HHHUB, UAB, Candidate & Recruitment Privacy Policy
Last updated: 21-08-2026
1. Who we are
HHHUB, UAB (“HHHUB”, “we”, “us” or “our”) is a recruitment agency registered in Lithuania (company registration code 307119412). We provide recruitment and talent search services, primarily to FinTech and other financial services businesses across Europe and the United Kingdom.
This Privacy Policy explains how we collect and process personal data in connection with our recruitment activities, including when you:
apply for an opportunity presented or managed by HHHUB;
create a candidate profile or otherwise provide your professional information to us;
communicate or interview with our recruiters;
are identified by us as a potentially relevant candidate through professional networks, databases or publicly available sources;
are referred or recommended to us;
act as a reference for a candidate; or
visit our Career Site.
For the processing described in this Privacy Policy, HHHUB, UAB generally acts as a data controller, meaning that we determine why and how your personal data is processed.
When we provide your personal data to a recruitment client or prospective employer for its own recruitment and hiring purposes, that organisation will generally act as a separate data controller in relation to its subsequent processing of your data.
2. Personal data we may process
Depending on your relationship with us and the recruitment process concerned, we may process the following categories of personal data.
Identity and contact information
This may include:
Professional and career information
This may include:
CV or résumé;
employment history;
job titles and responsibilities;
education;
professional qualifications and certifications;
skills and areas of expertise;
language skills;
professional achievements;
work samples where relevant;
LinkedIn and other professional profile information.
Recruitment information
This may include:
positions or opportunities in which you are interested;
salary or compensation expectations;
preferred working arrangements;
location preferences;
notice period and availability;
motivation for considering a role;
information discussed during recruitment interviews;
recruitment status and history;
communications with HHHUB;
recruiter interview notes;
professional assessments and evaluations;
information about your suitability for a particular opportunity;
feedback received during a recruitment process.
Application information
Where you apply for an opportunity, we may process the information included in your application, CV, cover letter, answers to recruitment questions and other materials you choose to provide.
Reference information
Where relevant, we may process professional references and information received from referees.
Technical information
When you use our Career Site, we may process technical information such as IP address, browser and device information, website activity and cookie-related information in accordance with our Cookie Policy.
3. Information we do not normally require
HHHUB seeks to collect only personal data reasonably necessary for professional recruitment purposes.
Unless specifically required by law or genuinely necessary for a particular recruitment process, candidates should not provide information such as:
national identification or personal identification numbers;
passport or identity document numbers;
marital or family status;
detailed health information;
political opinions;
religious or philosophical beliefs;
trade union membership;
information about sexual orientation or sex life;
biometric or genetic information; or
other sensitive information unrelated to professional suitability.
If such information is provided to us without being requested and is not necessary for the recruitment process, we may delete, redact or otherwise avoid using it.
4. Special categories of personal data
HHHUB does not actively seek to collect special categories of personal data within the meaning of the GDPR as part of ordinary recruitment.
Where processing of such information is exceptionally necessary, we will only process it where an appropriate legal basis under applicable data protection law exists and where the information is relevant and proportionate to the purpose concerned.
We do not use special-category information to make recruitment decisions unless its use is lawful and genuinely necessary.
5. Where we obtain personal data
Directly from you
We may receive information directly from you when you:
apply for an opportunity;
submit your CV;
create or update a candidate profile;
communicate with our recruiters;
participate in an interview or assessment;
provide information about your professional experience or preferences.
From professional and publicly available sources
As a recruitment agency, HHHUB may proactively identify professionals who appear potentially suitable for opportunities handled by us.
We may therefore obtain professional information from sources such as:
LinkedIn;
professional networking platforms;
recruitment or CV databases to which we have lawful access;
employer and company websites;
professional directories;
conference, industry or professional sources;
other publicly available professional information.
We normally limit such collection to information relevant to evaluating whether it may be reasonable to contact you about a professional opportunity.
Referrals and recommendations
We may receive your professional information from people within our network, candidates, employees, business partners, clients or other professional contacts who believe that an opportunity may be relevant to you.
Information created during recruitment
We may create information during the recruitment process, including interview notes, recruiter assessments, suitability evaluations, candidate summaries and records of communications and recruitment activity.
6. Sourced Candidates
You may become part of our recruitment process even if you did not initially contact HHHUB.
