GDPR Information - EN | GW Recruitment

Dear Prospect,

before filling out and sending the registration form and other documents, please read the information about the conditions for processing your personal data.

Information on the processing of personal data

in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of physical entities with regard to the processing of personal data and on the free motion of such data, which repeals Directive 95/46/EC (General Data Protection Regulation) ( hereinafter referred to as "GDPR")

Please read the following information on how personal data are processed. When processing your personal data, you are a person concerned, i.e. the person to whom the processed personal data relate.

The operator

The company GoodWill Recruitment, Ltd., with registered office: Letná 27, Košice- mestská časť Sever 040 01, ID number: 52 062 686, registered in the commercial register of the District Court of Prešov, Department: Sro, Insert number: 37336/P

Contact details of the operator: phone no. +421 948 172 818, e-mail: info@goodwill.sk

Contact on the responsible person: zodpovednaosoba@gwrecruit.tech

In case of any questions or if you want to exercise your rights in connection with the processing of your personal data, please contact the operator via the above

e-mail or written delivery to the address of the operator's headquarters or the responsible person.

Where are your personala data obtained from?

In most cases, personal data are obtained directly from the persons concerned. In some cases, personal data are also obtained from other sources - in such cases, the person concerned is also provided with information from which source his personal data are obtained and information about the category of personal data concerned.

Personal data are processed on the following legal basis:

- on the basis of contractual and pre-contractual relations (Article 6(1)(b) GDPR)

- on the basis of legitimate interests (Article 6(1)(f) GDPR)

- based on the fulfillment of a legal obligation (Article 6, paragraph 1, letter c) GDPR)

- on the basis of consent (Article 6, paragraph 1, letter a) GDPR).

We would like you to be informed that the person concerned is obliged to provide their personal data if the processing of personal data is necessary in connection with the fulfillment of the legal obligation of the operator.

The person concerned is also obliged to provide personal data in cases where their provision is a contractual requirement resulting from the contract concluded between the operator and the person concerned. The provision of personal data within the framework of pre-contractual and contractual relationships is necessary, otherwise, failure to provide them could make it impossible for the person concerned to participate in the selection process, conclude the contract, or its fulfillment.

If the legal basis for the processing of personal data is consent, the granting of consent is voluntary. If the processed personal data are based on your consent, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. Withdrawal of consent is not charged or otherwise sanctioned.

In the event that processed personal data based on our legitimate interests (Article 6, paragraph 1, letter f) GDPR), the person concerned has the right to object at any time for reasons related to his specific situation against the processing of their personal data carried out on this legal basis. Objections to processing may be sent to the address of the operator's registered office or to the e-mail address info@goodwill.sk

How long will your personal data be retained?

Your personal data will be retained for the time necessary to achieve the purpose for which the personal data is processed.

If your personal data are processed as part of the fulfillment of the legal obligations of the operator and the legal regulation determines the retention period or the criteria for determining it, the personal data and related documentation will be retained for the period required by the relevant legal regulation.

You can find more detailed information about the retention period later in this document.

What purposes are the processed personal data for? What is the legal basis for their processing and the processing period?

• processing the applicant's request for mediation of a job opportunity (registration of the applicant)

In this case, the personal data of the prospect based on their request are processed for the provision of a job opportunity mediation service, entered through the registration form on our website.

The processing of data for this purpose is necessary in order to take measures before concluding the contract (pre-contractual relations) based on the request of the person concerned (a prospect).

Data retention period for this purpose: until the conclusion of an intermediary contract (mediation of a job opportunity).

• mediation of a job opportunity to a prospect (candidate) and registration of interested parties

For this purpose, the personal data of the prospect (candidate) are processed to the extent of the data specified in the completed registration form on the website, in the CV and in other attached documents (or in the video presentation of a specific work skill sent) and other data that are received to us in connection with the mediation of the job opportunity provided e.g. during a personal interview (especially name and surname, place of residence, date of birth, e-mail address, telephone number, education, qualification, professional and work experience, job title, language skills, salary expectations, photo).

