Please read the following
information carefully!

Privacy notice

2023.

The purpose of the following Privacy Notice is to inform you about the data processing activities of Carbyne Ltd. (registered office: 1111 Budapest, Lágymányosi utca 12, szt 2., company registration number: 01-09-293516, tax number: 25868593-2-43) in connection with the provision of job placement and long-term career counselling services and the operation of its website www.carbyne.hu in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 20 December 2016 on the protection of individuals with regard to the processing of personal data and the processing of personal data in the course of the provision of employment services and long-term career counselling services. April 27, 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Regulation (EC) No 95/46/EC (General Data Protection Regulation – GDPR) and in accordance with the provisions of the Hungarian legislation in force.

Carbyne Ltd. is considered a data controller (hereinafter referred to as “Controller” or “we”) with respect to the processing of data in the course of providing job placement and long-term career counselling services and the processing of data related to the operation of the website www.carbyne.hu. The Controller’s contact details are info@carbyne.hu.

The Data Controller shall comply with the provisions of applicable law in its data processing operations and shall fully respect the fundamental rights and privacy of individuals in its data processing practices, with particular regard to the provisions of the General Data Protection Regulation.

1. General principles of data processing and specific principles applicable to the Data Controller
2. a) The Data Controller shall process personal data, including your career data, that comes to its knowledge in the course of its activities in accordance with the applicable legal provisions and the provisions of this Privacy Notice. The Data Controller processes personal data only for specific purposes, for the exercise of rights and for the performance of obligations.
3. b) The processing of data by the Controller does not constitute an online job placement activity without human intervention, as the Controller does not use automated decision-making (AI) tools.
4. c) Please be informed that the processing and recording of data, at all stages of the processing, complies with the requirements of fairness and lawfulness.
5. d) At all stages of the processing, the Data Controller shall ensure that you have the right to know at any time which data are processed by the Data Controller, for which purposes and to object to the processing at any time.
6. e) The Controller shall design and implement the processing operations in such a way as to ensure the protection of your privacy.

(f) The Data Controller shall document its operations on an ongoing basis, ensuring to its best intent the authenticity of each data record or input in its databases.

1. g) The Data Controller shall not transfer or sell or lend personal data to third parties for any purpose. Only the processors identified in this Privacy Notice shall have access to your personal data as indicated therein.

(h) Any transfer of data to another controller independent of the Controller shall be notified to you in advance by the Controller in all cases, unless it is required to provide a long list, in which case the transfer concerns the narrowest data set.

1. Processing of data in the course of providing job placement and long-term career counselling services

Data processing purposes

The Data Controller processes the data of persons who use or potentially use its services (hereinafter “you” or “data subject”) in the course of providing job placement and long-term career counselling services. In this context, the Data Controller records your personal data in its databases so to enable you to participate in or become aware of and apply for future job applications.

We process your personal data for the above purposes, namely

– record and register it in our database;

– enable your participation in selection procedures for our clients;

– transfer your personal data to our client who advertises a specific job vacancy matching your needs.

Categories and types of personal data processed

The Data Controller undertakes to process only the amount of personal data that is strictly necessary for the purposes of the processing. Personal data shall be processed only to the extent and for the duration necessary to achieve the purposes for which they are collected.

processing operation	personal data processed
1. contacting, maintaining a personal data sheet in the Data Controller’s databases; the data content of the data sheet depends on the intensity and nature of the use of Data Controller’s job placement and career counselling services by the data subject	contact details (name, email address, mobile number); CV; LinkedIn profile link and details of your professional history available there; personal details to be included in a personal or telephone interview; comments; current job and job title, a brief summary of your professional career, career motivation factors, salary expectations; contact details of third parties you have provided us with (name, email address, phone number, relation) and reference details you have received from them; any other information you share with us (e.g. previous test results, letters of recommendation); salary requirements; notice period; other/recent information published by you in a public database found by the Data Controller in the course of its daily operations; data provided at the time of recommendation;
2. preparation of a long list based on a contractual commitment	name, company name, position, job title, new position available in public database(s);
3. job placement (fulfilling contractual obligations to clients)	steps in the recruitment process after the presentation of the candidate; data from the SHL test report, which will be shared with you and the client; in case of a client request, copy of qualifications/diploma/professional qualifications; summary assessment; client decision; offer (e.g. offer letter); fact and date of employment, salary amount, position;
4. meeting contractual terms and conditions with customers	the fact, date and nature of the termination or establishment of the employment or other legal relationship.

