PRIVACY NOTICE AND POLICY ON THE HANDLING AND PROTECTION OF CANDIDATE DATA

SPICE media production Korlátolt Felelősségű Társaság (seat: 1036 Budapest, Perc utca 8, hereinafter referred to as: Company) places great emphasis on compliance with the prevailing rules of data protection and ensures the due level of protection stipulated in statutory provisions and this policy for anyone applying for a position with the Company (“Candidates”). The present notice and policy (“Policy”) lays down the fundamental rules of handling the personal data of Candidates and provides Candidates with detailed information regarding every significant aspect of the handling of their data, including especially the purpose and legal grounds of data handling, the persons handling and processing their data, the duration of data handling and the persons who may gain access to such data, in accordance with the rules set out in Act I of 2012 on the Labor Code (“Labor Code”), Act CXII of 2011 on Informational Self-Determination and Freedom of Information (“Privacy Act”) and Regulation EU 216/679 of the European Parliament and of the Council (“GDPR”).

Scope of this Policy

This Policy applies to everyone who applies for a position published by the Company or who submits an application in the absence of a position publishing (so-called speculative application). Candidates are deemed to have accepted the provisions of this Policy and provide their consent to the handling of their personal data in accordance with this Policy, given that this Policy was made available to them prior to their application. In case of speculative applications, the Company must promptly inform Applicants of this Policy and request their confirmation.

The Company may unilaterally amend the Policy anytime

Legal Bases

The Company handles Candidate personal data based primarily on the following legal bases:

Preparation for a contract: This legal basis is relevant regarding all data processing activities necessary for the preparation of the employment contract.

Compliance with a legal obligation: Data processing required by EU or national law, i.e. compulsory data processing based on a law or other statutory provisions.

Legitimate interest: This covers data processing activities required for the purposes of the Company’s or a third party’s legitimate interest. Data processing based on legitimate interest is always subject to a so-called “Balance of Interests” test, which assesses whether the Company’s legitimate interest is proportionate to the restriction of the Candidate’s right to the protection of his/her personal data, privacy and how equilibrium between the interests of the Company and the Candidate can be achieved.

Consent: The personal data of Candidates is handled by the Company mainly based on their consent. Any freely given, specific, informed and unambiguous indication of the Candidate's wishes by which he or she, by a statement or by a clear affirmative action (for example by applying for a position based on a job advertisement or submitting a speculative application), signifies agreement to the processing of personal data relating to him or her shall qualify as consent. The Candidate provides his/her consent freely at all times and is thus entitled to revoke it at will. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Purpose of Handling Candidate Data

The Company declares that it handles the personal data of Candidates for the following purposes:

• recruitment, staff selection;
• keeping contact;
• providing information on any job openings;
• other HR related purposes.

Scope of Data Handled by the Company

Candidate data handled by the Company are primarily the following:

All data provided by the Candidate in his/her application and CV, especially:

a.) Candidate’s name, b.) address, c.) place and date of birth, d.) sex, e.) citizenship, f.) identification numbers issued by governmental authorities, g.) the position applied for, h.) contact data, i) qualification, j) language skills, k) CV, l) photos, m.) salary expectations.

Extent, limits and general principles of data handling

The Candidate’ personal data is handled by the Company to the extent and for the duration necessary to achieve the above defined purposes. Only personal data essential for the given purpose and suitable to achieve such purpose shall be handled.

The Company handles the Candidate’s personal data for 120 days after the position for which the Candidate applied for is filled or until the Candidate requests the deletion of his/her data. In case of speculative application, Candidate data is kept for one (1) year following its receipt or until the Candidate requests its deletion.

Upon informing Candidates of their rejection for the given position, the Company may request the Candidate’s consent to keep their personal data for a longer period in case they wish to be contacted regarding subsequent job openings. In case the Candidate provides his or her explicit consent per e-mail or in writing, the Company shall keep the Candidate’s personal data for a further year following their consent in order to provide information regarding relevant openings. In case the Candidate does not request further information regarding job openings or does not respond within two (2) weeks, their personal data shall be promptly deleted.

Confidentiality

Persons that have access to Candidate personal data at the Company are bound by an obligation of confidentiality, i.e. they must keep all personal data they acquire within the scope of performing their employment related obligations confidential. Persons handling personal may not use such for their own purposes, nor may they transfer or disclose such to any third person – with the exclusions and purposes stipulated in this Policy. Such obligation prevails without limitation even in case of the termination of their employment.

Data Security

The Company ensures the same level of data security regarding Candidates’ personal data as it does regarding the personal data of its employees.

Recipients of Personal Data

Within the scope of data transfer – excluding data transfer based on statutory provisions – the Company shall only transfer Candidate personal data to recipients seated within the European Union or who can guarantee an adequate level of protection for data handled as required by the GDPR.

