Roche SERVICES (Europe) LTD. DATA PRIVACY NOTICE FOR CANDIDATES
Last amendment: 21 September, 2021
Last amendment: 21 September, 2021
1. General Provisions and Contacts
Roche Services (Europe) Ltd. („Company”) processes information related to persons (“Candidate(s)”) applying for positions published on the website “www.roche.com” (‘Website”) or otherwise, or applying in any other form – in particular via email, letter, phone or personally – qualified as “personal data” under Article 4 (1) of Regulation (EU) 2016/679 called General Data Protection Regulation (“GDPR”). The present data privacy notice (“Notice”) shall provide information about the processing of such personal data and the rights and remedies available to Candidates related to data processing. If the application is not submitted to the Company, the processing of personal data shall be governed by the data protection notice of the company to which the application has been submitted, either in physical format or electronically (including other Roche companies, such as F. Hoffman-La Roche Ltd – Grenzacherstrasse 124, CH-4070 Basel, Switzerland).
Contacts of the Company:
Registered office of the Company: 1133 Budapest, Véső utca 7.
Company registration number: 01-09-872964,
The Company is registered by the Company Registration Court of the Metropolitan Court of Justice
Phone number of the Company: +36 1 461 8900
Email address of the company: budapest.admin.ba1@roche.com
Website of the Company: https://www.roche.com/careers/our-locations/europe/hungary/budapest/careers.htm
Name and contacts of the data privacy coordinator of the Company: Lívia Mágoriné Kovács, budapest.privacy@roche.com
The Notice may be available on the website electronically and in the offices of the Company in paper format. In addition, the Company is eager to provide information on the rights and remedies available to data subjects on the above contact details.
The Company reserves the right to unilaterally modify this Notice with subsequent effect, subject to the limitations provided for in the laws and with advance notification to the Candidates in due time, if necessary. The Company may modify this Notice especially when it is required upon changes in the laws or the practice of the data protection authority, due to business needs or employees’ needs, any new activity requiring the processing of personal data, or any newly revealed security exposures or feedback from Candidates. When communicating in relation to this Notice or privacy issues or otherwise keeping in contact with the Candidate, the Company may use the contact details of the Candidate available to the Company in order to get or keep in contact. Upon request, the Company will for example send the Candidate a copy of the Notice in effect from time to time or certify that Candidates have reviewed the Notice.
2. Job applications and processing of personal data concerning the applications
By submitting his/her job application and the data therein, the Candidate shall warrant that (i) such information concerns exclusively his/her personal data, or (ii) it has proper and informed consent or other legal basis for providing the personal data. Should the Company become aware that the data of the data subject have been disclosed without the consent of the data subject or an appropriate legal basis, the Company may immediately delete all data, and the data subject shall be entitled to enforce his/her rights and remedies under this Notice. The Company shall not be responsible for the violation of the above commitment by the Candidate or any damages, losses or injuries potentially arising therefrom.
The Company may receive the data related to the Candidate from external companies. Such external company may be: Hays Hungary Kft. (recruitment), Profession.hu, (recruitment), Focus Consulting Kft. (recruitment), Meló-Diák Universitas Iskolaszövetkezet (provision of school cooperative services). Randstad Hungary Kft. (recruitment), Jobsgarden Kft. (recruitment), Talentuno Technologies Zrt. (recruitment), CPL Jobs Kft. (recruitment), Talentify CO Kft. (recruitment), Jobs Személyzeti Tanácsadó Kft. (recruitment), Zyntern.com Kft. (recruitment). For data processing carried out by external companies, the data protection policy of the relevant company shall govern, over which the Company does not exercise control. Besides the above, the Company may further use the services of the external companies in accordance with the agreement concluded with them during the recruitment process (e.g. assistance during the selection of successful Candidates), regarding which the affected persons may primarily receive information from the given external company. The Company transfers such data to the external companies, which are necessary for the performance of their services and for their fee calculation (in the given case including e.g.: initial scope of work and base salary, starting date of the employment relationship).
The Company provides the following information on the processing of job applications and personal data contained therein.
