PERSONAL DATA PROTECTION RULES FOR CANDIDATES

Name(s), surname(s)

GDPR Article 6 (1)(a), GDPR Article 6 (1)(b)

Not transferred (only details of the CV and identity document of a Candidate for the Management Board of the Bank are transferred to the Bank of Lithuania/European Central Bank)

• If no employment contract has been concluded with the Candidate by the end of the selection process/while the selection process is in progress (applies to CV and Information about the assessment of the Candidate, the Candidate’s criminal record from the Register or extract from the Register concerning the Candidate’s criminal record), the data shall be destroyed within 7 working days after the end of the selection process.
• Until the end of the employment relationship (applies to the Candidate Questionnaire, Information about the assessment of the Candidate, Candidate’s consent to receive information – data obtained from the current or, in the case of a legitimate interest of the Bank Group, former employer).
• 10 years after the end of the employment relationship (applies to the Candidate’s criminal record from the Register or extract from the Register concerning the Candidate’s criminal record, certificate on administrative offences).
• 10 years after the end of the employment relationship or term of office (for the assessment of the Candidate, to ensure the legal requirements for managers).

National identification number

Details of the identity document (type, number, issuing authority, date of issue, expiry date)

Address (place of residence)

Mobile or other telephone number

Email address

CV information (qualifications (education, school attended and date of graduation, specialisation, qualifications, degree awarded, information on whether you are studying at the time of application), knowledge of foreign languages and skill level, ability to work with specific computer programmes, qualifications acquired in the last two years), previous jobs, personal qualities)), the information you have provided about your personality, values, expectations and interests

Assessment of the Candidate (in the case of a member of the Board in the Bank Group, the Director of Anti-Money Laundering Compliance Department in the Bank, and the designated manager – in the case of the SBD and SBAM) responsible for the implementation of anti-money laundering and anti-terrorist financing measures in the Bank Group’s activities, on the basis of which the following personal data are processed: education, additional qualification courses, experience in managing a financial market participant’s compliance – anti-money laundering and anti-terrorist financing, experience in implementing the legal requirements for a financial market participant in the areas of know-your-client, client relationships, transaction monitoring, internal investigations, analysis of suspicious transactions, experience in identifying, managing money laundering and terrorist financing compliance risks related to the activities of a financial market participant, personal qualities, language skills

GDPR Article 6 (1)(b)

GDPR Article 6 (1)(c), BoL Resolution on the Approval of Instructions to Financial Market Participants Aimed at Preventing Money Laundering and/or Terrorist Financing

Assessment of the Candidate (in the case of a member of the Board in the Bank Group) responsible for the organisation of anti-money laundering and anti-terrorist financing measures in the Bank Group’s activities, on the basis of which the following personal data are processed: education, additional qualification courses, experience in managing a financial market participant’s compliance – anti-money laundering and anti-terrorist financing, experience in implementing the legal requirements for a financial market participant in the areas of know-your-client, client relationships, transaction monitoring, internal investigations, analysis of suspicious transactions, experience in identifying, managing money laundering and terrorist financing compliance risks related to the activities of a financial market participant, personal qualities, language skills

GDPR Article 6 (1)(b)

GDPR Article 6 (1)(c), BoL Resolution on the Approval of Instructions to Financial Market Participants Aimed at Preventing Money Laundering and/or Terrorist Financing

Information about pecuniary and/or non-pecuniary interests of the Candidates and their Relatives and other circumstances, where the Candidate is engaged in an activity that could give rise to a potential conflict of interest between the Candidate and the Bank’s Subsidiary (https://www.sb.lt/lt/apie/struktura-ir-valdymas/patronuojamosios-banko-imones) , i.e., the nature of individual activity, employment relationships, participation in the activities of other companies (as founders, shareholders, members of management bodies), participation in the activities of public organisations, participation in elected bodies of the state or municipalities, participation in private business, or provision of services in any other form – (applicable to all employees of the Bank Group)

GDPR Article 6 (1)(b)

GDPR Article 6 (1)(c), Guidelines on Internal Governance of 21 March 2018 (EBA/GL/2017/11)

Criminal record (applies to employees of the Bank’s brokerage function who provide investment advice and take orders from clients, Director (CEO) of SBAM and investment decision makers, i.e., members of the Investment Committee, Head of Investment Management Division, Head of Share and KIS Group, Head of Bond Group, Fund Manager, Junior Fund Manager, Director (CEO) of SBD, and key function holders, i.e., Head of Risk Management, Head of Actuarial Function, Head of Compliance, Head of Audit Function)