Data Processors

To assist its business activity, the Company may use the services of third parties, which services may include the processing of the Candidate’ personal data. Such third parties (“Data Processors”) shall process data in accordance with the Company’s instructions and prevailing statutory provisions. Only the personal data required for the fulfillment of the given purpose shall be transferred to the given Data Processor.

Data Processors engaged in the processing of Candidate data for the Company:

• profession.hu Kft. (seat: 1123 Budapest, Nagyenyed utca 8-14. 4. em.) – posting and processing job advertisements (www.profession.hu)
• Professional Publishing Hungary Kft. (seat: 1037 Budapest, Montevideo utca 3. B. ép. fszt. 1.) – posting and processing job advertisements (kreativ.hu);
• LinkedIn Ireland Unlimited Company (seat: Wilton Place, Dublin 2, Ireland) – posting and processing job advertisements
• Upgrowth Sales Kft. (seat: 1134 Budapest, Váci út 47/B. Ü-1.) – posting and processing job advertisements (mommyworks.hu)
• No Fluff Jobs sp.z.o.o. (seat: ul. Podolska 2, 181-321 Gdynia, Polska) – posting and processing job advertisements (nofluffjobs.com)
• LION & LION CONSULTING Kft. (seat: 1039 Budapest, Boglár utca 1. IX. em. 53.) – admin and other IT services

Third Parties

Company may – especially in order to ensure performance of obligations stipulated by law - be entitled and obliged to transfer Candidate personal data to given third parties for certain purposes including specifically courts, authorities, the police, public prosecutors, local municipalities, or state security services.

Rights of Candidates

The Privacy Act and the GDPR defines the rights of Candidates regarding the handling and transfer of their personal data by the Company.

The Candidate may request access to personal data pertaining to him/her, may request their rectification, erasure, the restriction of processing and he/she may object to data processing. The Candidate is further entitled to data portability and remedies.

Right of Access

Candidates are entitled to access their personal data and the following information:

• purposes of data handling;
• categories of personal data concerned;
• categories of recipients to whom their personal data have been or will be disclosed, including especially recipients outside the EU;
• in case of recipients outside the EU, the Candidate is entitled to request confirmation that any data transfer is subject to adequate guarantees;
• the envisaged storage period or the criteria used to determine such period;
• rights of the Candidate as a data subject;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected directly from the Candidate, any available information as to their source;
• information pertaining to automated decision-making including profiling carried out in relation to the Candidate’s personal data.

In case the Candidate submitted his/her request electronically, the information shall also be provided in a commonly used electronic form, unless otherwise requested by the Candidate.

Before complying with a request, the Company may ask the Candidate to further specify his/her request regarding the information and data handling activities it pertains to.

In case the Candidate’s right of access may adversely affect the rights and freedoms of others, especially regarding trade secrets, intellectual property or personal data, the Company is entitled to refuse compliance with the request as necessary and proportionate.

In case the Candidate requests the above information in multiple copies, the Company may charge a reasonable fee based on administrative costs for such additional copies.

Rectification of Personal Data

Candidates may request the rectification of incorrect or incomplete data. The Company may, if applicable, require the Candidate to properly verify any data rectified – especially by means of presenting a relevant document. The Company shall comply with such rectifications requests without undue delay.

Upon rectifying the Candidate’s data, Company shall – if possible - promptly also inform any person to whom Company previously transferred Candidate’s data subject to rectification, unless informing such party would involve disproportionate effort. Company shall inform Candidate of such recipients upon request.

Objection Against the Handling of Personal Data

The Candidate is entitled to object any time against the processing of personal data concerning him/her on grounds relating to his/her particular situation in case of:

• processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company; or
• processing necessary for the purposes of the legitimate interests pursued by the Company or by a third party;
• including profiling based on the above provisions.

In such cases, Company shall no longer process such personal data, i.e. such data must be erased, unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Candidate or for the establishment, exercise or defence of legal claims.

Right to Restriction of Processing

The Candidate is entitled to request the Company to restrict the processing of his/her personal data where one of the following applies:

• the accuracy of the personal data is contested by the Candidate (in this case the restriction applies for the period enabling the Company to verify the accuracy of the data);
• the processing is unlawful but the Candidate requests the restriction of the usage of data instead of their erasure;
• the Company no longer needs the personal data, but they are required by the Candidate for the establishment, exercise or defense of legal claims;
• the Candidate objects to the processing based on the Company’s legitimate interest and there are no overriding legitimate grounds for the processing (in this case the restriction applies for the period required to verify whether the legitimate grounds of the Company override those of the Candidate).

Where the processing of personal data has been restricted, such personal data shall, with the exception of storage, only be processed with the Candidate’s consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the EU or of an EU member state.

The Company shall inform the Candidate before the restriction of processing is lifted.

