Information for job applicants on data management
1. Name of Data Controller
The name of the Data Controller is White Hat IT Security Service and Trade Ltd. (hereinafter referred to as White Hat or the Organisation)
Head office: 1021 Budapest, Ötvös János u. 3;
Location / mailing address: 1021 Budapest, Ötvös János u. 3;
Tax number: 26373643-2-41;
Representative: Sándor Fehér Managing Director
Contact details of the Data Protection Officer:
Name: Alexandra Enyedi
Contact: privacy@whitehat.eu; ++36 20 346 9646.
2. Purpose and legal basis for processing
The purpose of data processing is to process the data necessary for the proper professional assessment of job applications and to check the conditions of employment.
2.1 Checking the conditions of employment, based on applications and CVs received
Data circle:
The information provided by the applicant in his/her CV and annexes, and any other information necessary to verify that the conditions for the post are met.
Personal data that candidates may provide in their CVs, covering letters and other attached documents, in particular but not limited to: name, maiden name, date and place of birth, address, postal address, e-mail address, landline/mobile phone number, educational qualifications, foreign languages spoken and their levels, salary requirements, details of previous and current employers , previous and current job titles and positions held, other personal data voluntarily provided by the candidate.
Legal basis:
The data processing is based on Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR”) (the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes).
In the event of refusal, the Organization will only store the personal data of the data subject if the data subject has given his or her prior explicit consent, based on Article 6 (1) (a) GDPR).
2.2. For the purposes of employment, verification that the conditions of employment are met
Data circle:
Personal data provided by the candidate in his/her CV and annex proving that he/she meets the requirements for the post.
Personal data that candidates may provide in their CVs, covering letters and other attached documents, in particular but not limited to: name, maiden name, place and date of birth, address, postal address, e-mail address, landline/mobile phone number, educational qualifications, foreign languages spoken and their levels, salary requirements, previous and current employers, previous and current job titles and positions held, other personal data voluntarily provided by the candidate.
Legal basis:
The processing is based on Article 6(1)(a) of the GDPR (the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes).
2.3. Processing of data relating to the establishment of employment
Data circle:
Personal data provided by the applicant in his/her CV and in the annex to the application, in particular natural identity data, covering letter, contact details.
If the Candidate accepts the offer of the Data Controller, the Data Controller will also collect the following data required for the preparation of the appointment/employment contract and for submission to the National Tax and Customs Administration before the Candidate starts working: identity card number, date of issue, date of validity, nationality, social security number, tax identification number, bank account number, highest level of education, specialisation, number of certificate, date of issue, number of printing/printing house, name of the institution issuing the certificate, number of the certificate of language proficiency, pension, child raised in own household 18. Children under the age of 18, family tax allowance, GYES, GYED, other employment, self-employment, previous employment.
Legal basis:
The processing is based on Article 6(1)(a) of the GDPR (the data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes).
3. The source of the personal data and the scope of the data processed, if not provided by the data subject
The Organization does not process personal data that it does not collect from the data subject.
4. Recipients and categories of recipients of personal data
The Organization will not transfer personal data processed under this Notice to any other recipient. Personal data may only be disclosed to White Hat’s staff involved in job applications, employment and traineeship preparation.
5. How and when the personal data is stored
The personal data obtained from the application file will be processed by White Hat until the date of the decision on the establishment of the legal relationship or, in the case of the establishment and continuation of the legal relationship, until the termination of the legal relationship. White Hat shall keep personal data forming part of the personal file for a period of fifty years after the termination of the legal relationship. If the applicant has given his/her explicit consent by means of a clear declaration in his/her application file, the application file will be included in White Hat’s selection database for a maximum period of 12 months in order to fill a vacant position at a later date, irrespective of the success of the application. If the applicant does not consent, his/her application will be destroyed. You can withdraw your consent to data processing by sending an e-mail to the address below. In case of withdrawal of consent, White Hat will immediately delete your application from the selection database.
White Hat does not use a data processor for the processing of the data covered by this notice, nor does White Hat perform any automated decision-making or profiling on or in relation to the data covered by this notice.
