On the processing of applicants’ personal data
Our company collects potential job applicants in a CV database. The persons in the CV database are then pre-screened according to the current job opportunities and potential candidates are informed about the current job opportunities.
When we contact the candidate, we inform them about the details of the vacancy and the employer.
If you are looking for a new job or are just interested in opportunities, please register in our CV database so that we can process your CV and any other personal data you provide when applying, and take it into account when making job offers, and inform you of any suitable vacancies that interest you.
The data controller of personal data processing during the job advertisement and selection process is the NORDCONN group of companies, of which our company, NORDCONN International Kft. (headquarters: 1113 Budapest, Bocskai út 134-146. , company registration number: 01-09-270280, tax number: 25354193-2-43) and our company registered in Sweden, Nordconn Sweden Aktiebolag (registered office: Magnus Ladulåsgatan 1, 11865, STOCKHOLM, company registration number: 559377-8946), hereinafter collectively referred to as “our company”, “we” or “NORDCONN”).
In the case of recruitment services, there are several possibilities. In some cases, we are the data controllers, i.e. the above two members of the NORDCONN group of companies as joint data controllers.
Our company and our Swedish partner company act as joint controllers when a candidate registers in our CV database. Based on the joint data controller agreement between our Hungarian and Swedish company, our Hungarian company, NORDCONN International Kft., is primarily responsible for providing information on data processing in connection with recruitment and for enforcing the data subject rights set out in this information notice and for responding to enquiries.
In other cases, we or one of our two companies will act as the data processor of the employer seeking to recruit the employee who has engaged us. If we act as a data processor, the candidates’ personal data would not be included in our own database, their personal data will be processed in accordance with the instructions of the employer company that engaged us and will be governed by the data processing rules set out in our recruitment partner’s own data processing notice.
When contacting you, we will provide you with information about the capacity in which we act. If you have any questions about the processing of your personal data in the context of our activities described above, please contact us using one of the contact details below.
Our contact details for questions about data processing:
Postal mailing address: 1113 Budapest, Bocskai út 134-146.
E-mail: info@nordconn.com; gdpr@nordconn.com
Telephone: +36 70 884-3030
Web: nordconn.com
The following table summarises what data we process, for what purposes and for how long, and on what legal basis.
|
|
JOBSEEKER DATABASE |
APPLICATION WITHOUT ADVERTISEMENT (incoming CVs) |
|
Purpose of data processing |
To offer suitable job vacancies to persons in the database. |
If a person does not apply for a job advertised, but simply enquires whether we currently have a job that matches his/her requirements, the purpose of the processing is to reply to this enquiry. |
|
Legal basis of data processing |
Voluntary consent of the applicant (Article 6(1)(a) GDPR) In the absence of consent, the applicant cannot participate in the selection. |
|
|
Scope of personal data processed |
Minimum data required for application: · Candidate’s surname, first name, telephone number and/or e-mail address (for identification and contact purposes); · CV, cover letter and all the data and information contained therein (all these data will help us to select the right person for the job and to offer the right job to the applicant); Additional information we hold on candidates: · Date of birth (if relevant) · Candidate’s general assessment · Data restriction, subsequent request, GDPR expiry date · date of registration of candidate (applicant) in our database · preferred job title, business sector, type of employment · – fact of disability (if relevant) · language skills (name of language, level of language proficiency) · highest level of education, name of educational establishment · information on the source of the application · driving licence · last place of employment · details of skills and abilities · – LinkedIn profile link* · data published on Profession.hu¬** · Data shared during referrals*** · Name of the professional manager assigned to the position applied for · Indication of future enquiries · type of interview, fact of online interview, place, date, duration of interview · Date of appointment of the professional manager |
|
|
|
· interview notification comment · interview evaluation and evaluation summary · fact of omission of interview · date of invitation sent · pre-screening result, experience, fact of active experience · gross salary requirement · application status details (step, status, date, result) · tender issue details (issue status, issue date and · date of issue, date of expiry, gross and net recommended basic salary, recommended gross annual and monthly premium amounts, starting date of entitlement to premium date of entitlement, amount of initial gross premium, date of payment of initial gross premium, planned starting date of employment, name of employer, offer document) |
|
|
Time of Data Controlling: |
We will delete personal data processed for the purposes set out in this notice at any time at the applicant’s request. Candidates should note that if they request the deletion of their data before the selection is closed, they will no longer be able to participate in the selection, as we will not have the necessary information for the assessment of their application. application file. |
|
|
We will also delete personal data in the absence of a request for erasure in the following cases: |
||
|
After 6 months or 2 years from the date of subscription to the database or the last confirmation of consent. The duration depends on the candidate’s declaration. |
If it is established that there are no vacancies corresponding to the relevant application and the data subject has been informed, his or her personal data will be deleted without delay. We will endeavour to carry out the above investigation and information in the shortest possible time, within a maximum of 30 days. |
|
* Personal information you disclose on LinkedIn will be processed on LinkedIn and will not be removed from LinkedIn unless you explicitly consent. You can also provide us with your personal data by applying for a specific job advertised or by registering in our CV database. Our legal basis for processing your data in connection with contacting you on LinkedIn and maintaining your LinkedIn connection is our legitimate interest (Article 6(1)(f) GDPR) in informing potential candidates about current job opportunities that are relevant to them.