 

If the Data Controller contacts you on the basis of data obtained from a third party, you will be informed at the time of contact about the source of your personal data.

We will only process special categories of data (e.g. health, gender identity, religion, criminal personal data) about you if it is necessary for the purposes of selecting you for a specific job offer you have applied for and you have shared such data with us. There may be occasions when the processing of sensitive data

1. a) is necessary for the performance of a legal obligation and the exercise of a specific right under the law (GDPR 9§ (2) b)) or

(b) we consider it necessary to process certain special categories of data in order to meet equality opportunity requirements. In any case, you will be informed in detail about the use, transfer and deletion of special data.

The Data Controller is not responsible for the processing of special categories of data brought to its attention (e.g. in a CV uploaded during online registration) without its expressed request.

The Data Controller does not track your online activity and therefore does not collect personal data about you on any website, including social media, does not send newsletters and does not link its databases to data processed by other data controllers.

Legal basis for processing

Your personal data is processed by the Data Controller for the purposes of providing job placement and long-term career counselling services on the basis of the legitimate interests of the Data Controller and its third party clients (GDPR § 6 (1) f)). Legitimate interest of the Data Controller and its third party clients is the interest in providing job placement and long-term career counselling services, which can only be achieved by collecting personal data of individuals (e.g. those who are potential job applicants) who are the target audience of its services in a database, contacting them as necessary and supporting them in their labour market activities. The provision of the service necessarily involves the processing of personal data, because without processing the personal data of the data subjects, the Data Controller cannot continue its activities. The Data Controller base its activity on a balancing test to demonstrate the non-detrimental effect on data subjects of the processing of data relating to the provision of job placement and long-term career counselling services, in accordance with the law.

The Data Controller’s client who advertises a job application is also considered a data controller under the law, so that the Data Controller (we) and our client (“Joint Data Controller”) are considered joint data controllers for the processing of your data from the presentation of the candidate until the date specified in the contract between the Data Controller and the client (end of candidate tenure, 12-24 months), concerning the data processing activities indicated in sections 3. and 4. above. The Joint Data Controller(s) act independently of the Data Controller and under their own responsibility. Please refer to their published data processing document(s) for their commitments regarding data processing.

III. Provision of talent mapping services

The Talent Mapping service is a service that we provide to our clients to identify the most suitable candidates for the relevant jobs without advertising the job. We provide our clients with a brief profile of the candidates, focusing on the job covered by the service. The Talent Mapping service is not yet a recruitment service, but a pre-placement, pre-placement orientation, pre-placement preparation and pre-placement support activity. In the context of Talent Mapping, we ask for your prior consent to recommend a specific client and to transfer your data (GDPR § 6 (1) a)).

processing operation	personal data processed
collecting data ordered by the client for the talent mapping and providing it to the client	Name, current job and job title, brief summary of your career, career motivation factors, salary expectations

 

With regard to personal data transferred to the Data Controller’s client (Joint-Controller) in the course of providing the Talent mapping service, the Data Controller and the client shall be considered as joint data controllers from the moment of the transfer. The Joint-Controller(s) shall act independently of the Controller and under their own responsibility. Please refer to their published data processing document(s) for their commitments regarding data processing.

1. Data processing operations, data transfers, possible recipients of the personal data

The Data Controller may get into contact with you in the following ways:

1. the Data Controller may contact you:
2. a) via social media, we will ask you to contact us, to confirm the contact; in this case, the contact will be established between the Data Controller and you according to your explicit intention;

b)a third party provides the Data Controller with your data, in which case the Data Controller will contact you immediately after receiving the data; at the time of contact, you may object to or accept the processing.

