Privacy Notice for Recruitment

Effective date: 31 March 2023

DATAPAO Korlátolt Felelősségű Társaság (hereinafter “Data Controller” or “DATAPAO” or “Company”) pays particular attention to ensuring that the personal data of its employees are safe and that they are processed by Regulation (EU) 2016/679 of the European Parliament and the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: “GDPR”).

This Notice aims to inform you about the essential details regarding how DATAPAO protects and manages the personal data you’ll share during the recruitment.

1. General information about the data controller

DATAPAO Korlátolt Felelősségű Társaság

2. The purposes of the processing

The personal data is necessary to examine whether you, as the data subject, are suitable for the position you have applied to. In addition, the Company needs your contact details to contact you regarding your application. Furthermore, in case of an unsuccessful application, Data Controller stores the Data Subject’s personal data to approach you with possible job offers in the future.

3. Sources & legal basis to process personal data

If you provided your personal data to DATAPAO

Legal basis for storing & processing data: expressed consent.

In this event, DATAPAO may process the personal data provided by you only if you also give your expressed consent by ticking the consent checkbox at the end of the application form and by clicking the “Submit Application” button.

DATAPAO may also collect personal data from third parties as agencies, referrals, or publicly accessible sources.

Legal basis for storing & processing data: legitimate interest.

During recruitment, DATAPAO’s primary aim is to create the best team, so it cooperates with other natural and legal persons that can recommend potential new employees. These third parties process and transfer to our Company your personal data in accordance with their privacy policies. We may also search for our new employees through other publicly available databases or social media such as LinkedIn.

Accordingly, DATAPAO’s legitimate interest is to work with qualified and efficient people. Therefore, it collects and processes your personal data received from its partners to whom you have provided your personal data or from social media platforms where you shared information about your professional background.

In this instance, we inform you about our data procession and source within a reasonable period after obtaining the personal data, but the latest at the time of the first communication with you.

4. List of processed personal data

• Name (first and last),
• Email address,
• Phone number,
• CV (content is optional as per the preference of the candidate)
• Additional information like, for example, if they have the right to work in Hungary or if they are legal residents or any other information that would help DATAPAO to assess the candidate’s VISA status (this is not something the data controller asks for all roles but only for the roles where the data controller does not support visa and relocation),
• LinkedIn profile (or other websites shared by the candidate).

5. The period for which the personal data is stored

Data procession lasts until the job position is filled. If someone else is hired for the position, we retain and might process your data for 24 months (730 days) after the moment we reject your application.

You are entitled to request the erasure or, if the legal basis is your consent, the withdrawal of your consent, in which case we delete your data within a reasonable period from the receipt of your request (but not longer than 30 days).

6. Access to the processed data, data management, and data transfer provisions

Primarily, the Company and the internal employees of the Company (with duties in HR or part of the hiring process) shall be entitled to know the personal data. They shall not publish or disclose it to any third parties and shall use it solely for the purposes specified in the Rules.

The Data Controller shares or processes your personal data with the help of the following third parties:

• Greenhouse Software Inc. (registered office: USA, 18 West 18th Street, 11th Floor New York, NY 10011; webpage: www.greenhouse.io): provides the Applicant Tracking System that stores the applications. Greenhouse Software Inc. is fully compliant with EU data protection laws.

7. Rights of the data subject

You have the right to request from the Controller access to and rectification or erasure of personal data or restriction of processing concerning the data subject or to object to the processing as well as the right to data portability.

You also have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

The Controller fulfills any request regarding the data subject’s exercise of law without undue delay within 30 days in a reply letter sent to the contact information provided in the request. If you send the request electronically to the Controller, the Controller’s response letter will also be sent to you electronically, if possible. If you want to send the answer another way, please indicate this in the application.

8. Legal remedy

If you consider that the Company, by the data processing realized by itself, breached, you may contact the authority at the contact details below.

Nemzeti Adatvédelmi és Információszabadság Hatóság

You are also entitled to initiate a legal procedure against the Company where you consider that the Company breaches the rights regulated by the GDPR. The court shall act in urgency. The tribunal shall have jurisdiction in the litigation – according to the data subject’s decision – based on your home address or the Company’s seat.