** We are entitled to view and download CVs uploaded to the Profession CV database in accordance with the Profession Terms of Use and to process the personal data contained therein for 90 days from the date of download. If the person concerned has not consented to our processing of his/her CV for more than 90 days, either by applying for one of our job vacancies or by registering in our own CV database, we will no longer process the CV downloaded from the Profession site after 90 days.
*** In the context of our activities, it is of particular importance that the candidate has a reliable reference, a recommendation from someone we know. In order to ensure that the right of candidates to control their personal data is fully respected, each candidate may only be included in our database if he/she requests this and gives his/her consent to the processing and storage of his/her data.
Additional data processing related to the performance of the intermediary contract
- Control of the prohibition of intermediation
Based on an agreement with some of our partners, we may not contact, hire or place candidates who have been successfully referred to us by them during the agreed period.
In order to fulfil this contractual obligation, we need to process the candidate’s personal data and the fact whether the placement was successful, when the employment or other employment relationship was established with our partner concerned and whether it is still in force at the time of the new application.
The duration of the processing is the duration of the ban on mediation as set out in the contract, which is usually 1 year.
The legal basis for processing is our legitimate interest in the performance of our contractual obligations (Article 6(1)(f) GDPR).
- Pre-screening (name check)
For some of our partners, we need to pre-screen candidates in order to check whether the candidate is already in the database of the company concerned, for example because another recruitment agency has already recommended him/her to us or because he/she has already worked for the partner or a company in his/her group. If the candidate is already in the partner’s database, it is not in our interest to initiate the placement. Therefore, NORDCONN may typically provide the name and email address of the candidate for pre-screening purposes, and occasionally, if additional information is required for identification purposes, the candidate’s date of birth to the potential employer.
Personal data sent for pre-screening purposes will be processed and transmitted to our client on the basis of the data subject’s consent (Article 6(1)(a) GDPR).
In the case of negative feedback, i.e. if the person is not available for placement, the result of the pre-screening will be deleted after the feedback. In the case of a positive feedback, i.e. if the person is not in the database of the principal, we will keep the result of the pre-screening for the duration of the limitation period for our legitimate interest in enforcing our claim for our commission from the mediation.
- Settlement of Agency Fee
In order for NORDCONN and the employer commissioning them to settle the fee for the mediation service, it is necessary for NORDCONN, on the one hand, to be able to prove which person was mediated to the respective partner and when. Furthermore, the partner must notify NORDCONN whether they employ the mediated employee or not. In the case of the mediated person’s employment by our client, it is essential to know from when and under what legal relationship the employment takes place. If our agency fee is determined based on a specified percentage of the mediated person’s base salary, then, for the purpose of settling the agency fee, we must also know the amount of the mediated person’s contractual base salary.
The personal data processed for this purpose includes the fact and timing of mediation by the intermediary and the employer, as well as the fact of the employment failure. In the case of a percentage-based mediation fee, the amount of the successfully mediated person’s contractual base salary is also considered. The legal basis for data processing is our legitimate interest in enforcing the agency fee (GDPR Article 6(1)(f)). In our assessment, this data processing based on legitimate interests is proportionate to the restriction of the data subject’s rights concerning their personal data because without this information, we would not be able to enforce our agency fee. The data subject is aware that they come into contact with the employer through labor mediation and, by using our services, acknowledges that the necessary processing of their personal data is closely related to the purposes of the service.