The processing is necessary for the fulfillment of the contract with the person concerned (Article 6, paragraph 1, letter b) of the GDPR) - an intermediary contract, the subject of which is the provision of a job opportunity mediation service.

Data retention period: until the end of the contractual relationship established by the agency contract.

• implementation of an agreement on employment mediation for payment

For this purpose, the personal data of the prospect (candidate) are processed to the extent of data necessary for the exercise of rights and obligations resulting from the agreement concluded in accordance with § 25 par. 4 of Act no. 5/2004 Coll. on employment services and on amendments to certain laws as amended (hereinafter referred to as the "Employment Services Act"). The essential details of this agreement are determined by the Employment Services Act (e.g. type of work, wage or salary and other working conditions).

The processing is necessary for the performance of the contract (agreement on employment mediation for payment) with the person concerned (Article 6(1)(b) GDPR)

Data retention period for this purpose: 10 years.

· settlement of financial claims during employment mediation (the operator's claim to contractual remuneration, the customer's claim to the return of the contractual remuneration paid)

The legal basis for the processing of personal data of prospects (candidates) is the operator's legitimate interest in resolving mutual financial obligations with the customer related to employment mediation (the existence of a claim, its application, payment). Information on the fact that an employment or other relationship with the prospect (candidate) was concluded, information on starting work and the duration of the relationship if it was terminated during the probationary period, as well as information on the rejection of the prospect(candidate) in the selection process is processed.

In this case, the data are provided to us by the customer with whom a job opportunity was mediated for the prospect. Financial claims and any settlement with the customer do not financially affect the prospect (candidate) in any way.

Retention period: 1 year from the end of the selection procedure.

• providing career guidance and consultations to prospects (candidates)

If interested, career counseling service may also be provided . In this case, the legal basis for processing personal data is the contractual relationship based on which this free service is provided.

Retention period: for as long as the prospect (candidate) is retained in the register of prospects for mediation of a job opportunity.

· keeping records of citizens to whom the operator mediated employment for payment

In this case, the processing is necessary to fulfill the legal obligations of the operator according to Act no. 5/2004 Coll. on employment services and on the amendment of certain laws as amended (§ 28). The operator is obliged to provide this data to the Central Office of Labour, Social Affairs and Family.

Retention period: 10 years.

• searching for prospects and contacting them

In the event of searching for prospects (job seekers) for our customers on websites (Profesia, ISTP, kariera.sk) or on the LinkedIn social network, personal data are processed that these individuals themselves have published/made available on the website (data in the CV and its annexes, in particular identification data, contact data, data on education, qualifications, language skills, professional experience, work classification) on the basis of our legitimate interest: to provide employment to prospects who have expressed an interest in it via social networks and websites with a focus on professional area and job search.

Retention period: 2 months.

During this time, you will be contacted with an offer of a work opportunity mediation service.

· selection procedure (applicants for employment with the operator)

The processing of the personal data of the job applicant by the operator mainly includes activities related to the reception and assessment of the submitted resume and application for employment, conducting the selection process and informing the applicant of the result (of acceptance or non-acceptance). In this case, the processing is necessary, based on the request of the person concerned, to carry out measures before concluding the contract (pre-contractual relations).

Retention period: until the end of the selection procedure.

· management accounting, processing of accounting and tax documents, invoicing and cash register records

Processing for this purpose is necessary for the fulfillment of the legal obligations of the operator, especially in accordance with Act no. 431/2002 Coll. on accounting, as amended, Act no. 222/2004 Coll. on value added tax as amended, Act no. 595/2003 Coll. on income tax as amended, Act no. 283/2002 Coll. on travel reimbursements as amended.

Retention period: 10 years (in accordance with the Accounting Act - § 35).

· ensuring network security and information security

In this case, the legal basis for processing personal data is the operator's legitimate interest in preventing unauthorized access to electronic communication networks, preventing damage to computer and electronic communication systems, and protecting data contained in the operator's IT technologies and systems.

Retention period: 5 years following the end of the calendar year in which the log was recorded.