For example, one of our recruiters may identify your professional profile on LinkedIn, in a professional database or through another professional source because your experience appears relevant to an opportunity handled by HHHUB.
In these circumstances, we generally process limited professional information on the basis of our legitimate interest in identifying and contacting potentially suitable candidates and providing recruitment services to our clients.
Before doing so, we consider whether:
the information is professional in nature;
the source and context make such recruitment contact reasonably foreseeable;
the opportunity could reasonably be relevant to your professional background;
the amount of information collected is proportionate; and
your privacy interests or fundamental rights override our recruitment interest.
We will provide you with information about our processing in accordance with the GDPR, including where Article 14 applies, within the applicable statutory timeframe and generally no later than our first substantive communication with you, unless a lawful exception applies.
You may object to processing based on our legitimate interests at any time. See Section 15 below.
7. Why we process your personal data
We may process personal data for the following purposes.
Identifying potential candidates
We search for and identify professionals whose experience may match current or reasonably foreseeable recruitment opportunities.
Legal basis: our legitimate interests in operating our recruitment business, identifying suitable candidates and fulfilling recruitment mandates for our clients.
Contacting you about recruitment opportunities
We may contact you when we reasonably believe that a professional opportunity may be relevant to your experience.
Legal basis: generally our legitimate interests.
Managing applications and candidate relationships
We process information to communicate with you, understand your career preferences and manage your participation in recruitment processes.
Legal basis: depending on the circumstances, processing may be necessary to take steps at your request in relation to an opportunity and/or be based on our legitimate interests in operating an effective recruitment process.
Evaluating professional suitability
We may review your experience, conduct interviews, prepare candidate assessments and evaluate your potential suitability for a particular role.
Legal basis: depending on the circumstances, our legitimate interests and/or processing necessary to take steps at your request in connection with a recruitment opportunity.
Presenting candidates to recruitment clients
Where appropriate, we may provide your personal data to a HHHUB client or prospective employer so that they can consider you for an employment or professional opportunity.
Legal basis: generally our legitimate interests in providing recruitment services and facilitating recruitment opportunities, taking into account your reasonable expectations and involvement in the relevant recruitment process.
Maintaining candidate relationships and considering future opportunities
Where appropriate, we may retain relevant professional information so that we can identify and contact you about future opportunities that may reasonably match your profile.
Legal basis: our legitimate interests, where those interests are not overridden by your rights and interests, or consent where we specifically ask for and rely upon consent.
Placement and recruitment-service administration
Where a candidate is successfully placed, we may process limited candidate information to:
confirm that a placement has occurred;
administer our agreement with the recruitment client;
document that recruitment services have been performed;
administer replacement or guarantee arrangements;
maintain appropriate internal recruitment and commercial records;
resolve questions regarding candidate ownership or introduction;
establish, exercise or defend contractual or legal claims.
Legal basis: our legitimate interests in administering and evidencing recruitment services and protecting our contractual and legal rights.
Where specific information must be retained because of a statutory accounting, tax or other legal requirement, the legal basis is compliance with a legal obligation.
Legal and compliance purposes
We may process information where necessary to comply with applicable law, respond to lawful requests from authorities, or establish, exercise or defend legal claims.
Legal basis: compliance with a legal obligation and/or our legitimate interests, depending on the circumstances.
Career Site operation and security
We process technical information to operate, protect and improve our Career Site.
The applicable legal basis depends on the specific technology involved and may include our legitimate interests and, where legally required, your consent.
8. When we share candidate information with recruitment clients
An essential part of HHHUB's business is introducing suitable candidates to organisations seeking to hire talent.
We may therefore share your personal data with a specific recruitment client or prospective employer where we reasonably consider that:
We do not intend this Privacy Policy to authorise unrestricted distribution of candidate information to unrelated clients.
Depending on the recruitment process, information shared may include:
your name and surname;
CV;
LinkedIn or another professional profile;
employment history;
education and qualifications;
skills and languages;
location;
compensation expectations;
notice period or availability;
motivation;
recruiter assessment;
interview summary;
other professional information reasonably necessary for the client to assess your suitability.
We apply the principle of data minimisation and seek to provide only information reasonably necessary for the relevant recruitment purpose.
