Personal data protection

The basic principles of the processing of personal data in connection with the services provided by Workania Magyarország Kft. via the website www.workania.hu (hereinafter: “Website”)


1. Introductory provisions
2. Definitions
3. The basic principles and security of the processing of personal data
4. Processing of personal data in the provision of services via the Website
5. The rights of Data Subjects
6. Using a data processor
7. Transfer of data to third country
8. The entry into force and modification of the data processing notice


1. Introductory provisions


Workania Magyarország Kft. (registered seat: H-1066 Budapest, Mozsár utca 16. 3. em.; registered by the Municipal Court of Budapest as Court of Registration under company registration number Cg. 01-09-332721; hereinafter: “Data Controller”) provides services to labour market actors via the website www.workania.hu (Website). The strategic interest of Data Controller is to ensure financial and economic stability, to continuously enhance the quality of the provision of the services, to maintain fair relationships with the Clients and the Business Partners and to maintain and enhance the good reputation of Data Controller.

The achievement of the objective above is subject to the continuous development of the standard of company management and the increase of the quality and the efficiency of the service provision, in which we apply processes supported by state-of -the-art information technologies. We are aware that an indispensable condition for using information technologies is to ensure the security and the protection of the personal data.

In this data processing notice, the data controller defined the fundamental and indispensable and economically proportionate measures which ensure the protection of the devices of the information systems, individuals and assets. In terms of the protection of the assets important for the viability of the organisation, the management of Data Controller is liable for the appropriate assessment of the risks and the efficient management thereof. The primary objective of this risk management activity is to manage the security incidents and to ensure the mitigation of their impacts.In order to protect the important assets affecting its internal security, Data Controller has taken security measures based on state-of-the-art knowledge, adjusted to the needs of the organisation, in cooperation with experts. The development involved adopting technical and organisational measures following the objectives below:

With regard to the objectives above, Data Controller adopted appropriate technical and organisational measures in order to ensure the adequate security of the personal data in their controlling and processing (including the DPIA documentation, that is, a data protection impact assessment), and it has in place an elaborate, regularly updated security plan defining the extent and the means of implementation of the security measures aiming at the elimination and mitigation of the dangers and risks threatening the information systems of Data Controller.The Data Controller carries out the processing of the personal data of Data Subjects in accordance with the effective legislations at all times. The main legislations at the time of this notice are the following:

The substantive scope of this data processing notice extends to the data processing activity relating to the Personal Data carried out by Data Controller in the service provision via the Website. The personal scope of this data processing notice extends to the Clients of Data Controller and to the Data Subjects of any other potential Personal Data acquired by the Data Controller during the provision of the Services.

This data processing notice is permanently available on the Website.

Up

2. Definitions



The capitalized terms used in this notice have the following meanings:

Personal Datum or Personal Data: any information relating to an identified or identifiable natural person (Data Subject); the identifiable natural person is a person who can be identified directly or indirectly especially based on an identification number or reference to one or more factors relating to the physical, physiological, mental, economic, cultural or social identity of the person;

The special categories of Personal Data: Personal Data referring to racial or ethnic origin, political opinion, religion or belief, or trade union membership and genetic and biometric data aimed at identifying the individual identification of natural persons, health data and Personal data relating to the sexual life or sexual orientation of natural persons;

Data Subject: the person to whom Personal Data relates.

Data Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

Data Processor: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

Client: the natural or legal person who uses the Services provided on the Website, or wishes to use them, also including the Business Partners and the Jobseekers;

Business Partner: a natural or legal person which uses the Services in order to find the right worker. The Business Partner is a registered Client of Data Controller;

Jobseeker: a natural person, who primarily uses the Services provided on the Website in order find the suitable job opportunity offered by the Business Partners;

CV: the summary of the Personal Data of the Jobseeker;

CV Database: the database containing the CVs created and/or shared by theJobseekers;