Upon restricting the processing of the Candidate’s data, Company shall – if possible - promptly also inform any person to whom Company previously transferred Candidate’s data subject to restriction (for example the data processor providing payrolling services), unless informing such party would involve disproportionate effort. Company shall inform Candidate of such recipients upon request.

Erasure of Personal Data

The Candidate may request the Company to erase personal data pertaining to him/her without undue delay where one of the following grounds applies:

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise handled by the Company;
• the Company was processing personal data based on the Candidate’s explicit consent, however the Candidate withdraws his/her consent and there is no other legal ground for the processing;
• the personal data have been unlawfully processed;
• the personal data have to be erased for compliance with a legal obligation in EU or national law to which the Company is subject;
• the Candidate objects to the processing and there are no overriding legitimate grounds for the processing.

The Candidate must submit his/her request for erasure in writing or per e-mail and must indicate which personal data he/she request to be erased and for which of the above purposes.

In case the Company complies with the Candidate’s request for erasure, the personal data in question must be erased from all of Company’s registrations and the Candidate must properly be informed thereof.

Upon erasing the Candidate’s data, Company shall – if possible - promptly also inform any person to whom Company previously transferred Candidate’s data subject to erasure, unless informing such party is impossible or would involve disproportionate effort. The Company shall inform other data controllers that the Candidate has requested the erasure of any copies or replications of such personal data. Company shall inform Candidate of such recipients upon request.

The Company shall not be obliged to erase personal data to the extent that data processing is necessary:

• for exercising the right of freedom of expression and information; • for compliance with a legal obligation which requires processing by EU or Hungarian law;
• for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Company;
• for reasons of public interest in the area of public health;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in so far as the Candidate’s right to erasure is likely to render impossible or seriously impair the achievement of the objectives of that processing;
• for the establishment, exercise or defense of legal claims.

Right to Data Portability

The Candidate is entitled to receive the personal data he/she provided to the Company in a structured, commonly used and machinereadable format and have the right to transmit those data to another data controller, given that:

• the processing is based on consent or a contract, and
• the processing is carried out by automated means.

Where technically feasible, the Company shall directly transmit personal data to another data controller in accordance with the Candidate’s request. The right to data portability does not create an obligation for data controllers to adopt or maintain processing systems which are technically compatible.

In case the Candidate’s right of data portability may adversely affect the rights and freedoms of others, especially regarding trade secrets, intellectual property or personal data, the Company is entitled to refuse compliance with the request as necessary and proportionate.

Remedies

In case the Candidate believes that the handling of his/her personal data by the Company is in breach of prevailing statutory provisions pertaining to data protection, thus especially the GDPR, he/she is entitled to lodge a complaint with the National Data Protection and Freedom of Information Authority (seat: H-1125 Budapest, Szilágyi Erzsébet fasor 22/c.; e-mail address: ugyfelszolgalat@naih.hu; postal address: 1530 Bp. Pf.: 5, website: www.naih.hu; telephone number: +36 (1) 391-1400).

The Candidate is entitled to lodge a complaint with any other supervisory authority, in particular in the EU member state of his/her habitual residence, place of work or place of the alleged infringement.

Without prejudice to the right to lodge a complaint, the Candidate is entitled to judicial remedy in case his/her rights under the GDPR have been infringed.

The Company, as a Hungarian data controller may be brought before court in Hungary. The Candidate may file such action either with the tribunal having jurisdiction based on the Company’s seat or the one with jurisdiction based on his/her own place of domicile. Contact data of Hungarian tribunals can be accessed here: http://birosag.hu/torvenyszekek.

In case the habitual residence of the Candidate is in another EU member state, such proceedings may be brought before the regular courts of such state.

Who Can Candidates Turn To?

Please turn to Kamila Utegenova (tel.: +36 70/313-4549; e-mail: kutegenova@spicemediaproduction.com) with any requests or questions regarding the handling of your personal data.

Social Media

Within the scope of its recruitment process the Company may review the information of Candidates which they have made publicly available for anybody regarding themselves on certain social media platforms – including especially their public Facebook and Linkedin accounts.

The Company shall however under no circumstances review or make efforts to review any information of the Candidate which is not available to the general public, but only to certain persons, within the scope of a closed or secret group or any similar arrangement.

The Company shall only access and assess any social media information regarding the given Candidate that may be relevant to the position to be filled in accordance with Section 10(1) of the Labor Code.

The Company shall under no circumstances copy, store or transfer the Candidate’s social media profile.

Automated Decision-making and Profiling

The Company does not engage in automated decision-making and profiling in relation to its Candidates.

Miscellaneous

The present Data Protection Policy enters into force on 25 June, 2020 and is valid until revocation by the Company.

The Company may unilaterally amend the present Data Protection Policy any time.