After receiving candidate information for its own hiring process, the prospective employer will normally determine independently how it evaluates and processes that information and will therefore generally act as a separate data controller.
Its subsequent processing will be subject to its own privacy information and legal obligations.
9. Candidate information in placement and contractual documents
Where necessary to identify a successful placement and administer our recruitment agreement, limited candidate information, including the candidate's name, may appear in documents such as:
candidate submissions;
placement confirmations;
service-performance confirmations or acts;
recruitment-service records;
replacement or guarantee records;
documents required to establish or defend contractual rights.
We only use identifiable candidate information in such documentation where reasonably necessary for the relevant purpose.
In accordance with the data-minimisation principle, we seek to avoid including candidate names or other personal data in invoices, file names or other administrative records where the individual can be identified adequately without doing so or where identification is unnecessary.
10. Other recipients and service providers
We may use third parties to support our recruitment and business operations.
Depending on the services used, recipients may include providers of:
applicant tracking and recruitment management systems;
cloud hosting and storage;
email and communication services;
document creation and electronic signing;
accounting and financial administration;
IT support and information security;
website and analytics services;
recruitment technology;
professional networking and recruitment databases;
assessment and interview tools.
Where a provider processes personal data only on our instructions, we require appropriate data-processing arrangements in accordance with applicable data protection law.
Some service providers may act as independent controllers for particular processing activities. Where applicable, their own privacy notices will govern those activities.
We may also disclose personal data:
where required by law;
to competent public authorities;
to professional advisers where necessary;
in connection with legal proceedings or claims;
in connection with a corporate transaction such as a merger, financing, restructuring or sale, subject to appropriate safeguards.
11. International data transfers
HHHUB operates in an international recruitment market and some clients or service providers may be located outside the European Economic Area (“EEA”), or may process data from locations outside the EEA.
Where personal data is transferred outside the EEA, we take steps to ensure that the transfer is permitted under applicable data protection law.
Depending on the destination and recipient, this may include:
an adequacy decision adopted by the European Commission;
the European Commission's Standard Contractual Clauses;
another transfer mechanism permitted by Chapter V of the GDPR; and
supplementary technical, contractual or organisational safeguards where appropriate.
You may contact us if you would like further information about the safeguards applicable to a particular transfer.
12. How long we keep personal data
We do not retain personal data indefinitely merely because it may be useful in the future.
Retention depends on the purpose for which the information is processed.
Active recruitment processes
We retain information while the relevant recruitment process remains active and for a reasonable period afterwards to complete the process, document its outcome and deal with follow-up matters.
Candidates who were not placed
Candidate information may be retained for 24 months after the most recent meaningful recruitment interaction where we have a legitimate reason to consider the candidate for relevant future opportunities.
The retention period should be reviewed against HHHUB's actual recruitment model and legitimate-interest assessment.
Candidates may object to continued processing for future recruitment purposes.
Talent pool / candidate database
Where we maintain a candidate profile for future opportunities, we retain it for 24 months from the latest meaningful interaction or profile update, after which we will delete, anonymise or review whether continued retention is justified.
Successful placements
Where a candidate is placed with a client, we may retain limited information necessary to document the placement, administer contractual obligations, replacement guarantees and protect legal rights.
Detailed recruitment information that is no longer required should not automatically be retained for the same period as contractual evidence.
Following a successful placement, detailed recruitment information (such as interview notes, assessments and internal candidate evaluations) that is no longer required for the purposes above will generally be deleted or anonymised within 24 months of the placement, unless a longer period is necessary for a specific purpose described below.
Placement and replacement guarantees
Information necessary for administering a placement or replacement guarantee is retained for the duration of the applicable guarantee period plus an additional 6 months to allow for administration or resolution of any related matters.
Legal and contractual claims
Where information is necessary to establish, exercise or defend legal or contractual claims, relevant information may be retained for up to 10 years from the end of the relevant contractual relationship, in line with the general limitation period under the Lithuanian Civil Code (Article 1.125), or for a shorter period where a shorter statutory limitation period applies to the specific type of claim. Where a claim has arisen before the expiry of this period, information will be retained until the claim has been finally resolved.
Accounting and legally required records
Documents that must be retained under Lithuanian accounting and tax law - such as invoices and records evidencing services performed - are retained for 10 years, in accordance with the requirements of the Law on Accounting of the Republic of Lithuania and related regulations. Personal data is included in such records only where necessary, and we seek to avoid including candidate names where identification is not required for accounting purposes.