2. You contact the Data Controller
3. a) via the Controller’s website or by email;
4. b) through a social media channel;
5. c) on the basis of a job advertisement sent to you via another job website;
6. d) by telephone.

We will record the personal data we obtain about you when you contact us in our databases. If we contact you by email or you contact us, your email details will also be stored in our mail system. The data you send to us via www.carbyne.hu will be regularly deleted from our website storage and permanently stored only in our databases. We may also record your personal data (name, company name, position, title) in our database if we include you in a long list of potential candidates for a particular job placement.

In addition to the service providers (data processors) identified below, your personal data will only be accessed by (i) employees of the Data Controller, in respect of whom the Data Controller ensures that their procedures comply with the applicable data processing legislation and this Notice, and (ii) the Data Processors, who are independently responsible for their compliance with the applicable legislation.

Our website (www.carbyne.hu) is operated by means provided by Rackhost Zrt. (6722 Szeged, Tisza Lajos körút 41.) (data processor), with the result that personal data received by us through the website is stored for a short period of time on the servers of the data processor.

The personal data we process is stored in a cloud-based CRM system (recruitcrm.io), which is ensured by the service provider to comply with data management legislation. The CRM system provider stores and saves your data as a data processor. The name and contact information for the data processor is Workforce Cloud Tech, Inc., 10490 Mira Vista Road, Cupertino, CA, 95014. USA, support@recruitcrm.io.

Our mailing system and shared file system (G-suite) is operated by Google LLC, and accordingly Google Cloud EMEA Limited, Velasco Clanwilliam Place Dublin 2, Ireland, contact: https://about.google/intl/en_in/contact-google/

The data stored by these processors is stored on servers located in a third country (the USA), which is considered a safe third country under the applicable law.

We will transfer certain personal data we hold about you in our databases to our customer (the “Joint Data Controller”) who

(i) has advertised the job application you are interested in and whose identity you will in any case be informed of in advance, in which case we will provide you with the complete application file (CV, resume, salary expectations) (“presentation”);

(ii) is requested us to provide a ‘long list’ of candidates’ basic information (name, company name, position, remarks) based on our database.

1. Duration of processing, termination of processing

The Data Controller shall immediately cease processing the data in the context of the provision of the services covered by this Notice and shall delete the data processed in relation to you in the course of the provision of the services, if you object to the processing in writing by sending an e-mail to info@carbyne.hu.

Under the same procedure, you may object to the transfer of data to the Data Controller(s), which objection will be promptly forwarded by the Data Controller to the Data Controller(s).

Your personal data will be deleted at the end of the 20th year after inclusion in our database, unless there is a meaningful interaction between us before then, which will result in the restart of the 20-year period. A meaningful interaction is when (i) we contact you about a specific job opportunity and you do not opt-out, (ii) or when you send us a resume for database updates by email or through our website, (iii) or when you refer someone to us.

We will delete the SHL test report for a specific job application at the end of the 2nd year after the application closes. We may use the data contained in the SHL test report for further job applications, or pass it on to other clients, in case you consented.

Where necessary and justified for tax compliance purposes, data supporting the settlement of accounts with customers are stored until the end of the 8th year in order to meet accounting obligations under Article 169 of Act C of 2000.

1. Information on your rights in relation to data processing

You have the rights set out below in relation to the processing of personal data that you provide to us as described above or that come to our knowledge in the course of processing.

You may exercise your rights by notifying the Controller in writing, by email or postal letter, which rights you wish to exercise, in relation to which data or all of your data, and in what way. In the event of such an indication, the Controller shall act in accordance with the applicable law and shall process your request within a maximum period of 1 month, which may be extended in cases provided for by law. A response will be sent only if the request makes it possible to identify you beyond reasonable doubt. To this end, please contact the Data Controller at info@carbyne.hu to exercise your rights. The reply will be sent to you in the same way as the request (electronically or by post).

You may also contact the Data Controller to enforce your rights. You will be informed of the contact details of the Data Controller at the time of the personal interview or in the notification of the inclusion in the Talent Mapping service. You can exercise your rights equally towards both data controllers.

