Colossyan – Recruitment Privacy Notice

At Colossyan, we take the data protection of job applicants and candidates seriously.

If you send a job application, or submit queries regarding job applications, the information provided to us may include personal data about you. This notice summarizes how we collect, use and safeguard the personal data you provide to us in a recruitment context and what choices you have with respect to your privacy.

1. What type of personal data do we process?

For the purposes of hiring and evaluating the suitability of job applicants and candidates, we will process information that you provide to us, such as:

• Identification data (e.g. name, date of birth, gender);
• Contact data (e-mail address, phone number, address, social media profile);
• Application data (data set out in your CV such as experience, work history, skills, studies, language proficiency, etc.);
• Skills and competencies data (qualifications, test or evaluation results and associated data);
• Background check information, such as proof of your identity and reference from previous employer;
• In relation to certain specific roles, any additional data that is necessary.

In any case, we will not specifically ask for any special categories of personal data (such as health information) and we will process any special categories of personal data only with your written consent and in accordance with applicable laws.

2. Why do we process your personal data?

We will process your personal data in order to carry out candidate sourcing, recruitment processes, to come to a decision regarding entering into an employment relationship, and to contact you.

In principle, we will process your personal data to evaluate your eligibility for the applied position or similar relevant vacancies with us. Upon your consent, we may also contact you and consider your application for similar positions that may be of interest for you.

Prior to the decision about your employment, we may need to carry out certain background checks. These background checks are intended to confirm your identity and verify that you are qualified for a particular job.

Where required by law or where we believe it is necessary to protect our legal rights, interests and the interests of others, we may use information about you in connection with legal claims and compliance functions.

3. What is the legal basis of our processing?

In principle, our data processing is based on your consent.

When sharing your data with us, we ask for your consent to our processing in accordance with the applicable data protection laws and this notice. If you do not agree to our data processing in the manner outlined in this notice, please do not submit any personal data to us. If the processing is based on your consent, you may withdraw your consent at any time.

When engaging in candidate sourcing we process personal data based on our legitimate interests to hire qualified staff to our business.

4. Who is responsible for the processing of your data?

Depending on the job that you apply for, the controller of data processing is

• Colossyan Korlátolt Felelősségű Társaság (company registration number: Cg. 01-09-388753; address: 1053 Budapest, Kossuth Lajos utca 7-9., 4th floor),
• Colossyan Ltd (company registration number: 1543454; address: 5 New Street Square, London, EC4A 3TW, the United Kingdom), or
• Colossyan Inc (company registration number: 5944819; address: 1209 Orange Street, City of Wilmington, County of New Castle, Delaware 19801, USA),

provided that such local entity has been named as the hiring legal entity.

5. Do we share your data with third parties?

We never sell your personal data to third parties. However, in certain cases we need to share your personal data with our affiliates and third parties. In any case, we will share your personal data only in accordance with applicable laws and this notice, and in the following cases:

• Legal compliance: We may transmit personal data if the applicable legal provisions so require, or when such action is necessary to comply with any laws. E.g. we may share personal data with third parties outside our organization if access to the personal data is reasonably necessary to: (i) meet any applicable law, regulation, and/or court order; (ii) detect, prevent or otherwise address crime and/or security issues; or (iii) protect Colossyan’s interests in case of potential claims and civil litigations.
• Third-party service providers: In certain cases, we use third party data providers. For example, we may use tools and software for recruitment purposes and to carry out background checks in accordance with applicable laws. Our agreements with our service providers include commitments that the service providers will use the personal data that we share with them solely in connection with the services they provide to us.
• Business transactions: If Colossyan is involved in a merger or acquisition, we may transfer your personal data to the other party involved in the transaction based on our legitimate business interest.

6. International data transfers

Your personal data will primarily be stored within the European Economic Area. However, we have service providers, operations and group companies in several geographical locations. As a result, we may transfer your personal data to, or process it in, jurisdictions outside the European Economic Area or your domicile. We provide appropriate and adequate safeguards for the transfers of personal data to countries outside of the European Economic Area in accordance with applicable laws.

7. How long will we process your data?

We will retain your personal data as long as it is needed to fulfill the purposes specified above, unless a longer retention period is required or permitted by law. In principle, your personal data shared with us will be stored for the period of one year and always in accordance applicable laws.

In certain cases, we may also process and retain your personal data for a longer period to fulfill our interests in connection with candidate sourcing. In such case, your personal data may be retained for a maximum of two years with your consent. For the purpose of possible litigation, claims or regulatory investigations, we may also store personal data for a longer period based on our legitimate interest.

8. Your data protection rights

• You have a right to access the personal data processed by us. This means that you may contact us, and we will inform you what personal data we have collected and processed regarding you and the purposes such data are used for.
• You have the right to have corrected or completed any incorrect, incomplete, outdated, or unnecessary personal data we process about you.
• You may also ask us to delete your personal data from our systems. We will comply with such a request unless we have a legitimate ground to not delete the data. Please note that during the term of employment data is processed primarily due to legal obligations and therefore we may not be able to delete it.
• You may request us to restrict processing of personal data for example when your data erasure, rectification or objection requests are pending and/or when we do not have legitimate grounds to process your data.
• You may have the right to object on grounds relating to your particular situation to the processing of your personal data based on our legitimate interest. We will comply with such objections unless we have a legitimate ground not to.
• In certain cases, you have the right to receive the personal data you have provided us with in a structured and commonly used format.

You can request your above rights by send an email to privacy@colossyan.com. We will respond to your request within thirty calendar days. Please note that, we may ask you to verify your identity before complying with the request.

You also have the right to complain to a data protection authority or claim damages before the court if necessary. A list of contact details for the EU data protection authorities is available here.

9. Changes

We reserve the right to change this notice from time to time. Changes will be published on this website and any material changes will go into effect eight days following such notification. We encourage you to periodically review this page for the latest information on our privacy practices. Your continued use of our website or our Services constitutes your agreement to be bound by such changes to this notice. Your only remedy, if you do not accept the terms of notice, is to discontinue use of our Website and Services.

10. Any further questions?

If you have any further questions in relation to the processing of your data, please contact recruitment@colossyan.com.