Privacy Policy & Use of AI

Privacy Policy

1. Fontes as the Controller of Personal Data

1.1 The controller of personal data is Fontes PMP OÜ, registry code 10319889 (hereinafter referred to as Fontes).

Contact details: +372 627 7077; info@fontes.ee; postal address: Sepapaja 6, Tallinn 11415, Estonia.

1.2 You may contact Fontes’ Data Protection Officer by email at info@fontes.ee.

1.3 Fontes is a talent advisory agency. Fontes focuses on talent acquisition, talent development and human capital research. We provide solutions that enable talent to develop their career opportunities and support organisations in retaining and recruiting employees, as well as shaping organisational culture.

1.4 Fontes adheres to the following principles when processing personal data:

Personal data is processed lawfully, fairly and in a transparent manner.

Personal data is collected and processed for specified and legitimate purposes.

Personal data is adequate, relevant, limited to what is necessary, accurate and, where necessary, kept up to date, and appropriate measures are taken to ensure inaccurate personal data is rectified.

2. Personal Data Processed

2.1 Fontes processes personal data provided directly by the data subject, personal data received from contractual partners, and personal data collected by Fontes itself, including the analysis of website traffic and campaign data (Facebook Business Manager, LinkedIn, the Fontes website and Google Analytics).

2.2 Fontes processes the following personal data: first and last name, personal identification code, email address, telephone number, the data subject’s online user accounts (e.g. LinkedIn), language skills, other skills specified in the CV (e.g. hobbies, interests, software skills, etc.), business and voluntary activities, membership in social or professional organisations, employment-related expectations (e.g. salary expectations, expectations regarding an employer, etc.), description of suitable job responsibilities, references provided by the data subject, work experience, education, continuing education and professional training, participation in Fontes training programmes (including attendance and absence, payment of participation fees, and satisfaction/feedback), information regarding the data subject’s use of Fontes services (e.g. career counselling, coaching services, etc.), professional profile (e.g. strengths, development needs, values, competencies, etc.), assessment and test results, recruitment process results (including participation in a recruitment process, progression, non-progression or withdrawal), and interview summaries.

3. Retention Period

3.1 Fontes retains personal data for as long as necessary to provide the services requested by the data subject, in accordance with the retention periods agreed with contractual partners and the retention periods prescribed by law, including:

  • information relating to invoices is retained for seven (7) years following the end of the relevant financial year in accordance with the Estonian Accounting Act and tax legislation;
  • in accordance with applicable legislation, personal data relating to claims is retained for a maximum of ten (10) years from the date on which the claim becomes enforceable (for example, for maintaining training records).

3.2 Anonymised data collected by Fontes is retained indefinitely.

4. Data Storage and Transfers

4.1 Fontes does not disclose, grant access to or transfer personal data to third parties without a legal basis arising from applicable data protection legislation. Personal data provided to Fontes is accessible only to Fontes and, where necessary, to persons authorised by Fontes (e.g. software developers and IT service providers).

4.2 As part of providing its services, Fontes may transfer personal data to third parties, such as employers, who ensure an appropriate level of data protection and with whom a confidentiality agreement has been concluded.

4.3 Fontes’ cooperation partners may be located in Estonia, the European Union, the European Economic Area (EEA), as well as in third countries. Consequently, your personal data may, to a limited extent, be transferred outside the European Union (EU) or the European Economic Area (EEA) for the purposes of service provision, technical administration and support. Such transfers will only take place where the European Commission has determined that the destination country or organisation ensures an adequate level of data protection, or where we are otherwise able to ensure an adequate level of protection for personal data in accordance with applicable legislation.

5. Purposes and Legal Bases for Processing Personal Data

5.1 The processing of personal data is necessary for the provision of Fontes’ services, ensuring the operation of its online environment, and complying with legal obligations.

5.2 Legal bases for processing personal data:

5.2.1 Fontes processes personal data on the basis of the data subject’s consent. Consent is freely given by the data subject for one or more specific purposes. The data subject has the right to withdraw their consent at any time.

5.2.2 Fontes processes personal data where such processing is necessary for the performance of a contract or in order to take steps at the request of the data subject or client prior to entering into a contract.

5.2.3 Fontes processes personal data where necessary to comply with a legal obligation. As a continuing education provider, Fontes fulfils the legal requirements applicable to continuing education institutions. In addition, Fontes processes personal data in order to comply with obligations arising from other applicable legislation (e.g. the Accounting Act and the Employment Contracts Act).

5.2.4 Fontes processes personal data on the basis of its legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data. Fontes’ legitimate interests may arise in connection with improving its services, ensuring the security of its network and information systems, and preventing fraud. Fontes carefully assesses the existence of a legitimate interest in accordance with the principles governing the processing of personal data.

