Data Controller: Shapr3D Zrt. (registered office: 1051 Budapest, Bajcsy-Zsilinszky út 12. 6/604.; 01-10-048757).
Data Subject: shall mean the applicant who submits an application to the Data Controller.
Personal Data: means any information relating to the Data Subject.
1.2. The Data Controller is committed to the protection of the Data Subject’s personal data and particularly wishes to observe the Data Subject’s fundamental right to informational self-determination.
1.4. Data Controller:
• processes the personal data lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
• collects personal data for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (‘purpose limitation’);
• processes personal data that are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
• processes accurate and up to date data (’accuracy’);
• keep personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’);
• processes the personal data in a manner that ensures appropriate security of the personal data (‘integrity and confidentiality’).
1.5. Data Controller’s data processing principles are in harmony with the relevant data protection regulations as effective, including but not limited to the following:
• The Constitution of Hungary (Freedom and Responsibility, Article VI);
• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – “GDPR”)
• Act No. CXII of 2011 on the right to informational self-determination and on informational freedom (“Info Act”);
• Act No. V of 2013 on the Civil Code;
• Act No. I of 2012 on the Labour Code (“Labour Code”).
2.1. The Data Controller strives to limit its personal data processing activity to what is absolutely necessary. Nonetheless, the processing of some personal data is inevitable. The Data Controller processes the personal data that the Data Subject provides regarding an open job position. Data Controller processes the following personal data for the purposes and on the legal basis detailed below:
• Purpose of the data processing: The personal data is necessary to examine whether the Data Subject is suitable for the position he or she applied to, in addition, Data Controller needs Data Subject’s contact details to reach the Data Subject in connection with the application. In case Data Subject’s profile settings enable LinkedIn to share the profile with third parties, Data Controller may store profiles it deems relevant for future job positions.
• List of processed personal data (always required by Data Controller): first name, last name, email address, resume (content is optional)
• List of processed personal data (required or optional based on the job offer): phone number, cover letter (content is optional), location.
• List of processed personal data (always optional): LinkedIn profile, website.
• List of processed personal data Data Controller may store: LinkedIn profile.
• Data Subject must answer the following questions (questions may change upon the specific jobs):
o How is your experience relevant for the role?
o Why is this role and Shapr3D of interest for you?
o How did you hear about this job?
o Where are you currently based?
o Are you willing to relocate to Budapest (if applicable)?
o How long is your notice period?
o What is your desired salary/package?
• Legal basis for the data processing: Data Subject’s consent. By submitting the application to a position that Data Controller advertises, Data Subject unequivocally and expressly declares that he or she has read the present data processing notice and gives consent to Data Controller to process his or her personal data in connection with the job application. Data Subject gives consent for storing LinkedIn profile by enabling it in profile settings.
• Duration of data processing:
o In case of an unsuccessful application, Data Controller stores the Data Subject’s personal data for 12 months from the moment the application was rejected on all the roles the candidate applied for. The Data Controller stores the personal data to approach Data Subject with possible job offers during the retention period. Data Controller may also store the LinkedIn profiles for the same reason for 12 months.
• Provision of personal data: It is necessary for the Data Controller to be able to contact the applicants and to assess if their application suitable for the role. Data Controller only collects personal data if the Data Subject click “submit” on the application.
2.2. In some cases, an application may be made by a third party on your behalf for a role. This may be through an agency, a referral, or via contact with one of our recruiters. In this case the third party providing information is responsible for the data transfer. When Data Controller receives an application from a third party, Data Subject will receive an email confirming the consent for the Data Controller to store the personal data.
2.3. The Data Controller does not use automated decision-making, including profiling.
3.2. The Data Subject is informed that the court, the public prosecutor, the criminal investigation authority, the infringements authority, the public administration authority, the National Data Protection and Informational Freedom Authority (“NAIH”), as well as other authorities authorized by legal regulation may request information, data and documents from the Data Controller, who will grant such requests to the extent it is required by the relevant legal regulations. The Data Controller will disclose personal data to the authorities only to the extent it is indispensable for the fulfilment of the authorities’ meticulously detailed request for information as regards the scope and purpose of information.
