INFORMATION ON THE PROCESSING OF PERSONAL DATA - CANDIDATES
Gi Group Recruitment Kft., Gi Group Hungary Kft., Wyser Search Hungary Kft., Grafton Recruitment Személyzeti Tanácsadó Kft. and Grafton Services Kft. (hereinafter also referred to as the "Joint Controllers" or the "Companies") wish to provide, pursuant to and in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter "GDPR"), some information on the purposes, methods and scope of communication and dissemination of personal data provided by candidates.
1. PURPOSES OF THE PROCESSING OF CANDIDATES' DATA AND THEIR LEGAL BASES
1.1. Your data is collected in the following ways:
- registration to the myGiGroup/MyWyser/MyGrafton personal area carried out from the websites of the Companies (hereinafter also "Site") or via App;
- websites of any third-party companies and social networks;
- e-mail;
- during an interview at one of the agencies.
1.2. Your data are processed for registration in the myGiGroup/MyWyser/MyGrafton personal area, to be carried out both in case of application in response to a specific advertisement published on the Site and in case of voluntary application through the Site.
1.3. The legal basis applicable to the processing of your personal data for the purpose referred to in Section 1.2. is the performance of a contract pursuant to Article 6(1)(b) of the GDPR.
1.4. Your data are processed both in the case of an application in response to a specific advertisement and in the case of a voluntary application for the pursuit of the purpose of search and selection of candidates, in particular:
a. for placement on a temporary basis at our client user company,
b. for direct placement at our third-party customer company,
c. for the implementation of active labour policy pathways or measures or in the framework of collaborations and/or partnerships with public and private market operators.
Your data are also processed to send you communications strictly related to the purpose of search and selection of candidates by traditional or automated contact methods, including communications relating to training initiatives strictly linked to a specific position, financed by our client company or by interprofessional funds.
1.5. The legal basis applicable to the processing of your personal data for the purposes referred to in Section 1.4 is the execution of pre-contractual measures taken at your request pursuant to Article 6(1)(b) of the GDPR.
1.6. Your data may be processed for all personnel searches and selections in line with your profile in order to ensure a job placement, including by sending job offers by traditional or automated contact methods.
1.7. The legal basis applicable to the processing of your personal data for the purposes referred to in Section 1.6 is the legitimate interest of the Companies, as employment agencies, in processing your data for the purpose of securing your employment, pursuant to Article 6(1)(f) of the GDPR. Should you object to such processing, your data shall be processed exclusively in the context of the specific selections for which you have applied.
1.8. Your data may be processed:
a. for analyses of aggregate data for statistical purposes, not aimed at detecting the behaviour of data subjects and without direct effects on the data subjects, and for analyses of data for the purpose of verifying and forecasting business results and for internal and external auditing purposes, which do not affect the legal sphere of the data subjects. Such analysis activities may also be carried out through the use of IT and artificial intelligence tools;
b. in an aggregate manner for the maintenance and improvement of the systems used to perform the services, in a manner not aimed at detecting the behaviour of the persons concerned and without direct effect on them.
1.9. The legal basis applicable to the processing of your personal data for the purpose referred to in point 1.8. is the legitimate interest of the Company (maintenance and improvement of company systems) pursuant to Article 6(1)(f) of the GDPR
1.10. Your data may also be processed to ascertain, exercise or defend a right of ours in court.
1.11. The legal basis applicable to the processing of your personal data for the purpose referred to in Section 1.10. is the legitimate interest of the Companies (exercise or defence of a right in court) pursuant to Article 6(1)(f) of the GDPR.
2. FURTHER PURPOSES OF THE PROCESSING AND THEIR LEGAL BASES
2.1. Your data may also be processed, with your consent, for the following additional purposes:
a. sending information and promotional communications relating to the services offered by the Companies, or carrying out studies and statistical and/or market research relating to employment services, using both traditional and automated contact methods (e.g., e-mail, SMS, instant messaging systems, operator calls, paper mail);
b. sending information and promotional communications relating to the services offered by other Group companies or the performance of statistical and/or market studies and research relating to employment services, using both traditional and automated contact methods (e.g., e-mail, SMS, instant messaging systems, operator calls, paper mail).
2.2. The legal basis applicable to the processing of personal data concerning you for the purposes set out in Section 2.1. is your consent pursuant to Article 6(1)(a) of the GDPR.
2.3. It is understood that consent to the processing of data for these purposes is purely optional; therefore, in the event of a refusal to process data for the aforementioned purposes, your data will only be processed for the purposes indicated in point 1 above.
3. CATEGORIES OF DATA PROCESSED, SOURCE OF DATA AND PROCESSING OF SPECIAL CATEGORIES OF DATA
3.1. The Companies, by way of example but not limited to, will collect the following categories of common personal data: first name, surname, password, date of birth, residence, e-mail address and telephone contacts, educational qualification, work experience and any additional data you have included in your curriculum vitae and/or provided during an interview at one of the branches.