5.3 Fontes uses automated processing in the following cases:

5.3.1 In relation to individuals who have provided their personal data to Fontes and expressed an interest in receiving suitable training offers.

5.3.2 When conducting targeted searches within the online environments of Fontes’ cooperation partners by using search criteria made available by the system (e.g. job title, years of professional experience, field of activity, etc.) to identify users of those online environments (based on the user’s consent, which may be withdrawn at any time), in order to identify talent to whom targeted opportunities may be presented.

5.3.3 The logic of automated decision-making is based on the information that the individual has entered into the online environments used by Fontes or has otherwise provided directly to Fontes.

6. Rights of the Data Subject

6.1 The rights of the data subject are set out in Articles 15–22 of the General Data Protection Regulation (GDPR). Accordingly, the data subject has the right to:

  • access their personal data;
  • request the rectification of their personal data;
  • request the erasure of their personal data (including the “right to be forgotten”);
  • request the restriction of the processing of their personal data;
  • object to the processing of their personal data;
  • request the transfer of their personal data (data portability);
  • object to automated decision-making (including profiling);
  • withdraw consent given for the processing of their personal data;
  • lodge a complaint with the competent data protection supervisory authority.

To exercise these rights, the user must contact Fontes by submitting a request or objection via email to info@fontes.ee.

7. Cookies

7.1 Cookies are small data files that are stored on the user’s computer by the websites they visit.

7.2 Fontes uses cookies within its online environment to ensure the website functions properly, to improve its performance, and to enable analytics.

7.3 Fontes also uses Google Analytics to analyse the use of its online environment. Accordingly, Google Analytics cookies are also used.

7.4 Users may disable the use of cookies through their browser settings. However, doing so may cause the website to function improperly and may limit the user’s ability to use certain features of the online environment.

8. Security Measures

8.1 Fontes has carefully considered the protection of personal data and has implemented various technical and organisational measures to ensure data security. These include, for example, employee training on data protection, internal policies and procedures, password-based authentication, password hashing, and secure connections (HTTPS).

8.2 When selecting its cooperation partners, Fontes takes the importance of data protection into account and requires its partners to comply with applicable data protection requirements.

9. Amendments and Updates

9.1 Fontes may amend or update this Privacy Policy by notifying users through its website.

10. Enquiries and Right to Lodge a Complaint

10.1 To exercise their rights, the data subject must contact Fontes’ Data Protection Officer, Kristina Udras, by submitting a request or objection via email to info@fontes.ee.

10.2 The data subject has the right to lodge a complaint at any time with the Estonian Data Protection Inspectorate.

 

Use of AI at Fontes

The purpose of this document is to define the principles for the responsible, transparent, secure and ethical use of artificial intelligence (AI) tools in Fontes’ operations.

The use of AI tools at Fontes is intended to:

  • support employees’ efficiency and the quality of their work;
  • assist in creating, analysing and structuring information;
  • support knowledge creation and enhance the quality of professional work;
  • improve the quality of services provided.

The use of AI does not replace the professional judgement, decision-making authority or responsibility of Fontes’ consultants and specialists.

Recruitment, Assessment, Training and Consulting

AI tools in use:

  • AI chatbots and assistants (e.g. Gemini, Copilot, ChatGPT and others);
  • the built-in AI tools available in the Teamdash recruitment platform;
  • the built-in AI tools available in the CreateUpon e-learning platform (please refer to the CreateUpon Privacy Policy for further information).

AI tools are used in a supporting role in the following recruitment, assessment, training and consulting processes:

  • preparing company market overviews;
  • drafting job profiles;
  • writing job advertisements;
  • qualitative job analysis;
  • collecting, structuring, analysing and summarising job-related information and job profiles in an anonymised format;
  • preparing interview methodologies and interview questions;
  • creating e-learning course structures and generating visuals;
  • creating marketing messages;
  • preparing frameworks and methodologies used in consulting projects;
  • structuring information and conducting qualitative analysis.

The accuracy of AI-generated content is reviewed, and all final decisions are made, by a Fontes employee.

AI Is Not Used at Fontes For:

  • assessing candidates or their suitability;
  • making recruitment decisions;
  • interpreting psychometric assessment results;
  • processing confidential information relating to clients, candidates or organisations;
  • formulating final conclusions or recommendations.

Every AI-generated output is reviewed and validated by a Fontes employee.

Data Protection and Confidentiality

Confidential organisational information is not shared with AI tools in any manner that could result in data leakage or make such information accessible to third parties.

When using AI tools, Fontes complies with all applicable data protection and confidentiality requirements, including the principles of the General Data Protection Regulation (GDPR).