• access and key mode management

This purpose includes activities related to the registration of access codes and passwords to the operator's individual information systems and databases, as well as the registration of access to the operator's premises. In this case, personal data are processed for it is the legitimate interest of the operator to prevent unauthorized access to the operator's systems, databases and selected premises.

Retention period: documentation related to access management and the key regime proving the access rights of a specific user to individual information systems must be retained for a period of 5 years from the cancellation of his access rights. Records of the assignment and return of keys to the operator's premises are retained for a period of 5 years from the handover (return) of the key.

• registry purposes, including records of mail sent and received

Processing is necessary to fulfill the legal obligations of the operator according to the law

no. 395/2002 Coll. on archives and registries and on supplementing some laws as amended.

Retention period: for the period required by the relevant legal regulation (i.e. for the period during which the originator of the registry needs the registry record for his activity). Personal data in the records of sent and received mail are retained for a period of 5 years (from the end of the calendar year in which the mail was sent/received).

handling requests for the exercise of the rights of the persons concerned

The processing is necessary for the fulfillment of the legal obligations of the operator according to the legal regulations on the protection of personal data (GDPR), which the operator has in connection with the exercise of the rights of the persons concerned pursuant to Art. 15 to 22 GDPR.

Retention period: 5 years from the date of processing the request, but at least until the legal end of the administrative procedure, which was initiated in connection with the request at the initiative of the person concerned.

• management of the company's agenda, registration and notification of changes to the commercial register

In this case, the processing is necessary for the fulfillment of the operator's legal obligations (Act No. 530/2003 Coll. on the Commercial Register and on Amendments and Supplements to Certain Acts, as amended, Commercial Code).

Retention period: personal data processed for this purpose (e.g. contained in the minutes of the general meeting as well as in other corporate and legal documents of the company) are kept for the duration of the legal entity of the operator (even in the event of the dissolution of the company with a legal successor).

• implementation of existing contractual relations with suppliers

Processing for this purpose is necessary for the performance of the contract to which the person concerned (supplier) is a contracting party.

Retention period: until rights and obligations from the contract are settled, but at least 10 years from the end of the contractual relationship.

• implementation of existing contractual relations with clients

This purpose includes activities connected with the fulfillment of the operator's obligations from the contract that were concluded with you as our client. Processing is necessary for the performance of the contract to which the person concerned (client) is a party.

Retention period: until rights and obligations from the contract are settled, but at least 10 years from the end of the contractual relationship.

• business communication

In this case, the legal basis for the processing of personal data is the operator's legitimate interest in communicating with customers and suppliers in the course of business activities.

Retention period: until the end of the contractual relationship with the customer/supplier.

• valid conclusion and ensuring the fulfillment of contractual relations

For this purpose, personal data of persons concerned are processed to act on behalf of the supplier/client and data of employees of suppliers/clients specified in contracts concluded within the framework of supplier-customer relations or in the drafts of these contracts. The data of these persons concerned are processed for this purpose on the basis of the legitimate interest of the operator to ensure the valid conclusion of contracts and their effective performance.

Retention period: until rights and obligations from the contract are settled, but at least 10 years from the end of the contractual relationship.

• handling the request for information (inquiry/question) entered through the contact form on the website of the operator

The data are processed for the given purpose based on the consent of the person concerned (granted by filling out and sending the contact form on the website), so that inquiry or request may be responded to.

The provision of data is voluntary, but it is not possible to process the request without providing it.

The person concerned has the right to withdraw their consent at any time by sending an e-mail to the operator's e-mail address info@goodwill.sk. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

Retention period: until the request is processed (until the required information is provided), but for a maximum period of 1 year.

performing activities aimed at acquiring a client

The stated purpose includes the activities of the operator before concluding a business with a potential client, in particular contacting (following the expressed interest) and arranging a meeting with a potential client.

If it is a client-natural person and the processing started on the basis of his request/demand for our services, the processing is necessary in order to take measures before concluding the contract (pre-contractual relations) based on the request of the person concerned.