4.1. The Data Controller assigns the following data processors during its data processing activity:
4.1.1. Greenhouse Software Inc. (registered office: USA, 18 West 18th Street, 11th Floor New York, NY 10011; webpage: www.greenhouse.io): Providing the Applicant Tracking System that stores the applications. Greenhouse Software Inc. is fully compliant with EU data protection laws.
5.1. If the Data Subject provides personal data from third parties, Data Subject must have the required consent or other legal basis to share the personal data with the Data Controller and informs Data Controller of any change or update relating to them. All Data Subjects should refrain from providing third parties’ data.
6.1. The Data Controller treats the Data Subject’s personal data confidentially, therefore Data Controller has adopted the technical and organizational measures necessary to ensure the security of personal data and avoid their accidental or unlawful destruction, loss, alteration, processing or unauthorized access, given the state of the technology, the nature of the stored data and the risks to which they are exposed, whether they come from human action or from the physical or natural environment. The Data Controller selects and operates the IT equipment used to process personal data with respect to the contractual relationship in such a way that the processed data:
(a) is available to authorized persons (availability);
(b) authenticity and authentication are ensured (authenticity of data processing);
(c) integrity can be proven (integrity of data); and
(d) is protected against unauthorized access (confidentiality of data).
7.1. The Data Subject has a right to:
• access the personal data: Upon the Data Subject’s request, the Data Controller supplies information about the Data Subject’s data processed by the Data Controller as data controller and/or processed by a data processor on the Data Controller’s behalf if any of the conditions stipulated in Article 15 of GDPR is fulfilled.
• request the rectification of the personal data: The Data Controller rectifies the Data Subject’s personal data if such data is inaccurate or incomplete while the correct personal data is available to the Data Controller.
• request the erasure of the personal data (right to be forgotten): The Data Controller erases any and all personal data if any of the conditions stipulated in Article 17 of GDPR is fulfilled.
• restriction of processing: The Data Subject obtains from the Data Controller the limitation of the data processing if any of the conditions stipulated in Article 18 of GDPR is fulfilled.
• data portability: The Data Subject receives the personal data concerning him or her, which he or she has provided to the Data Controller, in a structured, commonly used and machine-readable format, if the processing is based on a consent or contract and it is carried out by automated means.
7.2. The Data Controller provides information on action taken on the Data Subject’s request sent to the contract address specified in Section 1.7. without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, considering the complexity and number of the requests. The Data Controller informs the Data Subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the Data Subject makes the request by electronic means, the information will be provided by electronic means where possible, unless otherwise requested by the Data Subject. If the Data Controller does not act on the Data Subject’s request, the Data Controller will inform the Data Subject without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
7.3. Data Subject’s right to remedy:
- filing a complaint with the authority: Without prejudice to any other administrative or judicial remedy, Data Subject may, in the event of an infringement of his or her rights, file a complaint with the data protection authority (Nemzeti Adatvédelmi és Információszabadság Hatóság: address: H-1125 Budapest, Szilágyi Erzsébet fasor 22/c.; Tel.: +36 1 391 1400, Fax: +36 1 391 1410, email: firstname.lastname@example.org; website: https://naih.hu/index.html).
- filing a complaint with the court: Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, Data Subjects have the right to an effective judicial remedy where he or she considers that his or her rights have been infringed as a result of the processing of his or her personal data in non-compliance with the data protection regulation. The Data Controller is liable for any loss or damage caused by the unlawful processing of the Data Subject’s data or by any violation of applicable data-security requirements. The Data Controller will be exempted from such liability if the loss or damage was caused by circumstances beyond its control and outside the scope of data processing. No compensation shall be paid to the extent that the loss or damage was caused by the Data Subject’s wilful or grossly negligent conduct.