Munkaerotoborzo.hu Magyarország Zrt (hereinafter: Data Controller) hereby informs you of its practices regarding the processing of personal data in connection with its recruitment activities, the organizational and technical measures taken to protect the data, as well as your rights regarding data processing and the possibilities for exercising those rights.
Contact details for the Data Controller: Munkaerotoborzo.hu Magyarország Zrt., 2040 Budaörs, Budapesti út 108., phone number: +36-1-211-2182, e-mail: garancsy at munkaerotoborzo.hu
1. Concepts and interpretations related to personal data
„personal data”: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
„data management ”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
„Data Controller”: the natural or legal person, public authority, agency, or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.
„Data Processor”: the natural or legal person, public authority, agency, or any other body which processes personal data on behalf of the data controller.
„Personal Data Breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored, or otherwise processed.
2. Principles of Data Processing
Personal data must be processed lawfully, fairly, and in a transparent manner in relation to the data subject.
The collection of personal data may only occur for specified, explicit, and legitimate purposes. The processed data must be adequate and relevant for the purposes of the data processing, and must be limited to what is necessary.
Processed data must be accurate and, where necessary, kept up to date. Every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay.
The storage of personal data must be in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
Personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures.
3. General Overview of Data Processing
The Data Controller is a business entity engaged in recruitment services, acting as an intermediary to connect job seekers—who meet specific criteria—with client employers. In the course of this activity, the Controller processes the personal data of the data subjects (job seekers), primarily those provided in the submitted or uploaded CVs. Additionally, the Controller processes information from telephone conversations with the applicant, including any further personal data disclosed during those calls.
The Controller acquires the personal data of job seekers from the following sources:
- Job seekers' CVs uploaded to the www.profession.hu website and forwarded to (downloaded by) the Controller
- CVs/applications of candidates applying for job advertisements posted by the Controller
- CVs/applications of job seekers registering and uploading a CV on the Controller's website www.munkaerotoborzo.hu
The Controller proceeds as follows during the recruitment process for positions to be filled by its clients:
- The Controller reviews the received CVs and selects those that meet the criteria for the position to be filled.
- The Controller contacts the selected job seekers by telephone and, if necessary, supplements the data contained in the application.
- The Controller prepares a summary (a so-called "professional profile") from the relevant data of the selected job seekers for the position to be filled and forwards it to its client seeking to fill the vacancy. This professional profile is anonymous and does not contain the job seeker's contact details; furthermore, the Controller compiles it in such a way that the job seeker cannot be identified based on the other data provided.
- If the Controller's client selects the job seeker based on the professional profile, the Controller discloses the job seeker's name and contact information (phone number and/or email address) to the client.
In addition to the above, the Controller may record and process information regarding its client who has placed an order for recruitment services.
4. The scope of processed datae
The Controller processes the personal data provided in the data subject's CV, including in particular: the name of the data subject, contact details (phone number and/or email address), data regarding educational attainment and qualifications, language skills, previous workplaces, job titles, and salary requirements.
In addition to the above, the Controller processes personal data provided in the CV that the data subject discloses voluntarily, such as the data subject's photograph, place of residence, place and date of birth, and data regarding their current place of employment.
The Controller records the telephone conversation with the data subject and processes the audio recording.
The Controller records the telephone conversation with its client (the client's contact person) who has placed an order for recruitment services and processes the audio recording.
5. The purpose of data processing
The purpose of processing the data provided in the CV is to enable the Controller to perform recruitment services; specifically, to establish a connection between job seekers and employers wishing to fill a vacancy, to find candidates who meet the requirements of the position during this process, and to maintain contact with the job seeker throughout these activities.
The purpose of the telephone conversation with the data subject is to allow the Controller to verify the data necessary for providing recruitment services and, if necessary, to request further information from the data subject.
The Controller records and processes the telephone conversation for the purpose of ensuring that the data provided in the data subject's statement and their consent to further data processing can be retrieved and verified.