For this purpose, personal data of physical entities are also processed acting on behalf of the client or employees of a client who has expressed interest in our services, based on our legitimate interest in acquiring a new client through communication with contact persons. In this case, personal data are directly obtained from the persons concerned or from potential clients, while ordinary personal data are exclusively processed in the scope of title, first name, last name, e-mail and telephone contact, connection to a legal entity whose employees or the executive is the person concerned and about their function/position.

Retention period: until the conclusion of the contract with the client, but no more than 6 months.

Sending marketing e-mails and electronic newsletters

Based on your consent, information about your e-mail address will be processed, to which e-mail messages will be sent with the presentation of the offered services and the newsletter. Personal data are processed for this purpose based on the consent of the person concerned. You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

If we have obtained your e-mail address in connection with the sale of goods or services, your data will be processed for this purpose based on our legitimate interest in informing customers about news in the field of services provided by us. Based on legitimate interest, our own goods and services are only marketed similar to those you have purchased from us. In accordance with Art. 21 par. 2 GDPR, you have the right to object at any time to the processing of personal data for direct marketing purposes. In that case, personal data may no longer be processed for this purpose.

Every marketing email or newsletter sent contains an unsubscribe link. If you no longer wish to receive information about our news and offers, you may unsubscribe by clicking on this link.

Retention period: 5 years.

• records of approvals for the purposes of electronic marketing

In accordance with Act no. 452/2021 Coll. about electronic communications, we are obliged to keep a durable medium on which demonstrable (prior) consent for marketing purposes is recorded, for a period of at least four years from the withdrawal of consent.

Retention period: to fulfill this obligation, the personal data of the person concerned will be retained by the operator for a period of four years from the expiration of the consent for the purpose of sending electronic newsletters (consent is granted for 5 years) or for a period of four years from the revocation of consent (if consent is revoked earlier).

• management of the agenda related to ongoing disputes and executions and the agenda of the recovery of receivables and other claims of the operator within the framework of judicial, extrajudicial, execution or bankruptcy proceedings, including legal representation in these proceedings

In the event that your personal data are processed for this purpose, the legal basis for the processing is the legitimate interest of the operator, namely the exercise or defense of the operator's legal claims, the prevention of damages and the fulfillment of claims and other legal claims of the operator. Within this purpose, your personal data may be provided to a lawyer who processes personal data to the extent necessary for the purpose of practicing law.

Retention period: 5 years from the legal end of the relevant procedure or from the settlement (payment) of the enforced legal claim.

• ensuring actions on behalf of the operator (especially concluding contracts and performing other legal acts on behalf of the operator)

In this case, the processing of personal data of managers is necessary to fulfill the legal obligations of the operator in accordance with the Commercial Code.

Retention period: for the duration of the function of the manager, but at least for the period during which it is necessary to keep written documentation related to the mentioned actions and activities as part of the activity of the operator.

• fulfillment of contracts on the performance of the function (managerial contracts) concluded with executives

Processing for this purpose is necessary for the performance of the contract to which the person concerned (executive) is a contracting party.

Retention period: until rights and obligations from the contract are settled, but at least 10 years from the end of the contractual relationship.

• presentation of the operator by publishing the executive's professional profile on the operator's website

The executive's personal data are published based on the consent of the person concerned (executive). Consent is voluntary. The recipients of published personal data are visitors to the operator's website and the company providing external support and website operation.

The provision of personal data for the stated purpose is not a legal or contractual requirement, nor is it a requirement necessary to conclude a contract. Consent is voluntary. You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal. You can withdraw your consent by sending an e-mail to the address info@goodwill.sk or by delivering a written notification to the address of the operator's headquarters.

Retention period: for the duration of the operator's executive position.

• presentation of the operator by publishing photos on the operator's website and on the LinkedIn social network (on which the operator has created a profile)

Based on consent, photos of the persons concerned (our employees) are published as part of various work presentations and other activities on the website and on the LinkedIn social network.

The recipients of published personal data are visitors to the website of the operator and users of the LinkedIn social network, the operator of the LinkedIn social network, the company providing external support and website operation.

Retention period: 10 years.

• running your own company profile on the LinkedIn social network

When operating a profile on a social network (LinkedIn), our legitimate interest is to raise awareness of the operator in the online environment and communicate via the fun page (fan page).

