Home | Protection of personal data as part of the hiring and onboarding process

Protection of personal data as part of the hiring and onboarding process

1. General Provisions

This Notice on the Protection of Personal Data as Part of the Hiring and Onboarding Process (the “Personal Data Processing and Privacy Notice”, or “Privacy Notice” for short) is designed to inform you how the Data Controllers (i.e., “we”) obtain, store, and process your personal data in connection with the hiring of new staff, and how they otherwise handle and dispose of, as well as protect, your personal data.

Personal data is understood to mean any information relating to an identified or identifiable natural person who seeks employment (hereinafter “you”, or the “applicant”).

In addition, this Privacy Notice seeks to inform you of your rights in connection with the processing of your personal data, and the ways in which you may exercise these rights.

We recommend that you carefully familiarize yourself with the information set out in this Privacy Notice.

2. Data Controller

The data controller with respect to your personal data is First Line Software s.r.o., Na Hřebenech II 1718/8, 140 00 Praha 4-Nusle, VAT ID CZ04414802, based on the existing Agreement on the Rights and Obligations of Joint Data Controllers in the Area of Recruitment.

3. Data Processing: Purpose; Legal Basis; Scope, Duration

3.1 Legal bases, purposes, and duration of processing

Our processing of your personal data is limited in scope to the discharge of our obligations under contract and in law and, where applicable, to processing based on your consent for certain purposes as set out further below.

We are processing your personal data for the purpose of recruitment for specific job positions and possibly for the conclusion of an employment relationship between you and us with respect to such position.

Such data processing is indispensable for the conclusion of any employment contract between you and us. For this reason, we shall process your personal data until the recruitment process is complete.

If you give us your consent, we may also process your personal data for the purposes of contacting you with job offers for other suitable positions and the subsequent recruitment process for such positions.

In such a case, we will further process your personal data for no longer than the time period specified in the Notice of Consent, whereas this time period customarily will not exceed three years from the date on which consent was granted.

If you give us consent (via the relevant online interface or otherwise), we will also process your personal data for the purpose of being able to contact you with job offers for other suitable positions within the company and for the purpose of the related recruitment procedures.

In specific cases, you may submit to us the personal data of third persons, which we will then process to approach such individuals e.g. because you listed them as references for previous employment etc. The contact details which you pass on to us must have been obtained in accordance with the applicable laws, and the relevant individuals must have been advised by you that we may contact them for a selected purpose. The legal basis for such data processing is our legitimate interest.

3.2 Scope of processing

We will process your personal data in the following scope: the information you provide to us during the recruitment process and in your C.V., i.e., primarily, your full name and address, e-mail address, phone number, level of formal education, current labor market status, previous work experience, acquired skills, your likeness (photograph), and such other data as may be contained in your C.V. or otherwise made available to us.

4. Sharing And Transferring Personal Data (With / To Data Recipients)

4.1 Recipients of personal data

We may share certain categories of personal data which we collected in the above-described manner with third parties who are either independent controllers or whom we have commissioned with certain services related to the recruitment process and who thus act as our processors. These are, in particular:

i. organizations in charge of the administration of our IT systems and organizations providing IT services in order to manage and organize recruitment processes, as processors;

ii. organizations concerned with recruitment and with the advertisement of job opportunities, as processors;

iii. government organizations or other third parties, in the course of discharging obligations under the law.

4.2 Warranties

We have entered into Data Processing Agreements with the processors of personal data referred to in the preceding paragraph (with the exception of cases where such agreements are not mandatory, e.g. when disclosing personal data to public officials), and these agreements warrant a level of protection which is at least equal to that afforded by this Privacy Notice.

5. Data Security

In accordance with best commercial practice, we have put into place, and maintain, appropriate technical and organizational measures, internal safeguards and information security processes that reflect the potential risks which you as the data subject may face. At the same time, we take into account the state of technological development so as to protect your personal data from random loss, destruction, tampering, unauthorized disclosure, and unauthorized access. Among other things, these measures may include taking appropriate steps to hold employees liable who have access to your data; staff training; regular backups; data recovery and incident management procedures; software protection for devices on which personal data has been stored, etc.

6. Your Rights as a Data Subject

If you exercise any of your rights as set out further below in this section, or pursuant to the laws then in force, we will notify any recipient to whom we transferred data pursuant to Section 4 of this Privacy Notice of the measures taken, or of the fact that your personal data was erased, or of the restriction of processing, provided that such notification is feasible and/or does not require disproportionate efforts. If you wish to exercise the said rights and/or obtain detailed information, please reach out to us using the contact details in Section 2 of this Privacy Notice.

6.1 What demands are available for you to make?

In accordance with the applicable laws and regulations, you may demand access to your personal data which we have been processing in the capacity of data controller; you have a right to their rectification, erasure, or transfer (i.e., the portability needed to transfer your personal data to another controller based on your request), the right to bring objections, and the right to demand that we restrict our data processing. In addition, you may at any time revoke any consent with the processing of personal data which you have given at an earlier point.

6.2 Rectification of your personal data

Under the applicable laws, you are entitled to demand the rectification of your personal data processed by us, if you find that this data is inaccurate or incomplete.

You may contact us at any time to enquire whether we are still processing your personal data.

6.3 Erasure of your personal data

You may ask us at any time to erase your personal data. If you approach us with such a request, we will promptly delete any and all of your personal data in our possession, unless where we still need this data to discharge our obligations under contract or in law, or in order to protect our legitimate interests. We will also erase all your personal data (and see to it that the data processors commissioned by us will do likewise) if you revoke your consent with data processing.

6.4 Withdrawing consent

If you have given consent with processing for the purposes listed earlier above, you may withdraw such consent at any time without giving reasons. To this end, please get in touch with us using the contact details set out in Section 2 above. In such a case, we will promptly erase your personal data. Please note that withdrawing your consent has no bearing on the lawfulness of processing which took place based on your consent prior to such withdrawal.

6.5 Accessibility and portability

You are entitled to obtain confirmation as to which of your personal data we are processing or not. If you so require, we may directly transfer certain personal data (i.e., in particular, personal data which we have been processing based on measures taken prior to the conclusion of a contract and/or based on your consent) to a third party (another data controller) as specified in your request, provided that such request does not adversely affect the rights and freedoms of others, and provided further that it is technically feasible.

6.6 Objections against processing

To the extent that we are processing your personal data based on our legitimate interest, you may at any time raise an objection against the processing of such data. We will then no longer process your personal data, unless we can show that there exist compelling legitimate grounds for processing on our part which override the interests, rights or freedoms of the data subject, or unless continued processing is necessary for us to establish, exercise, or defend legal claims of ours.

6.7 Restriction of processing

If you ask us to restrict the processing of your personal data, i.e. because you contest the accuracy or lawfulness of processing or you doubt that we have need to process your personal data, then we will restrict our processing of your personal data to the absolute minimum (i.e., storage); any processing shall be limited to the establishment, exercise, or defense of legal claims, or else because the rights of another natural or legal person need to be protected (or for such other grounds for processing enumerated by the law). Once the restriction of processing has been lifted and we resume the processing of your personal data, we will promptly notify you of this fact.

6.8 Complaint with the Data Protection Office

You may bring a complaint against the way in which we process your personal data with the supervisory authority, i.e., the Data Protection Office (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7. The website of the Office is www.uoou.cz.