3.2. The Companies will collect the aforementioned data from you and/or from websites managed by third parties or social networks through which the Companies publish advertisements (on behalf of client companies or on their own behalf) or through which they can consult candidate profiles.
3.3. Should you respond to an advertisement or apply voluntarily, you will be given the opportunity to declare whether you belong to a protected category in the data collection forms on the Site or during a telephone interview or at one of the branches. This information is likely to reveal your state of health and falls within the special categories of data referred to in Article 9(1) of the GDPR and will be processed in accordance with the relevant regulations in force.
3.4. The legal basis applicable to the processing of special categories of personal data concerning you for the purposes described in Section 3.3 is your explicit consent pursuant to Article 9(2)(a) of the GDPR.
Should you fail to give your consent, it will not be possible to process data concerning your membership of a protected category.
3.5. Regardless, please do not indicate any special categories of data in your curriculum vitae (personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data concerning a person's health or sex life or sexual orientation).
3.6. If special categories of personal data concerning you are processed for the purposes described in Section 1.10 the applicable legal basis is the establishment, exercise or defence of a legal claim under Article 9(2)(f) of the GDPR.
4. DATA RETENTION PERIOD
4.1. In the event of data processing for the purposes of registration to the myGiGroup/myWyser/myGrafton personal area and search and selection referred to in paragraph 1.2, the data shall be entered into the Company database and kept for 48 months from their entry or from your last interaction with the Site (access, updating of data, or uploading of your curriculum vitae), unless you wish to consent to a further period of retention of your data, which you will be asked to express before the expiry of the aforementioned term.
4.2. In the event of data processing for the purposes of establishing, exercising or defending a right in a court of law as referred to in paragraph 1.10, the data shall be included in a historical file and kept for the duration of the litigation, until the time limits for appeals have been exhausted.
4.3. In the case of data processing for the further marketing purposes referred to in Section 2, the data is entered into the Company database and stored for the duration indicated in Section 4.1 or until you withdraw your consent.
4.4. After the above-mentioned retention periods have expired, the data are deleted or anonymised, subject to technical deletion and backup procedures.
5. NATURE OF DATA PROVISION AND CONSEQUENCES OF REFUSAL
5.1. The provision of the data marked with an asterisk in the registration form for the myGIGroup/myWyser/myGrafton personal area is necessary to allow the Companies to complete your registration as per paragraph 1.2 above; therefore, any refusal to provide the requested data will prevent the Companies from completing your registration to myGIGroup/myWyser/myGrafton.
5.2. The provision of the data marked with an asterisk in the data collection form on the Site or requested from the agencies is necessary to allow the Companies to pursue the search and selection purposes set out in paragraph 1.2 above; therefore, any refusal to provide the requested data shall prevent the Companies from carrying out the search and selection activity and shall not allow your application to be taken into consideration.
5.3. The provision of data for the marketing purposes referred to in paragraph 2.1 above is optional. Any refusal to provide data or consent will have no consequence on your registration to myGIGroup/myWyser/myGrafton and will not prevent the Companies from carrying out search and selection activities.
6. RECIPIENTS OF DATA
6.1. Your data may only be processed by employees of the Company departments authorised to process them as they are assigned to the pursuit of the aforementioned purposes. These employees have received adequate operational instructions in this regard.
6.2. Your personal data may be communicated by the Companies, in pursuance of the purposes set out in paragraph 1 above, to the following entities:
- Client companies or entities;
- Ministry of Labour;
- Public bodies in the framework of the implementation of active labour policy paths or measures;
- Other market players in the case of partnerships;
- Legal advisors;
- Training organisations;
- Group companies.
6.3. Your personal data may also be processed by parties, expressly appointed as data processors, which provide the Companies:
- Site operation and maintenance services;
- Candidate database management and maintenance services;
- Archiving services;
- Communication mailing services;
- Market research services;
- Assessment and training service;
- Event organisation services;
- Marketing services.
6.4. An up-to-date list containing the addressees is available at our registered office or by sending a communication to the Companies.
6.5. Personal data provided by candidates will not be disseminated.
7. EXTRA-EEA DATA TRANSFER
7.1. Your data may be transferred abroad to recipients referred to in sections 6.1 and 6.2 outside the European Economic Area ('EEA'), and in particular to
a. Argentina, the United Kingdom and Switzerland, whose level of data protection has been deemed adequate by the European Commission under Article 45 of the GDPR;
b. Brazil, China, Colombia, Hong Kong, India, Montenegro, Russia, Serbia, Turkey, Ukraine and the USA, subject to the Companies’ signature with the data importer of the Standard Contractual Clauses adopted/approved by the European Commission pursuant to Article 46(2)(c) and (d) of the GDPR.