Personal data that you post on our "FUN PAGE" social network page such as comments, likes, videos, images, etc. will be published via the social network platform. We do not subsequently process personal data for any other purpose.

The operator of the social network has its own adopted rules, service infrastructure and own provisions for the protection of personal data. It is recommended that you familiarize yourself with the privacy protection terms of the social network platform provider: https://www.linkedin.com/legal/privacy-policy

Retention period: until the fan unfollows the fun-page (deletes posts on the operator's timeline) or files an objection to processing (in which case we, as the operator, shall delete the posts).

We use cookies on our website. These are small text files that are stored on your device (computer or other device with Internet access, such as a smartphone or tablet) when you visit websites, and which contain information about the activities of website users.

Cookies are transferred either to our website ("own cookies") or to another website to which the cookies belong ("third-party cookies"). We use temporary and permanent cookies, temporary ones are stored on your device until you close the page. Permanent cookies remain on your device until they expire or until you delete them.

For the functioning of our website, we use the so-called essential (necessary) cookies enabling the implementation of the basic functionalities of the website.

Essential cookies are processed on the basis of Article 6 para. 1 letter f) GDPR (the legal basis is the legitimate interest of the operator). Our legitimate interest is the optimization, functionality and security of the website.

You have the right to object to the storage of cookies that are collected on the basis of our legitimate interest, for reasons related to your specific situation. You can submit an objection to the operator's e-mail address below. Failure to use necessary cookies could negatively affect the functioning of the website.

With your consent, we would also like to use the so-called voluntary cookies (which are not necessary). These are marketing cookies - these collect information that helps to adapt advertising better to your interests.

In the case of marketing cookies, personal data based on Article 6 para. 1 letter a) GDPR (consent of the person concerned) are processed. Giving consent is voluntary. We ask for your consent to the use of cookies through our cookie bar. You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

By clicking the "Accept all" button, it is agreed to use of all cookies, including third-party cookies, that is used on our website.

However, if you do not want all cookies to be used on our website, you can choose a setting directly on the cookie bar ("Customize your selection" button).

You also have the option to choose "Reject all" - by clicking this button, you disable all cookies processed on the basis of consent (only necessary cookies shall be used).

As long as you do not specify your preferences on the cookie bar (you do not click any button), cookies shall not be stored, except for essential cookies.

We want you to be informed more about the individual cookie files used directly in the cookie bar.

When using the services of the supplier Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Maps service, Google General), data are transferred to a third country (USA).

For data transfer, Google uses standard contractual clauses approved by the Commission, which can be found here:

https://business.safety.google/adsprocessorterms/sccs/eu-p2p-intra-group/

Google Privacy Policy: https://policies.google.com/privacy

Recipients of personal data:

Recipients of personal data are resp. may be entities designated by legal regulations, in particular state administration and public authorities for the exercise of control and supervision, courts, law enforcement agencies, the Central Office of Labour, Social Affairs and Family.

Depending on the purpose of processing and specific circumstances, recipients of your personal data may also include other persons (in the position of intermediary or independent operator), in particular:

- postal service provider,

- an external service provider in the field of HR, accounting and payroll processing,

- a company performing external support and operation of websites,

- external service providers in the field of information systems and software products,

- external supplier of the Recru system (Cloud-IT s.r.o.),

- cloud service provider,

- operator of the LinkedIn social network,

- visitors to the operator's website and users of the social network on which the operator created his profile (LinkedIn) in relation to the published data,

- supplier of communication services and software products of Microsoft Corporation,

- operators of advertising job internet portals (Profesia, kariera.sk, ISTP),

- internet connection and data connection provider,

- the provider of the implementation and management of the cookie bar on the website of the operator,

- platform provider for managing consents to the use of cookies on the website,

- Google Maps and Google General service provider (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland),

- lawyer,

- executor,

- bank.

In cases where your personal data are processed through intermediaries, as a special category of recipients of personal data, it is made sure that they proceed in accordance with the applicable legal regulations and the conditions agreed in the contract on the processing of personal data, that they are bound by confidentiality and protect your data in accordance with GDPR requirements.