GDPR Article 10, GDPR Article 6 (1)(c), LLPPD Article 3 (1) and Article 5 (1), Law on Markets in Financial Instruments Article 17 (1), 17(2)(1), 17(3), Law on Banks Article 34 (10), 34(14), Law on Collective Investment Undertakings Article 9 (4)–(5), Resolution No. 03-181 of the Board of the Bank of Lithuania of 14/11/2023, Law on Insurance Article 22 (5)

Criminal record (applies to the assessment of suitability of Bank managers and key function holders as regards compliance with the requirements set out in Article 34(12)(1) and (13)(1)–(2) of the Law on Banks of the Republic of Lithuania).

GDPR Article 10, GDPR Article 6 (1)(c) and (3), LLPPD Article 3 (1) and Article 5 (1), Law on Banks Article 34 (2), 34(12)(1) and 34(13)(1)–(2)

Criminal record (applies to other Bank staff)

GDPR Article 10, GDPR Article 6 (1)(c) and (3), LLPPD Article 3 (1) and Article 5 (1), Law on Banks Article 34(10) and 34(14)

Administrative offences (applies to employees of the Bank’s brokerage function who provide investment advice and take orders from clients, Director (CEO) of SBAM and investment decision makers at SBAM, i.e., members of the Investment Committee, Head of Investment Management Division, Head of Share and KIS Group, Head of Bond Group, Fund Managers, Junior Fund Managers), Director (CEO) of SBD, key function holders, i.e., Head of Risk Management, Head of Actuarial Function, Head of Compliance, Head of Audit Function)

GDPR Article 6 (1)(c), Law on Markets in Financial Instruments Article 17 (2)(2), Resolution of the Board of the Bank of Lithuania on the approval of regulations of the assessment of managers of supervised financial market participants and their persons carrying out the main functions, No. 03-181.

Assessment of the Candidate, for the purpose of ensuring compliance with the legal requirements for managers (applies to members of the Supervisory Council of the Bank, members of the Board, the Chief Executive Officer and Deputy Chief Executive Officer, the Head of Internal Audit Division, the Director (CEO) of SBAM, and investment decision makers, i.e., members of the Investment Committee, Head of Investment Management Division, Head of Share and KIS Group, Head of Bond Group, Fund Managers, Junior Fund Managers, Director (CEO) of SBD, and key function holders, i.e., Head of Risk Management, Head of Actuarial Function, Head of Compliance, Head of Audit Function)

Manager Form approved in accordance with the requirements of the Bank of Lithuania and the data collected, for example: name and surname, former surname, email address, national identification number, date of birth, place of birth, nationality, former passport, identity card details, residential and correspondence address, phone number, education, professional qualifications, work activities over the last 10 years, specific knowledge that could be useful while working for a financial market participant, acquired while holding the specified position, civil actions, administrative and criminal proceedings against both individuals and controlled companies, bankruptcy of the natural person, legal entity, restructuring, managed companies (if any) (respective percentage values, position held), financial results of companies; positions held with other employers, legal entities whose participants are related persons, relatives, private interests, financial liabilities, and other information and documents relevant to the assessment and issuance of the permit by the Bank of Lithuania

GDPR Article 6 (1)(b), GDPR Article 6 (1)(c), GDPR Article 10 Resolution of the Board of the Bank of Lithuania on the approval of regulations of the assessment of managers of supervised financial market participants and their persons carrying out the main functions, Law on Collective Investment Undertakings Article 9 (4)

Transferred to the Bank of Lithuania/European Central Bank if necessary

Data relating to sanctions applied/not applied (applies to the Bank’s managers (i.e., members of the Bank’s Supervisory Council, members of the Board of the Bank, the Chief Executive Officer and his/her deputies, the Head of Internal Audit Division), the Bank’s key function holders (i.e., the Head of Risk Management Function (CRO), Head of Compliance Function (CCO), Head of Internal Audit Function, Chief Financial Officer (CFO), Chief Information Officer (CIO)), members of the Board of the Group companies, Chief Executive Officers (CEOs) of the Group companies, key function holders of the Group companies (Head of Audit Function, Head of Risk Management Function, Head of Actuarial Function, Head of Compliance of SBD)

Data collected in accordance with the requirements of the Bank of Lithuania: name, surname, date of birth