Services: the services that the Data Controller provides to Business Partners and Jobseekers via the Website. The Services provided to Jobseekers include the following as regards the processing of the Personal Data: the possibility to respond to a published job offer or seasonal job offer in the database on the Website, sending suitable job offers by email, recommending a job offer to friends, communication in the job seeking forum, retrieving references via the Website. The Services provided to Business Partners include the following as regards the processing of Personal Data: publication of job offers, access to the CV Database.Processing of Personal Data (data processing): any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Transfer of Personal Data: transfer of the Personal Data to a third party who/which will continue processing them;

Disclosure of Personal Data: communication or disclosure of Personal Data to a person who/which will not process them in the future;

Consent of the Data Subject: a voluntary, explicit and comprehensible expression of will by which Data Subject gives their consent to the processing of their Personal Data based on the communicated information. The Consent is primarily certified by au audio, visual recording or video footage or the declaration of the person providing the Personal Data to the information system, or possibly another authentic procedure. The written Consent can be certified by a confirmation document. The certification of the Consent mainly contains data relating to the person granting the Consent and the addressee thereof, the purpose of the processing of data, the Personal Data concerned by the Consent, the scope thereof, and the temporal validity of the Consent;

Anonymisation of the Personal Data: an operation by which the given Personal Data can no longer be attributed to the Data Subject as a result of the modification of the Personal Data;

Supervisory Authority: the Hungarian National Authority for Data Protection and Freedom of Information.

Up

3. The basic principles and security of the processing of personal data

3.1Basic Principles



The Personal Data shall be:


3.2Responsibility of the Controller


The Data Controller is responsible for ensuring that the compliance with the principles above can be demonstrated (“responsibility”).The processing of personal data is lawful only if and to the extent that at least one of the following conditions applies:

Data Controller shall also:

Up

4. Processing of personal data during the provision of services via the Website

4.1Personal Data in the CVs and the CV Database


Services provided to Job Seekers include the ability to complete an online form on the Website or to use a printed form delivered to Profesia, spol. s r.o. with the seat Pribinova 19, 81109 Bratislava, Slovak republic or Profesia CZ, spol. s r.o. with the seat Opletalová 55, Praha 110 00, Česká republika or Workania Magyarország Kft. with the seat Mozsár utca 16, Budapest 1066, Maďarsko (hereinafter referred to as "Joint Operators“) to create a CV and to publish/provide it in the CV Database to the Business Partners of Workania Magyarország Kft. The CV Database is a joint database of the companies named above, who make it up together and who process the personal data contained there as Joint Operators. Mutual cooperation of the Joint Operators was declared in a written contract that was concluded for an indefinite period and states the conditions for personal data processing among Joint Operators. The Joint Operators have agreed: the contact place for concerned parties will be each of the Joint Operators, the information about the contact place will be published by each of the Joint Operators on their websites, the concerned parties can claim their rights pursuant GDPR with each of the Joint Operators and against each of the Joint Operators, the obligation to provide information mentioned in articles 13 and 14 of the GDPR Regulation will be fulfilled by each of the Joint Operators, the obligations and tasks related to exercising rights of the concerned parties will be fulfilled by Workania Magyarország Kft. The Joint Operators are obliged to provide mutual interaction when fulfilling obligations according to the GDPR Regulation, especially concerning the rights of the concerned parties, fulfilling the obligation to inform the concerned parties, when assessing and reporting security incidents, as well as when taking suitable measures for personal data protection. Each of the Joint Operators is obliged to publish the basic parts of this Agreement on their Website.

CVs stored in the CV Database include data classified as Personal Data under the Regulation and the Act. Therefore, such Personal Data may only be processed with the consent of the Concerned Party. The Concerned Party declares that all disclosed Personal Data is true and grants its consent to Workania Magyarország Kft. to process its Personal Data.

The purpose of the processing of this Personal Data is to provide assistance to the Concerned Party as a Job Seeker to find a suitable job. Workania Magyarország Kft. is authorised to disclose/provide the Personal Data contained in the Concerned Person’s CV to its Business Partner based on the consent of the Concerned Party and for the purposes disclosed in the previous sentence.