Where this Notice indicates the relevant limitation period for the enforcement of claims as the duration of data processing, then any event which interrupts the limitation period shall extend the term of the data processing until the new date when the underlying claim may lapse (Section 6:25 (2) of Act V of 2013 on the Civil Code – the “Civil Code”). If the limitation period is interrupted, the claim can be enforced within one year from the time when the reason for interruption ceases to exist or, in respect of a limitation period of one year or less, within three months, even if the limitation period has already lapsed or there is less than one year or less than three months, respectively, remaining from it (Section 6:24 (2) of the Civil Code).
a. Processing of the personal data of Candidates in order to perform recruitment for the positions for which Candidates have applied, as well as documentation of the selection process.
Legal basis of data processing
Article 6 (1) b) of the GDPR ((data processing is necessary in order to take steps at the request of the Candidate, to assess the application prior to entering into a contract of employment)).
The information on data processing shall apply to the processing of personal data related to the clarification of the content of the submitted job application, the professional expectations and needs mentioned by the Candidate during the job interview, as well as eventual professional questions, tasks and competence.
The information on data processing shall also apply if the Candidate submits his/her job application outside the Website, in another manner (such as personally or in email or online but not on the platforms of the Company, e.g. LinkedIn, profession.hu).
Job applications may not be evaluated appropriately without the data.
In the event of application for a position which requires the establishment of an employment relationship, Article 10 (1) of Act I of 2012 on the Labour Code shall be governing. In accordance with the Act, data and data sheets necessary for the establishment of an employment relationship may be requested before the establishment of an employment relationship.
In the event of a successful application, if it is done through recruitment companies, the Company shall notify recruitment companies on the admission and the initial salary of the Candidate in accordance with the data protection policy of the recruitment company to allow the company to calculate the commission to be paid after a successful recruitment. In the above case, the legal basis for data transfer shall be Article 6 (1) f) of the GDPR (legitimate interests pursued by the Company and the recruiter).
If the Company employs the Candidate in a way that the Candidate will enter into the relevant contract not with the Company, then the Company will transfer the personal data to the employer entity. Such a case is, for example, if the Company is engaging an intern, and the employer entity is the Meló-Diák Universitas Iskolaszövetkezet. In this case, the legal basis of the data transfer is Article 6 (1) b) of the GDPR (data processing is necessary for the performance of a contract where the Candidate is a party, or in order to take steps at the request of the Candidate prior to entering into a contract of employment).
The legal basis of the processing of the personal data of reference people: Article 6 (1) f) of the GDPR (the legal basis of the Company and the Candidate).
Processed data
Name, contact details (address, phone number, email address, LinkedIn or other social media profile, if applicable, link to professional website) of Candidates, content of the CV and cover letter, attached profile picture (photo), foreign language skills, professional experience, work place(s), data concerning qualifications, skills and studies, preferred professional field, references, expected monthly salary (if applicable). CVs and applications may include the personal data of the Candidates provided by them voluntarily, such as: place and date of birth, mother’s maiden name, citizenship.
The data processing includes clarification of the content of the job application on the job interview (if any) and processing of personal data related to the professional expectations, wishes communicated by the Candidate on the job interview, professional questions, tasks and competencies.
Such data are received by the Company either directly from the Candidate, or from a third party transferring the data of the Candidate (such as recruiters). In the latter case, data processing shall also be governed by the data processing policy of the third party.
In addition to the above, the Company may keep internal records related to the job applications on the professional competence of the Candidate and related assessment criteria.
In addition, the Candidate may give the names, positions and contacts of the reference persons in relation to the Candidate’s former or present workplace, if the Candidate thinks that the relevant person (typically former professional supervisor, colleague) can give credible information on the professional experience and expertise of the Candidate. It is not obligatory to give such data or designate a reference person, failing which the Candidate will not suffer any discrimination on the part of the Company. If a reference person is designated, the Candidate represents that he/she has appropriate grounds for transferring the personal data of the reference person and does not breach the rights of the reference person by the transfer.
If the Company contacts the reference person given, then the Company may only request information about the professional experience and expertise of the Candidate that is relevant to the job applied for and may not record any other data.