GDPR Article 6 (1)(b), GDPR Article 6 (1)(c), Resolution of the Board of the Bank of Lithuania on Approval of Instructions to Financial Market Participants on Implementation of International Sanctions (sub-paragraph 9.4.2)

Transferred to the Bank of Lithuania/European Central Bank if necessary

until the end of the employment relationship or term of office

For Candidates where at least one employer is SBAM – the information on the list of securities owned, for example: type of securities, name of securities, ISIN, number of securities, custodian, name and surname of security holder

GDPR Article 6 (1)(b), GDPR Article 6 (1)(c), Rules on the Organisation and Operation of Management Companies Articles 61–64

Transferred to the Bank of Lithuania/European Central Bank if necessary

10 years after the end of the employment relationship

Data relating to qualifications, professional skills, and professional qualities obtained while working for the current employer

GDPR Article 6 (1)(a)

These data are not transferred

Data relating to qualifications, professional skills, and professional qualities obtained while working for the former employer

GDPR Article 6 (1)(f) (legitimate interest provided for in LLPPD[2] Article 5 (2), checking the suitability of the Candidate)

These data are not transferred

Name(s), surname(s)

GDPR Article 6 (1)(a), GDPR Article 6 (1)(b)
 

We do not transfer these data to other controllers

If no internship contract has been concluded with the Candidate by the end of the selection process/while the selection process is in progress (applies to CV)

Address (place of residence)

Mobile or other telephone number

Email address

CV information (education, training, previous internships, workplaces)

Information about the assessment of the Candidate

GDPR Article 6 (1)(b)

These data are not transferred

CV information (education, language skills, training, previous workplaces, personal characteristics)

GDPR Article 6 (1)(a), GDPR Article 6 (1)(b)

Bank of Lithuania/European Central Bank

If no employment contract has been concluded with the Candidate by the end of the selection process/while the selection process is in progress

Name(s), surname(s)

GDPR Article 6 (1)(b), GDPR Article 6 (1)(c)

State Social Insurance Fund Board (Sodra)

50 years after the end of the contract

National identification number

Commencement of duties

Type of contract

Mobile or other telephone number

These data are not transferred

Email address

Address (place of residence)

Position

Job functions

Wages

Trial period

Other information provided in the employment contract

Information provided in the document certifying education (educational institution, degree, etc.)

10 years after the end of the business relationship

Name(s), surname(s), national identification number(s) of the minor child(ren) (in the case of a single parent, details of the document certifying this)

Medical certificate/personal health history/other document certifying health condition (disability, etc.)

Driving licence (if required to perform job functions) (applies for a driver’s position)

These data are not retained

Details of the Candidate’s (including Candidates for the Supervisory Council of the Bank) immediate family (degree of relationship, name(s), surname(s), year of birth, place of work, position)

GDPR Article 6 (1)(c), GDPR Article 6 (1)(f) (the Bank Group’s legitimate interest in ensuring compliance with legal requirements when specific data for the performance of a legal obligation are not specified in the applicable legislation), Law on Banks Article 34 (10) and (12), paragraphs 8.3 and 8.7 of the Regulations for the Organisation of Internal Control and Risk Assessment (Management) of the Bank of Lithuania

Paragraph 42 of the Regulations for Assessment of Heads and Key Function Holders of Financial Market Participants Supervised by the Bank of Lithuania

These data are not transferred

If no employment or other contract has been concluded with the Candidate by the end of the selection process/while the selection process is in progress, 10 years after the end of the employment relationship or office

Controls on trading in financial instruments

Name(s), surname(s), surname(s) given at birth, national identification number, date of birth, personal and work mobile or other telephone number, address, companies controlled.

Information about immediate family (degree of relationship, name(s), surname(s), year of birth or national identification number, companies controlled, position held)

GDPR Article 6 (1)(c), Market Abuse Regulation Articles 18 and 19

Bank of Lithuania

5 years from the date of updating the lists and from the date of notification

Name(s), surname(s), details of the financial instrument transaction

Nasdaq

Ensuring compliance with the requirements of internal lending and lending to affiliates of the Bank Group

Name(s), surname(s), national identification number and/or date of birth, address, mobile or other telephone number, email address, companies controlled, number of shares held, position held

Information about immediate family (degree of relationship, name(s), surname(s), year of birth or national identification number, companies controlled, number of shares held, position held), details of the transaction

GDPR Article 6 (1)(c), Law on Banks Articles 52 and 53,

Law on Corporate Income Tax Article 40

Bank of Lithuania (PRDB)

Retained for 10 years