The Personal Data contained in the Concerned Party’s CV is disclosed/provided to a Business Partner over the Internet via the Website for a period of 3 months from the date of consent to such processing of their personal data. After the expiration of this period, the Personal Data contained in the CV shall not be made accessible and will remain stored in the CV Database in case the Concerned Party once again discloses/provides this data.

The data contained in the CV Database shall be rendered permanently anonymous and shall only be used for statistical purposes after a period of 3 years has passed since the Job Seeker’s last login to their registered account at www.workania.hu. A Concerned Party may terminate or restore the disclosure/provisioning of a CV at any time. Upon written request from the Concerned Party, Workania Magyarország Kft. is obliged to definitively delete their Personal Data.

CVs stored in the CV Database include: at least one means of contact (email address or phone number), highest level of completed education, specification of the field and job they are interested in, the definition of a location in which they are looking for a job, the type of employment sought, and gender (exclusively for the purposes of statistical processing). A Job Seeker alone decides what other data to provide in a CV; Workania Magyarország Kft. does not require that any other information be provided. Workania Magyarország Kft. in no way requires that a Job Seeker disclose any data considered a special category of personal data as defined in Article 9 of the Regulation.


4.2 Personal Data in the response sent to a job offer or a seasonal job offer


The Services provided to Jobseekers include the possibility to respond to a job offer or seasonal work job published on the Website. The job offers and seasonal job offers are published by the Business Partners. Jobseekers may respond to the job offer or seasonal job offer published on the Website. The Data Controller shall archive the responses sent by Jobseekers to the job offers published on the Website.

The responses archived by the Data Controller sent to the job offers published on the Website contain Personal Data. These Personal Data can, therefore, only be processed with the Consent of the Data Subject. Before sending his/her response to the given job offer or seasonal job offer, the Data Subject declares that all Personal Data provided by him/her are true, then he/she gives his/her Consent to Data Controller and the Business Partner advertising the job offer concerned to the processing of his/her data.

The purpose of the processing of the Personal Data is to assist the Jobseeker to find the suitable employment opportunity. The Data Controller shall archive the responses sent by Jobseekers to the job offers published on the Website. The Consent is for a 3(three)-year definite period. After the expiry of the 3(three)-year period the Personal Data shall be anonymised, and subsequently they may only be used for statistical purposes. During this period the Jobseeker may manage his/her responses sent to the Business Partners through their account registered on the Website (reviewing, repeated use, resending etc.).

The 3 (three) years are regarded as a period during which no significant changes are expected to occur in terms of the qualification of the Jobseeker or the qualification requirements relating to the specific workplace. The determination of the 3(three)-year period is based on the knowledge and experience gained by the company group of Data Controller in the field of human resources management.

The responses sent to the job offer or seasonal job offer published on the Website include the following: at least one contact detail (email or phone), the highest educational attainment and the gender (the latter data is only for statistical processing purpose). The provision of further Personal Data in the response given to the job offer or the seasonal job offer is subject to the decision of the Data Subject Jobseeker; the Data Controller does not request the provision of any further Personal Data. The Data Controller may under no circumstances ask the Jobseeker to provide Personal Data which belong to the special categories of Personal Data.

The Data Subject may send his/her CV to the Business Partner through the Website along with the annexes, in which case he/she gives his/her consent through the Website to the Business Partner to process his/her Personal Data in order to be included in the selection process carried out by the gi ven Business Partner. The selection process does not only include the process of getting hired for the advertised post but also the possibility for the given Business Partner to process the Personal Data of the Data Subject during a 3(three)-year period from the date of the Consent, including sending notifications in connection with the selection process aiming at filling other vacant posts considered to be suitable.

During the provision of the Services the Data Controller and the Business Partner act towards Jobseeker as data controllers independently and in their own name. This does not restrict the Jobseeker as Data Subject in the exercise of his/her rights according to the effective legislations with regard to or against either the Data Controller or the Business Partner as data controller.