Duration of data processing
The data retention time shall be 3 years (period of lapse of time) after the conclusion of the application (that is the selection of the successful Candidate), in order to ensure the possibility of defense in the event of litigation or official proceedings initiated by the Candidate (data may be processed until the final decision of the proceedings) or for the future assessment of job applications it may be justified for the Company to keep it on record internally for the afore-mentioned period in case somebody earlier applied for a job at the Company. In this case, the legal basis for data processing is Article 6 (1) f) of the GDPR (legitimate interest of the Company). The data processing is necessary for pursuing the legitimate interests of the Company that is the participation in proceeding(s) related to the enforcement of claims, and the presentation of the Company’s defense, or the registration of the former applications of the Candidate to the Company.
During the above period, the Company may check within the framework of an internal audit whether the most competent Candidate has been selected or not.
Considering the above criteria, after the completion of the application process, the Company shall store the job applications in its own closed system and locked office (and in the absence of the above mentioned litigation or official proceeding, shall not carry out data processing activities outside data storage), and shall irretrievably delete the data after the expiry of the 3-year period.
In certain cases, a shorter data retention is applicable to the Company, for example, there may be a case, when the Company receives the personal data of the Candidate from a third party’s CV database. In such case, the Company must delete the personal data within the deadline determined by the third party who is operating the database. For example, the general terms and conditions of profession.hu provides that in case of access to the CV database according to the above general terms and conditions, the Company may contact the relevant person within 90 days from downloading his/her CV or other document, and process his/her data.
Should the Candidate cancel his/her application before the end of the application process at one of the contacts of the Company, the Company shall immediately delete the data of the Candidate after the cancellation. The Company shall consider the cancellation of the application, as if the Candidate has expressed that he/she did not wish to enforce any claims with respect to the application and does not want to enter into a contract with the Company.
During the period of data processing, the Candidate’s job applications and personal data therein may be accessed by the person responsible for the job application within the Company and the competent employees of the Company’s People & Culture team, and in the event of the initiation of the above mentioned litigation or official proceedings, the competent employees of the Company’s Legal Department.
b. Assessment of the Candidate’s professional competence for the job (data processing related to the competence test, test sheets and videos recorded by the Candidates) after the revision of the job applications – depending on the nature of the job the Candidate has applied for.
The professional competence test and the assessment carried out with the involvement of an expert may take place exclusively in the cases previously specified by the Company, if it is necessary for filling the post, in which cases the Company shall notify the Candidates before carrying out the test. Competence tests are usually carried out with tests assessing foreign language skills and financial knowledge. Competence tests may also include the so-called ‘Assessment Center”. Assessment Center or AC is a method applied during the selection of Candidates, which aims to assess the expected professional competence of the Candidate. During the AC, Candidates are faced with tasks related to the respective position, and evaluators try to conclude from their reaction how they would succeed in the position. Tasks may include among others: simulation exercises, presentation exercises, tests, interviews.
In the selection procedure following the pre-screening of the Candidates the Company may request them for recording a video. The Company may request the recording of a video only in case of such positions, where the employee often acts and the employee’s style of expression, appearance (presence) and/or speaking style and/or language knowledge is important and where recording high quality videos is the task of the employee. Such positions are for example the positions to be filled on communication, project management and employer branding areas. The Company always informs the pre-selected Candidates in advance and in writing of the topic of the video (e.g. introduction video, in which the applicant answers to previously given questions), its duration, which conditions it should meet and the deadline for sending it to the Company. The topic of the video may only be in connection with the filling of the position, for example an introductory video from which the Company can determine, whether the Candidate’s style of speaking is in accordance with its expectations.
Legal basis of data processing
Article 6 (1) f) of the GDPR (the legitimate interest of the Company).
Candidates may ask questions related to the competence test at the place of the competence test, before and during the test.
The balancing test related to the data processing based on the Company’s legitimate interest is included in the table attached to this Notice.
Processed data
Answers provided during the competence test, professional skills and the video recording sent by the Candidate (picture and voice) and the conclusions drawn therefrom.