6. Access to and transfer of data
Access to the data is restricted to authorised employees of the controller. The data may be transferred to third parties only with the consent of the data subject or by law.
7. Data subject’s rights in relation to data processing
The GDPR gives Candidates, as data subjects, certain rights, which are set out below. These rights are complementary, i.e. they are additional to each other, and the Candidate may, for example, request the rectification or integration of his/her data or the deletion of his/her data.
7.1. of consent
If the data controller stores and processes the personal data of an applicant on the basis of the consent given by the applicant for the further registration of his/her application, the applicant has the right to withdraw this consent at any time. However, the withdrawal of consent does not affect the lawfulness of the processing that took place before the date of withdrawal. As a result of the withdrawal, the controller may no longer process the data concerned for the purposes indicated in the consent form as from the date on which the controller became aware of the withdrawal. In this case, the Applicant will be excluded from the register of candidates for future vacancies.
7.2 Right of access, rectification and erasure
Data subjects have the right to
(i) obtain confirmation from the controller as to whether the controller is processing personal data concerning them and, if so, to be informed of that processing;
(ii) request the correction of inaccurate personal data concerning them; and
(iii) request the erasure of personal data concerning them under certain conditions.
7.3. Right to restriction of processing
Data subjects also have the right to request the controller to restrict processing,
(i) if they contest the accuracy of the data concerning them, in which case the restriction may be requested for a period of time which allows the controller to verify the accuracy of the data;
(ii) if the processing is unlawful but the data subjects refuse the erasure of their data and instead request the restriction of processing;
(iii) where the controller no longer needs the personal data of the data subjects for the purposes of processing them, but the data subjects need those data for the establishment, exercise or defence of legal claims; or
(iv) the data subjects have objected to the processing, but a decision on the fundamental aspects of the processing has not yet been taken.
7.4. Right to object
Data subjects also have the right to object to the processing of their personal data. In the event of such an objection, the controller shall cease processing the data unless
(i) can demonstrate that there are legitimate grounds for the processing which override the interests, rights and freedoms of the data subject; or
(ii) processing is necessary for the establishment, exercise or defence of legal claims.
7.5 Right to data portability
Applicants have the option of receiving the personal data that they provide to us and that we process in a machine-readable format specified by us or of authorising us to transfer such data directly to a third party of their choice, provided that the recipient of the transfer allows us to do so for technical reasons and the transfer is not prevented by an unreasonable effort, legal or other confidentiality obligations or confidentiality considerations on our part or on the part of a third party.
7.6. Right to complain
Please contact the controller in writing (by post or e-mail) to exercise your rights as set out above. The data controller is of course also available at any time to Candidates for other requests concerning the use and security of their data. If the Applicant believes that the controller is using his/her data in an unlawful way, he/she may also lodge a complaint with the Data Protection Authority using one of the contact details below:
National Authority for Data Protection and Freedom of Information
1055 Budapest, Falk Miksa utca 9-11.
www.naih.hu
7.7. Deadline
The Organization shall comply with the data subject’s request to exercise his or her rights within a maximum of 15 days of receipt of the request. The date of receipt of the request shall not count towards the time limit. The Organization may, if necessary, and taking into account the complexity of the request and the number of requests, extend this time limit by an additional two months. White Hat will inform the data subject of the extension, stating the reasons for the delay, within 15 days of receipt of the request.
7.8. Your right to legal redress
Any person who has suffered pecuniary or non-pecuniary damage as a result of a breach of the GDPR is entitled to compensation from the controller. The court shall rule on the case out of turn. The tribunal shall have jurisdiction to hear the case. The action may also be brought before the courts for the place of residence or domicile of the data subject.
7.9. Data protection authority procedure
The data subject may lodge a complaint with the National Authority for Data Protection and Freedom of Information (1125 Budapest, Szilágyi Erzsébet fasor 22/c, phone: +36 (1) 391-1400, email: ugyfelszolgalat@naih.hu, website: www.naih.hu)