The purpose of the processing of data with regard to the Business Partners is to find the “suitable worker”. The Business Partner may not use the Personal Data acquired through the Website for purposes other than this. After acquiring the Personal Data, the Business Partner shall be obliged to comply with its reporting obligation towards Data Subject Jobseeker in accordance with article 14 of the Regulation and section 15 of the Privacy Act. The information relating to the contractual relationship in place between the Data Controller and the Business Partner is published on the Website, where it is publicly available for the Data Subjects.

The contract of services is for a definite term not exceeding one year. (https://www.workania.hu/altalanos-szerzodesi-feltetelek)


4.3 Sending suitable job offers by email


The Services provided to Jobseekers include the creation of the so-called “agent” function through the Website which regularly sends job offers. By using this Service the Jobseeker may define the criteria for searching the job offers published by the Business Partners on the Website. These job offers are received by the Jobseeker at the email address provided by him/her.

As in accordance with the Regulation and the Privacy Act the email address qualifies as Personal Data, it is indispensable that before activating the “agent” function the Data Subject gives his/her Consent to the processing of his/her Personal Data; the processing of the Personal data – email address – is technically indispensable for the implementation of the service provision. The Consent is for a 3(three)-year definite period.

The “Sending suitable job offers by email” Service is activated by the registration created on the Website.


4.4 Recommending a job offer to a friend


The Services provided to Jobseekers include the recommendation of the job offers to other persons. Within the framework of this Service, these job offers shall be forwarded to another natural person, with the inclusion of the own message of the sender and the email address of the Jobseeker.

As in accordance with the Regulation and the Privacy Act the email address qualifies as Personal Data, it is indispensable that before sending the recommendation the Data Subject gives his/her Consent to the processing of his/her Personal Data.

The “Recommendation of job offer to a friend” Service is activated by the registration created on the Website. The email address is used for the activation and management of the registration created on the Website; the processing of the Personal data – email address – is technically indispensable for registering on the Website. The Consent is for a 3(three)-year definite period.


4.5 Communication in the job seeking forum


The Services provided to Jobseekers include the possibility to communicate with other Jobseekers in the job seeking forum operating on the Website. This Service is only available after registering on the Website. The registration on the Website is carried out using the email address. As in accordance with the Regulation and the Privacy Act the email address qualifies as Personal Data, it is indispensable that the Data Subject gives his/her Consent to the processing of his/her Personal Data before creating the registration. The email address is used for the activation and management of the registration created on the Website; the processing of the Personal data – email address – is technically indispensable for registering on the Website. The Consent is for a 3(three)-year definite period.


4.6 Retrieving references through the Website


The Services provided to Jobseekers include the possibility to retrieve references through the Website. This Service is only available after registering on the Website. The registration on the Website is carried out using the email address. As in accordance with the Regulation and the Privacy Act the email address qualifies as Personal Data, it is indispensable that the Data Subject gives his/her Consent to the processing of his/her Personal Data before creating the registration. The email address is used for the activation and management of the registration created on the Website; the processing of the Personal data – email address – is technically indispensable for registering on the Website. The Consent is for a 3(three)-year definite period.


4.7 Cookies


Cookies are small data files which are installed on the device used for visiting the Website (computer, tablet, smart phone, etc.). The Data Controller monitors the efficiency of the functioning of the Website using cookies. The cookies do not generally collect information for the identification of persons; instead, they are used to identify the browser of the specific device. The cookies can be temporary or persistent. The latter remain on the device after closing the browser for a duration determined in the cookie. These persistent cookies can be checked whenever the Client visits the Website. The scope of the information collected using the Website extends to the following: type of browser, internet address from which the browser logged onto the Website, the operating system running on the device, the IP address of the device. In order to display more relevant advertisements, the individual cookies are placed by the advertising systems of third parties – e.g. Google Adsense. This can be disabled in the settings of the Google account. The cookies can be disabled on the computer, although in this case it may occur that certain functions of the Website or certain Services will not be available.