1. You have the right to be fully informed about the processing of your personal data by the Data Controller

In this context, in addition to the continued availability of this Privacy Notice, you have the right to request a copy of your personal data processed by the Controller, which the Controller can provide to you free of charge in an excel-readable .csv format. The Data Controller is obliged to provide you with a copy of the processed data only in such a way that it does not infringe the rights, other rights and freedoms of any other person with regard to personal data.

1. You have the right to rectification of your data processed by the Controller

If you find that your personal data are inaccurately recorded in the Controller’s records, you have the right to request the rectification of the personal data processed. You may do so in writing by sending an email to the contact details indicated above. In relation to the possibility of complying with a rectification request, it is always necessary to examine the underlying purpose of the processing and the Controller is only obliged to comply with the rectification request if it is related to the purpose of the processing.

If you request the rectification of your personal data, the Data Controller is obliged to notify everyone to whom you have disclosed your personal data in accordance with this Notice.

1. You have the right to request the restriction or deletion of the processing of your personal data by the Controller

You may request the restriction of processing in the event that you,

– if you believe that your personal data processed by the Controller are inaccurate, you may request the restriction of processing until the personal data processed are rectified;

– if you otherwise request erasure of the data, but instead the restriction of processing is more in your interest;

– if the Controller could already delete your data because the purpose of the processing has ceased, but it is in your interest for the purposes of pursuing a legal claim that your data should not be deleted, but only restricted;

– if you object to the processing based on the legitimate interests of the Controller, you may request the restriction of the processing of your personal data during the transitional period until it is established whether or not the legitimate interests of the Controller prevail over your personal data interests.

During the period of restriction, your personal data may only be stored or processed for the purposes of public interest or legal claims. The Controller shall inform you of any lifting of the restriction of processing.

 

You may request the erasure of the personal data processed if

– the processing carried out by the Controller is unlawful;

– the personal data are no longer necessary for the purposes for which they were collected by the Controller;

– the law applicable to the processing so provides;

No erasure of the personal data processed is possible if:

– the processing is necessary for the exercise of the right to freedom of expression and information;

– processing for the fulfilment of a legal obligation to which the Controller is subject or in the public interest;

– for the establishment of legal claims;

– in the public interest of public health;

– for scientific or historical research, archiving or statistical purposes in the public interest;

necessary for.

If you request the restriction or deletion of your personal data, the Data Controller must notify everyone to whom you have disclosed your personal data in accordance with this Notice.

1. You may object to the processing of your personal data

You have the right to object to processing based on the legitimate interest of the Controller. You may exercise your right to object at any time. If you do so, the Controller will immediately cease processing and delete your personal data as referred to above.

1. Portability of your personal data

You may request to receive the personal data you have provided in a commonly used, machine-readable format or to be transferred directly to another controller.

1. You have the right to complain

If you believe that we have violated the legal provisions on the protection of your personal data by our processing, you have the right to lodge a complaint with the competent supervisory authority, which is the National Authority for Data Protection and Freedom of Information (www.naih.hu; 1055 Budapest, Falk Miksa u. 9-11; phone: +36-1-391-1400; e-mail: ugyfelszolgalat@naih.hu.

VII. Data security measures taken by the Data Controller

The Data Controller shall ensure the security of the processing of your personal data and shall take technical measures to ensure that the data collected, stored and processed are protected and shall take all necessary steps to prevent their destruction, unauthorised use and unauthorised alteration. In addition, the Data Controller shall make every effort to ensure that the transfer of data to the Data Controller(s) is carried out in a secure manner, as specified by the Data Controller or in accordance with the instructions of the Data Controller.

VIII. Scope of this Notice, Amendments

The provisions of this Notice shall enter into force on the date indicated on the first page and shall govern the activities of the Data Controller from that date. The Data Controller may amend this Policy at any time, which amendment shall apply to the processing of data after its publication on the Data Controller’s website and shall be effective as of its publication to you on the website. If you do not agree to any amendment to this Notice, you may exercise your rights to erasure or restriction of the rights set out in this Notice, provided that the conditions for such erasure or restriction are met.