If our client does not employ the mediated person during the agreed contractual period (fee-paying period), the personal data supporting the fact of mediation will not be processed beyond the expiration of our claim for the agency fee (5 years after the end of the fee-paying period).
- Data Processing for the Purpose of Fulfilling Mediation Guarantee
In cases where a guarantee is provided in the employment mediation contract, we guarantee that the person mediated by us meets the search criteria specified by the partner. The terms, duration, and conditions of the guarantee are stipulated in the mediation contract concluded with the respective partner and may vary. According to the guarantee, if the employment relationship of the person mediated by NORDCONN ceases for reasons within the scope of the guarantee during the guarantee period, NORDCONN undertakes to mediate a new candidate to the partner.
If we have provided a guarantee as described above, we need to process the personal data of the applicants covered by the guarantee and the personal data necessary for the evaluation of the guarantee claims during the guarantee period and the limitation period of the guarantee claims. For the purpose of evaluating the guarantee obligation, NORDCONN processes:
the application material of the mediated candidate (for the purpose of determining whether the candidate meets the selection criteria specified by the partner),
the fact and timing of establishing an employment relationship at the partner’s premises (for calculating the guarantee period),
the relevant employment circumstances of the mediated employee for the evaluation of the guarantee claim (filled job position, compliance with the employment conditions specified by the partner),
the manner, reason, and timing of the termination of employment (for the examination of guarantee conditions).
The legal basis for processing the above personal data is our own legitimate interest in evaluating the guarantee, as well as the legitimate interest of our partner in enforcing the guarantee (legal basis according to GDPR Article 6(1)(f)). There is no possibility to enforce and evaluate the guarantee without processing the aforementioned personal data, and in our judgment, the processing of your personal data is proportionate to our interests.
- Who Can Access Your Data Related to These Topics?
NORDCONN Employees
Employees of our companies who are responsible for handling matters related to workforce recruitment have access to applications and the personal data contained therein.
Prospective Employers
We inform prospective employers about your identity before disclosing any personal data, ensuring that you can decide whether you truly want to apply for the position. This helps prevent a situation where a business is informed about your interest in a position while you are currently employed or avoids connecting you with an undesirable business. If you consent to the data transfer or if the employer is already aware of your application, we may transmit your resume or, in its absence, the following necessary data for the application to the potential employer for the purpose of selection:
- Applicant’s name
- Data related to educational background, qualifications, and previous work experience
- Data related to changed work capacity if required for the specific job
- Date of birth if required for the specific job
- Salary expectations, interview notes, resume, cover letter, reference statement, assessment prepared by NORDCONN.
Our data processors
We may use data processors for the storage of data and for IT services related to data media and other data processing operations. Processors will act in accordance with the law and our instructions when carrying out processing operations. The data processors we use and their tasks:
|
DATA PROCESSOR |
ACTIVITIES |
|
Name: RABIT Ltd. Location: 6726 Szeged, Alsó kikötő 11. avenue D. building |
Activity: development of a recruitment system for Joblinken |
|
Name: Highlight Design Studio Bt. Location: 9742 Salköveskút, Petőfi street 49. |
Activity: development of a Joblinken career portal |
|
Name: Optivise Hungary Kft. Location: 9742 Salköveskút, Petőfi street 49. |
Activity: Joblinken career portal development |
|
Name: Imre- Szabó Katalin EV. Location: 3100 Salgótarján, Medves b. 78. ½ |
Activity: Accounting |
|
Name: ExoHora Kft. Location: 2461 Tárnok, Sport u 4. |
Activity: Invoice management, accounting |
DATA SECURITY
In order to maintain the security and confidentiality of the personal data we process and to prevent the destruction, unauthorized use or alteration of personal data, we apply the following IT and other data security and organizational measures. In addition, we keep abreast at all times of technical developments, available technical, technological and organisational solutions and apply solutions appropriate to the level of protection required by our data processing.
Personal data relating to recruitment are processed both on paper and electronically.
– Documents containing personal data kept on paper are stored in lockable cabinets protected from unauthorised access.
– Personal data provided by e-mail or other electronic means may only be accessed and processed by our employees who are authorised to have access to it. We ensure through back-ups that the authenticity and integrity of the data are preserved and that the original data can be restored in the event of destruction or alteration.