4.8 The Personal Data of the Business Partners and its employees


When using the Services the Business Partners may provide the following Personal Data of their own employees and thus disclosing them to the Data Controller: name, email address, phone number, post. In accordance with the Regulation and the Privacy Act, the Business Partner as data controller concerned acting as the employer of Data Subject is entitled to transfer or disclose these Personal Data if it is necessary for the Data Subject to carry out his/her workplace tasks, duties or assignments. The transfer or disclosure of the Personal Data may not violate the dignity of the Data Subject or may not threaten the security of his/her Personal Data. These Personal Data may be processed by Data Controller for up to 5 (five) years from the last order received from the Business Partner; subsequently they will be permanently deleted. The above appropriately applies to the Personal Data (name, email address, phone number) provided by the executive officers or other organisational representative(s) acting on behalf of the Business Partners. The legal ground for the processing of data according to this section is the conclusion and completion of a contract of services made between the Data Controller and the Business Partner.


Up

5. The rights of Data Subjects

 

The Data Controller shall take appropriate measures in order to provide the appropriate information included in articles 13 and 14 of the Regulation, and the adequate communication according to articles 15-22 and 34 to the Data Subjects in a concise, transparent and easily accessible manner, in simple terms, especially in the event where the information is expressly addressed to minors. The information and the communication shall be provided in writing or via another suitable medium, including, if necessary, electronic devices. If Data Subject so requests, the information and the communication may also be provided orally provided that the Data Subject has duly proved his/her identity.

The Data Subject is entitled at all times to request information from the Data Controller concerning whether the Data Controller processes his/her Personal Data or not, and if so, the Data Subject is entitled to access these Personal Data, to request the following information and to exercise his/her rights below:

The Data Subject shall have the right to obtain from the Controller without undue delay the rectification of inaccurate Personal Data concerning him or her. Taking into account the purposes of the processing, the Data Subject shall have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

The Data Subject shall have the right to obtain from the Controller the erasure of Personal Data concerning him or her without processed on the basis of a Consent. Any consent given to the Controller to the processing of the Personal Data may be withdrawn. Such requests can be made by Data Subject by email to the following address: [email protected]

If the Data Subject thinks that his/her rights relating to the processing of data have been infringed, the Data Controller suggests that the Data Subject should initiate a consultation with the Data Controller via the contact person below: Csaba Zachar, email address: [email protected] .

If this consultation is not successful or the Data Subject does not intend to discuss the matter in the suggested manner, he/she can apply to the court or the Supervisory Authority. In case of a court proceeding the Data Subject may decide to initiate the proceeding before the court competent according to his address or place of residence. The data of the Supervisory Authority are the following: H-1125 Budapest, Szilágyi Erzsébet fasor 22/C.; Telephone: +36 1 391 1400; fax: +36 1 391 1410; email: [email protected]; website: www.naih.hu.


6. Using a Data Processor

 

The Data Controller uses the data processors below in its data processing activity falling within the scope of this data processing notice, with whom it cooperates in compliance with the provisions of the Regulation and the Privacy Act:


7. Transfer of data to third country

 

The Personal Data of Clients may only be transferred to data controllers and data processors located in the countries of the European Economic Area; no data shall be transferred to countries outside of the European Economic Area (third country), including the disclosure of Personal Data.


8. The entry into force and modification of the data processing notice

 

This data processing notice enters into force on 02.01.2019. The Data Controller reserves the right to unilaterally modify or amend this notice at any time, on the condition that it shall be obliged to notify the Clients of the changes without delay and to publish the changes and the date of their entry into force on the Website. Any matters not regulated by this notice are governed by the General Terms and Conditions of the Data Controller and the legislation in force in the European Union and Hungary.


9. Subcontractors

 

For the purposes of the present GCTC, the agents procuring personal data are: Google Ireland Limited, the Google Cloud Platform service in keeping with Google Cloud Platform Terms of Service published on the website: https://cloud.google.com/terms/; Hotjar Limited, C 65490, Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta





                     Mgr. Ivana Molnárová, chief executive officer of Workania Magyarország Kft.