
To object to processing carried out on the basis of our legitimate interest
Where processing is based on your consent, to withdraw that consent at any time
Where a decision about you is based solely on automated processing and produces legal or similarly significant effects, to obtain human intervention, to express your point of view, and to contest the decision

If you believe your data has been processed unlawfully, you have the right to lodge a complaint with a data protection authority - the State Data Protection Inspectorate in Lithuania (L.Sapiegos str. 17, Vilnius, Lithuania, telephone +370 5 271 2804; email ada@ada.lt), or the relevant supervisory authority in another EU member state. We would appreciate the opportunity to resolve any concerns directly with you first, so please feel free to contact us.

Last updated 4 August 2026