Website and cookie information
Retention periods relating to cookies and similar technologies are described in our Cookie Policy.
13. Security
We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.
Our measures are selected taking into account the nature of the information, the purposes of processing and relevant security risks.
Access to candidate information should be limited to people and service providers who require it for legitimate recruitment, operational, legal or technical purposes.
14. AI and recruitment technology
HHHUB may use recruitment technology, including AI-assisted tools, to support activities such as:
candidate sourcing;
searching professional profiles;
CV or profile analysis;
matching candidates with opportunities;
preparing or structuring recruitment information;
candidate scoring or recommendations;
recruiter workflow support.
Such technologies may assist our recruiters but do not necessarily make recruitment decisions.
Unless expressly communicated otherwise, HHHUB does not make decisions producing legal or similarly significant effects on candidates solely by automated means without meaningful human involvement.
Recruiters and/or prospective employers remain responsible for evaluating candidates and making recruitment decisions.
If HHHUB introduces solely automated decision-making falling within Article 22 GDPR, this Privacy Policy and the relevant candidate information should be updated before such processing is used.
15. Your data protection rights
Depending on the circumstances and applicable law, you may have the following rights.
We will respond to requests exercising these rights without undue delay and in any event within one month of receipt of the request. Where a request is complex or we have received a number of requests from you, this period may be extended by a further two months; if so, we will inform you of the extension and the reasons for the delay within one month of your original request.
Access
You may ask whether we process personal data about you and request access to that information.
Rectification
You may ask us to correct inaccurate information or complete information that is incomplete.
Erasure
In certain circumstances, you may ask us to delete personal data about you, for example where it is no longer necessary for the purpose for which it was collected.
This right is not absolute and we may retain information where we have a lawful reason to do so.
Restriction
In circumstances provided by data protection law, you may ask us to restrict how we process particular information.
Objection
You have the right to object at any time to processing based on our legitimate interests on grounds relating to your particular situation.
This includes processing relating to sourcing, candidate database activities or future recruitment opportunities where legitimate interests are the applicable legal basis.
If you object, we will assess whether we have compelling legitimate grounds to continue the relevant processing or whether processing is required for the establishment, exercise or defence of legal claims.
Data portability
Where processing is based on your consent or on a contract and is carried out by automated means, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, request its transmission to another controller.
Withdrawal of consent
Where we rely specifically on your consent, you may withdraw that consent at any time.
Withdrawal does not affect processing that was lawful before the consent was withdrawn.
Complaints
You have the right to lodge a complaint with a competent data protection supervisory authority.
HHHUB's lead supervisory authority in Lithuania is: Valstybinė duomenų apsaugos inspekcija, https://vdai.lrv.lt/lt/.
If you are located elsewhere in the EEA, you may also be entitled to contact the supervisory authority in your country.
Where UK data protection law applies, you may have the right to contact the UK Information Commissioner's Office.
16. How to exercise your rights
You may contact us regarding your personal data or exercise your rights using:
HHHUB, UAB
Privacy contact: privacy@hhhub.eu
Company address: Gyneju str. 14, Vilnius, 01109, Lithuania
Company registration number: 307119412
We may need to verify your identity before fulfilling certain requests. Where identity verification is required, the one-month period referred to in Section 15 begins once your identity has been confirmed.
Where appropriate, you may also use privacy functionality available through our Career Site or candidate system.
HHHUB has not appointed a Data Protection Officer, as this is not a mandatory requirement under Article 37 GDPR for our scale and nature of processing. Questions regarding data protection matters may be directed to our Director, who is responsible for overseeing compliance with this Privacy Policy, using the contact details above.
17. References
If a candidate provides your details as a professional reference, we may process your name, contact details, professional relationship to the candidate and information you provide about the candidate.
We process this information for the legitimate interests of evaluating candidates and providing recruitment services.
We ask candidates to provide reference details only where reasonably necessary and appropriate.
18. Changes to this Privacy Policy
We may update this Privacy Policy when our recruitment practices, technology, service providers or legal obligations change.
The current version and its effective date will be published on our Career Site.
Where a change materially affects how we process candidate personal data, we will take reasonable steps to provide additional notice where required by law.