Questions related to the assessment of competence may exclusively aim to assess the competences absolutely necessary for filling the published position. The test shall be carried out by an expert subject to the obligation of secrecy who is employed or appointed by the Company. During the test, the expert shall evaluate the answers and information provided by the Candidate in the test sheets / on the online surface / during the personal interview. The assessment of the video recorded by the Candidate will be assessed by the employees of the People & Culture group of the Company, the competent leader and the employees involved in the selection procedure and they assess, whether the Candidate’s style of expression, appearance (presence) and/or speaking style and/or language knowledge is in accordance with the Company’s expectations and/or where recording high quality videos is the task of the employee, they assess the video from a technical point of view.
The criteria of the assessment shall be made available on the test sheets / online surface before the completion of the test, or recording the video or shall be communicated to the Candidate before the start of the personal interview.
None of the above methods for assessing professional competence are channelled towards the private life of the Candidate or the personal characteristics irrelevant to the assessment of competence.
The above expert may disclose to the Company exclusively the results of the assessment: (i) whether the Candidate complies with the criteria for the job or not, or (ii) whether further conditions for filling the job shall be ensured by the Company, such as: further professional training, in the case of managing positions provision of management training.
Duration of data processing
The Company shall store the personal data in accordance with the criteria specified at the section entitled: ‘Processing of the personal data of Candidates in order to perform recruitment for the positions for which Candidates have applied, as well as documentation of the selection process.
Answers provided by Candidates during the competence test and their assessment (professional competence) may only be accessed by the person competent within the Company for the area related to the post in question, as well as competent employees of the Company’s People & Culture team and the expert employed or appointed by the Company (the latter one also has access to the test itself, while the other persons only have access to the results of the assessment).
c. Retention of the Candidate’s CV and other job application documents (such as cover letter) in order to allow the Company to contact the Candidate directly with job offers in the future (for example in the event of a job vacancy).
Legal basis of data processing
Article 6 (1) a) of the GDPR (voluntary consent).
The Company may request the Candidate to grant his/her consent to the retention of his/her job application the result of the assessment test conducted by the Company and the notes taken of the Applicant by the Company on the interview after the completion of the selection procedure, even in the absence of a vacancy or a published job offer, in order to directly contact the Candidate with eventual future job offers (such as: currently, there is no vacancy in the field for which the Candidate has applied, but in the future, it may occur).
Processed data
Personal data originally provided by the Candidate, the result of the assessment test conducted by the Company, the video recorded by the Candidate and the notes taken of the Candidate by the Company on the interview.
Duration of data processing
3 years after the conclusion of the selection criteria. This is the period during which the data necessary for the purposes of the data processing may be up-to-date and accurate in the opinion of the Company. For example, if the Candidate’s experience is not sufficient at the time of application, but he/she may become eligible at a later date for a future position. Candidates may request the Company to delete their data at any time during the above period. Candidates’ right to the above shall also cover data recorded during eventual competence tests. In the above case, Candidates shall acknowledge that in the event of the submission of a new job application, another competence test may become necessary.
The person competent in the field related to the relevant job application within the Company, as well as the competent employees of the Company’s People & Culture team may access the job application materials of the Candidates and the personal data therein during the period of data processing.
d. Registration of those potential candidates, whom the company cannot offer an open position at a particular data; however, they can be suitable candidates at a later stage in connection with an open position.
The legal basis of the data processing:
Article 6 (1) f) of the GDPR (the legitimate interest of the Company). The legitimate interest: monitoring the developments in the field of recruitment, the scope of the potential candidates, in order to enable the Company to have a proper overview on the development of the relevant circumstances, and identify its possibilities in connection with the employment of future employees (e.g. the scope of potential candidates, and how their career path evolves). The Company is approaching the given candidates only if they want to interview them for a particular position.
Processed data:
The Company is collecting only publicly available professional information on the potential candidates, and/or professional information published by the relevant individuals themselves, i.e. name, email address, the source of the information (e.g. LinkedIn, profession.hu or other career portal, job fairs - HVG, Corvinus, EFOTT or any other event organised for a similar purpose) and the publicly available information accessible in the given sources (e.g. contents of the LinkedIn profile, CV). The Company is processing the personal data always with a view to the applicable terms and conditions of the given source, and the relevant restrictions (e.g. permitted purpose, deletion period)).