Shall your personal data be provided outside the European Union?

When using the services of the supplier we use, in connection with our online activities on the LinkedIn social network, data are transferred to the United States of America (USA). Standard contractual clauses approved by the Commission are used for data transfers:

https://www.linkedin.com/legal/l/dpa

Privacy terms of the social network platform provider:

https://www.linkedin.com/legal/privacy-policy

When providing communication services and software products to suppliers of Microsoft Corporation (intermediary), data are transferred to the United States of America (USA). For data transfer in this case, standard contractual clauses approved by the Commission are used, which can be found here:

https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA

More information on how Microsoft Corporation processes personal data can be found here:

https://privacy.microsoft.com/sk-sk/privacystatement

When using the services of the supplier Google, data are transferred to a third country (USA).

For data transfer, Google uses standard contractual clauses approved by the Commission, which can be found here:

https://business.safety.google/adsprocessorterms/sccs/eu-p2p-intra-group/

Google Privacy Policy:

https://policies.google.com/privacy

Shall your personal data be used for automated individual decision-making?

Personal data shall not be used for automated individual decision-making.

Rights of persons concerned:

The right to access personal data according to Art. 15 GDPR:

The person concerned has the right to provide confirmation that the operator is processing personal data concerning them. The person concerned has the right to obtain access to their personal data (they have the right to provide a copy of the personal data that the operator has at their disposal about the person concerned), and information about how the operator processes them to the extent according to Article 15 of the GDPR.

The right to correct personal data according to Art. 16 GDPR:

The person concerned has the right to correct personal data concerning them if they are incorrect or to supplement them if they are incomplete. The operator must submit requests for repair or comply with the addition of personal data without undue delay.

The right to erasure (the right to be "forgotten") according to Art. 17 GDPR:

The person concerned has the right to obtain from the operator without undue delay the deletion of personal data concerning them, under the conditions set out in Art. 17 GDPR (e.g. if the personal data obtained by the operator are no longer necessary for the purposes for which they were obtained or otherwise processed). This right of the person concerned shall be assessed by the operator from the point of view of all relevant circumstances in accordance with Art. 17 GDPR (e.g. the operator shall not comply with the request if the processing is necessary - to fulfill a legal obligation of the operator or to demonstrate, exercise or defend legal claims).

The right to limit the processing of personal data according to Art. 18 GDPR:

The person concerned has the right to limit the processing of their personal data by the operator if any of the cases listed in Art. 18 GDPR (e.g. if the data subject contests the correctness of personal data during the period for verifying their correctness). If the processing was limited in accordance with Art. 18 par. 1 GDPR, such personal data are processed, with the exception of retention: a) only with the consent of the person concerned, or b) to prove, exercise or defend legal claims, or c) to protect the rights of another natural or legal person, or d) for reasons of important public interest of the Union or a Member State.

The right to portability of personal data according to Art. 20 GDPR:

If the processing is based on consent or on a contract and is carried out by automated means, the person concerned has the right to obtain their personal data, which they have provided to the operator, in a structured, commonly used and machine-readable format and have the right to transfer these data to another operator. If it is technically possible, they have the right to transfer data directly from one operator to another.

The right to object under Art. 21 GDPR:

If the processing is based on legitimate interests (Article 6(1)(f) GDPR), the person concerned has the right to object at any time for reasons related to their specific situation to the processing of personal data concerning them, including objection to profiling based on the provisions of Art. 6 par. 1 letter f) GDPR. In such a case, the operator may not further process personal data, unless they prove the necessary legitimate reasons that prevail over the interests, rights and freedoms of the person concerned, or reasons for proving, exercising or defending legal claims.

The right to file a proposal to initiate data protection proceedings at the Office for Personal Data Protection

A proposal regarding the processing of your personal data may be submitted to the supervisory authority at any time, i.e. j. Office for the Protection of Personal Data of the Slovak Republic, Hraničná 12, 820 07 Bratislava, phone number: +421 2 3231 3214, www.dataprotection.gov.sk