7.2. In the absence of the aforementioned adequate guarantees, any transfers to non-EEA countries will be performed on the basis of the exceptions provided for under Art. 49(1)(b) and (c) of the GDPR. The data subjects will be specifically notified of such transfers.
7.3. The adequacy decisions can be consulted at the following link: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
7.4. A copy of the standard contractual clauses signed by the Companies may be obtained by sending a notice to the Joint Controllers.
8. RIGHTS OF THE DATA SUBJECT
8.1 Data subjects are granted the rights set out in Articles 15 to 22 of the GDPR, where applicable.
8.2 In particular, data subjects may request from the Data Controllers access to the data, their deletion, the rectification of inaccurate data, the integration of incomplete data, as well as the restriction of processing in the cases provided for in Article 18 of the GDPR .
8.3 Data subjects have the right to object, at any time, in whole or in part, to the processing of data necessary for direct marketing purposes and for the pursuit of the legitimate interests of the Data Controllers.
8.4 Data subjects also have the right to receive the data provided to Data Controllers in a structured, commonly used and machine-readable format, and, if technically feasible, to pass them on to another data controller without hindrance, if the conditions for exercising the right to portability set out in Article 20 of the GDPR are met.
8.5 These rights may be exercised by writing by post to the address below, or by e-mail to the following e-mail address: hu.privacy@gigroup.com. It is understood that where the request is made by electronic means, the information will be provided in a commonly used electronic format.
8.6 Data subjects have the right to lodge a complaint with the competent supervisory authority (in particular in the Member State where they habitually reside or work or in the State where the alleged infringement occurred).
In Hungary: National Authority for Data Protection and Freedom of Information
Address: H-1055 Budapest, Falk Miksa utca 9-11.
E-mail: ugyfelszolgalat@naih.hu
Mailing address: 1363 Budapest, Pf.: 9.
8.7 Upon the infringement of their rights, data subjects may turn to the regional court with competence at their address or place of residence, and anyone may request an investigation by the competent supervisory authority with reference to an infringement of their rights or the immediate risk thereof.
9. WITHDRAWAL OF CONSENT
9.1 Data subjects have the right to withdraw their consent at any time via their myGiGroup/MyWyser/MyGrafton personal area or by sending an e-mail to hu.privacy@gigroup.com.
9.2 Withdrawal of consent does not affect the lawfulness of processing based on consent given prior to withdrawal.
10. JOINT CONTROLLERSHIP AGREEMENT
The Companies have entered into an agreement to assume joint controllership of the data processing, pursuant to Article 26 of the GDPR, under which a number of measures will be jointly established, in particular with regard to:
- Purposes and methods of processing of Personal Data;
- Procedures for providing timely feedback to requests by data subjects in the exercise of their rights;
- Security measures appropriate to the processing of Personal Data and data breach management procedures;
- Content of privacy notices.
You may also request to see the essential content of the joint controllership agreement.
The joint controllership agreement enters into force on the following dates:
• For: Gi Group Recruitment Kft., Gi Group Hungary Kft., Wyser Search Hungary Kft., and Grafton Services Kft. on May 2024;
• For Grafton Recruitment Személyzeti Tanácsadó Kft. on November 2024.
11. CONTACT DETAILS OF THE JOINT DATA CONTROLLERS
The joint data controllers are:
• Wyser Search Hungary Kft.
with registered office in 1053 Budapest, Károlyi u. 12, e-mail dpo.hu@wyser-search.com
• Gi Group Recruitment Kft.
with registered office in 1053 Budapest, Károlyi u. 12, e-mail dpo.hu@gigroup.com
• Gi Group Hungary Kft.
with registered office in 1053 Budapest, Károlyi u. 12, e-mail dpo.hu@gigroup.com
• Grafton Recruitment Személyzeti Tanácsadó Kft.
with registered office in 1053 Budapest, Károlyi u. 12, e-mail dpo.hu@grafton.hu
• Grafton Services Kft.
with registered office in 1134 Budapest, Váci út 35. 3.4. e-mail dpo.hu@grafton.hu
12. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)
The Data Protection Officer [DPO] can be contacted at the following addresses:
- Ms Fanni Márkus to the attention of the Data Protection Officer
- e-mail Fanni.Markus@kpmg.hu
13. CHANGES TO THIS INFORMATION SHEET
The Companies have the discretion to update this policy at any time. When the Companies do, the Companies revise the updated date at the bottom of this page. It is encouraged that candidates frequently check this page for any changes to stay informed about how the Companies are helping to protect the personal information collected. As a candidate, you acknowledge and agree that it is your responsibility to review this policy periodically and become aware of modifications.
Date: June 2024