YOUR RIGHTS
1./ Withdrawal of consent
2./ Right to information / Right of access
3./ Right to access to data
4./ Right to erasure (“right to be forgotten”)
5./ Right to object to processing based on legitimate interest
6./ Right to restriction of processing
Right to data portability
Withdrawal of consent You have the right to withdraw your consent at any time without giving any reason. After withdrawal of consent, the personal data of the data subject will no longer be processed. Withdrawal of consent shall not affect the lawfulness of the prior processing.
Request for information / Right of access At any time, you can request information about whether we are processing your personal data. You have the right to request clear, transparent and comprehensible information about how we process your personal data and what your rights are in relation to this. This privacy notice is also intended to do so. Upon request, we will provide you with information about the data we process about you, the purposes, legal basis and duration of the processing, who is or has been given your data and for what purposes, and what data subjects’ rights you have if your data has not been given to us by you, and the source of the data. We will also provide you with a copy of the personal data that we hold about you on request. The first copy will be free of charge, but we may charge a reasonable fee for each additional copy. The amount of this charge will be notified to you in advance.
Right to rectify or amend your personal data If you become aware that any of your personal data is incorrect, inaccurate or incomplete, or if your personal data has changed in the meantime (e.g. you have changed your name, acquired new qualifications), please provide us with the correct, amended or additional data so that we can make the correction or amendment and keep the data up to date.
Right to erasure of your personal data (“right to be forgotten”) You can notify us at any time, without giving any reason, that you are no longer interested in the job opportunity or that you no longer wish to be contacted with job offers (withdrawal of consent). We will then delete your personal data, unless there is another legal basis for doing so. Withdrawal of consent does not affect the lawfulness of the processing that preceded it. Please note that we may refuse to delete data in particular if the data are or may be necessary for the fulfilment of our legal obligations or for the exercise of our claims.
Objection With regard to processing based on legitimate interests, you may object to our processing of your data if you consider that the processing is prejudicial to you. If you object, we will delete your personal data unless the processing is justified by compelling legitimate grounds which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Restriction of processing You may request that we designate your personal data for the purpose of restricting its future processing if one of the following conditions is met: (a) you contest the accuracy of the personal data, in which case the restriction will be for a period of time that allows us to verify the accuracy of the personal data; (b) the processing is unlawful and you object to the erasure of the data and instead request the restriction of their use; (c) we no longer need the personal data for the purposes for which they were originally processed but you require them for the establishment, exercise or defence of legal claims; or (d) you have objected to the processing and need time to verify whether there are other grounds for the erasure.
During the period of restriction, the data will only be stored and no other processing operations will be carried out unless you consent to further processing or unless such further processing is necessary for the protection of your rights, the rights of a third party or in the public interest. In the event of a restriction of processing, you will be informed in advance of its lifting
Right to data portability Where we process your personal data electronically, you may request that the personal data we have about you is provided to you or to another person you designate in a commonly known and easily usable electronic format.
HOW TO ENFORCE RIGHTS
CONTACT NORDCONN
If you wish to exercise any of the rights set out above, please send us your request in writing, if possible, to the contact details indicated in point 1. Please include your identification details and postal address in your letter. If we have doubts about your identity or if the information provided is not sufficient to identify you, we are entitled to ask you for additional identification information.
We will respond to your request within 1 month. If necessary, we are entitled to extend this period by a further two months, and we will send you a reasoned explanation.
Reasonable requests will be granted free of charge. However, if the request is manifestly unfounded or excessive, in particular in view of its repetitive nature, we are entitled to charge a reasonable fee or even refuse to act on the request.
We will inform all those to whom we have disclosed the data concerned of the rectification, erasure or restriction of the data, unless this proves impossible or involves a disproportionate effort. At your request, we will inform you of the recipients to whom we have communicated or informed as described above.
How to contact the data protection authority, make a complaint
In the event of unlawful processing, you also have the right to refer the matter to the National Authority for Data Protection and Freedom of Information (NAIH) and to initiate its proceedings.
Contact details of the NAIH:
Website: http://www.naih.hu/
address.
Postal address: 1363 Budapest, PO Box 9.
E-mail address: ugyfelszolgalat@naih.hu
Address to the Court of Justice
Please note that you have the right to pursue your claim in court. The courts have jurisdiction to hear the case. You can bring your claim before the courts of the place where we are based or the courts of the place where you live or stay.
Budapest, 12.02.2024.
NORDCONN International Ltd. and Nordconn Sweden Aktiebolag
Joint controllers