The Controller may also process the data subject's personal data to enforce its own legitimate interests, where necessary. In this case, the Controller processes the job seeker's personal data to prove that the candidate was recruited and referred to the employer by the Controller, thereby enabling the Controller to enforce its claim for fees.
The Controller may process the telephone conversation with its client (the client's contact person) who has placed an order for recruitment services in order to enforce its own legitimate interests. In this case, the Controller processes the audio recording of the client or the person acting as a contact on the client's behalf for the purpose of proving the performance of the recruitment service contract and for quality assurance purposes.
6. The legal basis for data processing
The processing of your data is based on your voluntary consent (Article 6(1)(a) of Regulation (EU) 2016/679 (hereinafter: the Regulation)).
If the data subject's information (CV) was forwarded to the Controller through the www.profession.hu website, the data subject—by simultaneously registering on the website—consents to their CV becoming accessible (downloadable) to partners subscribing to the website, such as the Controller.
If the data subject registers and uploads their CV on the Controller's own website, they provide their consent to the processing of their data simultaneously with the registration and the CV upload.
If the data subject applies for a job advertisement published by the Controller, they consent to the processing of their personal data by sending their CV/application.
In the case of the recording and processing of the telephone conversation with the Controller, the data subject provides their consent to the data processing at the beginning of the call.
Where the Controller processes the data subject's personal data for the purpose of enforcing its legitimate interests, the processing is based on Article 6(1)(f) of the Regulation. In the case of the job seeker's personal data, the Controller’s legitimate interest is to be able to prove—in the event of a legal dispute—that the job seeker was referred to the employer by the Controller, thereby enabling the Controller to enforce its claim for fees.
In the case of a client placing an order with the Controller, the legitimate interest behind processing the audio recording is the Controller's interest in being able to prove the instructions given via telephone by the client within the scope of contract performance, the requests and statements made, the information provided by the Controller, and the feedback given by the client regarding the service.
7. The duration of data processing
The Controller processes the data from CVs and other documents downloaded from the www.profession.hu website until the purpose of the data processing has been fulfilled (i.e., until the vacant position is filled or the search is concluded), but for a maximum of 90 days from the date of download.
Following the above-mentioned period – until deletion at the data subject's request, but for a maximum of 5 years – the Controller may process the data contained in the data subject's CV only if the data subject has explicitly requested and consented to being contacted by the Controller with further job offers should their CV meet the requirements of a vacancy.
The Controller processes the personal data contained in the CVs/applications of job seekers who register on its own website or apply for its own advertisements until the purpose of the data processing has been fulfilled (i.e., until the vacant position is filled or the search is concluded), but for a maximum of 1 year. Beyond this period – until deletion at the data subject's request, but for a maximum of 5 years – the Controller may process the data contained in the data subject's CV only if the data subject has explicitly requested and consented to being contacted by the Controller with further job offers should their CV meet the requirements of a vacancy.
The Controller shall retain the audio recording of the telephone conversation with the data subject for a period of 5 years.
Where the Controller processes the data subject's personal data for the purpose of enforcing its legitimate interests, the data shall be processed for 5 years, or, if longer, until the conclusion of the proceedings initiated to enforce those legitimate interests.
The Controller shall process the audio recording of the telephone conversation with the client (or their contact person) who has placed an order for recruitment services for 1 year from the date of recording. The Controller may process the audio recording beyond this 1-year period if its legitimate interest in the data processing persists after the expiry of this period, particularly if a legal dispute is pending between the parties. In the latter case, the Controller shall process the audio recording until its legitimate interest in the data processing ceases to exist.
8. The scope of persons authorized to access the data (recipients)
During the period of data processing, your personal data may only be accessed at the Controller by the Controller's Managing Director, the members of the company personally participating in its activities, and employees whose access to such data is necessary for the performance of their job duties.
If the data subject meets the requirements of the position to be filled, the Controller will send a professional profile (blind CV) to its client seeking to fill the position. The data subject's identity cannot be identified from this professional profile. The Controller will only disclose the name and contact information (phone number and/or email address) of the job seeker to the client if the client has selected the job seeker based on the professional profile.
9. Data Security
The collection, storage, and any other data processing activity aligned with the purpose of the processing shall be carried out in a manner that ensures unauthorized persons do not gain access to the data.
To ensure the security of your personal data, the Controller employs physical and technical measures designed to prevent unauthorized access, alteration, or transmission of such data, as well as its intentional or accidental deletion or destruction. In doing so, electronically recorded data is stored on media equipped with state-of-the-art protection (firewall, password), and access to specific data is further protected by multiple passwords. Recorded personal data is write-protected, and the Controller performs regular backups of this information. Within the Controller’s organization, personal data may only be accessed by the aforementioned individuals and only when necessary for the performance of their duties.
10. Rights and Remedies Related to Data Processing
As a data subject, you may request from the Controller access to your personal data, its rectification, erasure, or the restriction of its processing, and you may object to the processing of such personal data.
You have the right to withdraw your consent to the processing of your personal data at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
You have the right to obtain confirmation from the Controller as to whether or not personal data concerning you are being processed. Where such processing is taking place, you have the right to access the personal data and receive information regarding the purposes of the processing, the categories of personal data concerned, the categories of recipients of the data, and the envisaged period for which the personal data will be stored (or, if not possible, the criteria used to determine that period).
The Controller shall provide a copy of the personal data undergoing processing to you. For any further copies, the Controller may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by you.
Personal data must be erased if:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws consent on which the processing is based, and where there is no other legal ground for the processing;
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the Regulation;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
- the personal data have been collected in relation to the offer of information society services referred to directly to children.
You may request that the Controller restrict the processing of your data if one of the following conditions is met:
- You dispute the accuracy of the personal data; in this case, the restriction applies for a period enabling the Controller to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims; or
- You have objected to the processing; in this case, the restriction applies for a period until it is established whether the legitimate grounds of the Controller override those of the data subject.
You have the right to receive the personal data concerning you, which you have provided to the Controller, in a structured, commonly used, and machine-readable format, and you have the right to transmit those data to another controller.
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, where the basis for the processing is:
- processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.
In this case, the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
When the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Controller shall communicate the personal data breach to the data subject without undue delay.
You may submit your request regarding the above matters to Munkaerotoborzo.hu Magyarország Zrt. (2040 Budaörs, Budapesti út 108., phone: 06-1-211-2182, e-mail: garancsy@munkaerotoborzo.hu). The Controller shall inform you of the measures taken following the request without undue delay, but no later than 1 month from the receipt of the request.
Where necessary, taking into account the complexity and number of the requests, this period may be extended by two further months. The Controller shall inform you of any such extension within one month of receipt of the request, together with the reasons for the delay. Where you make the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by you.
If the Controller does not take action on your request, it shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action. In case of failure to take action, or regarding the measures taken, you may lodge a complaint with the National Authority for Data Protection and Freedom of Information (NAIH) and seek a judicial remedy.
You are entitled to initiate proceedings with the National Authority for Data Protection and Freedom of Information (NAIH) if an infringement regarding the processing of personal data has occurred or if there is an imminent danger thereof. The Authority's contact details are: postal address: 1530 Budapest, Pf.: 5., phone: +36 (1) 391-1400, e-mail: ugyfelszolgalat@naih.hu, website: http://naih.hu.
In the event of a breach of your rights, you may take legal action against the Controller in court. The adjudication of the lawsuit falls within the competence of the tribunal (törvényszék). The lawsuit may – at your choice – also be brought before the tribunal of the place of your residence or stay.
If you have any complaints or problems regarding the processing of your personal data, please contact the Controller before initiating any of the above procedures.