Duration of data processing:
3 years from the collection of the data. This is the period of time, until – according to the opinion of the Company – the personal data which are necessary for the purpose of the data processing are accurate and up-to-date. The Candidate can request the deletion of his/her personal data from the Company anytime during the above retention period.
The person competent in the field related to the relevant job application within the Company, as well as the competent employees of the Company’s People & Culture team may access the personal data.
3. Data security measures taken by the Company
The Company shall organize compulsory data protection training for its employees and partners.
Such training shall be:
- privacy awareness training – knowledge of regulations related to the protection of personal data (such as GDPR, rights related to data processing) and management of data breaches,
- information security end user awareness training – work outside the office, remote access, password management, communication (email, sending messages), social engineering, prevention of data breaches
The Company shall provide technical data security by monitoring access to the system, encryption, firewalls, using anti-virus and anti-malware software and data-loss prevention software (e.g. blocking data subtraction from the systems, emails containing certain data types, USB-s) and a strong password policy.
The Company shall ensure organizational data security with the following measures: locked rooms, restriction of access to the rooms of the Company’s People & Culture team and to server rooms, internal rules and policies regarding information security, clean desk policy, data classification, management of data breaches.
4. Data protection rights and remedies available to Candidates and other data subjects
4.1 Data protection rights and remedies
Data protection rights and remedies available to data subjects, including Candidates and other persons listed in Section 2 (such as in the event of submitting an application in someone else’s name) are set forth in the relevant provisions of the GDPR (in particular Articles 15-21, 77-79 and 82). The following summary contains the most important provisions, and the Company provides information to the Candidate and other data subjects on their rights and remedies related to data protection in accordance with this Notice.
The Company hereby informs the Candidates that the online or paper-based test sheets completed during competence tests, as well as answers given to the oral questions and data contained therein may only be processed by the expert subject to the obligation of secrecy employed or appointed by the Company. With respect to such personal data, data subjects may contact the above expert – at the above contact details – or the Company, which shall transfer such requests to the expert. The Company undertakes to fulfill such requests exclusively if it does not result that the Company may become aware of the content of the relevant test sheets or answers to the oral questions and the personal data contained therein without the consent of the data subject, otherwise such requests shall be fulfilled on behalf of the Company by the expert employed or appointed by the Company.
The Company shall provide information on action taken on a request related to the data subject’s exercise of rights to the data subject without undue delay and in any event within one month of receipt of the request. Taking the complexity of the request and the number of requests into consideration, such term may be extended by two months if necessary. The Company shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.
The Company shall provide information requested by the data subject in writing or – in the case of requests submitted electronically – electronically. The information may be provided orally, provided that the identity of the data subject is proven to the Company.
4.2 Right of access of data subjects
- The data subject shall have the right to obtain from the Company confirmation as to whether or not personal data concerning him or her are being processed. If such data processing is in progress, the data subject shall have the right to obtain access to the personal data and the following information:
- purpose of data processing;
- categories of personal data involved;
- the recipients or categories of recipient to whom the personal data have been or will be disclosed by the Company, in particular recipients in third countries or international organisations;
- if applicable, the planned duration of storing the personal data or if this is not possible, the aspects of determining this period of time;
- the existence of the right to request from the Company rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- right to file complaint to a supervisory authority; and
- if the data was not collected from the data subject, all available information about the source thereof;.
- If the personal data is transferred to a third country, the data subject shall have the right to obtain information about the sufficient guarantees related to the transfer.
- The Company shall provide a copy of the personal data undergoing processing. For any further copies requested by the data subject, the Company may charge a reasonable fee based on administrative costs. If the data subject submitted the request electronically, the information shall be provided in a widely used electronic format except if the data subject requests otherwise.
- If a data processing purpose is required for the enforcement of the legitimate interest of the Company or any third party, the balancing test used to determine the legitimate interest shall be made available by the Company in case of request submitted to any of the contacts above.
4.3 Right of rectification
The data subject shall have the right to obtain from the Company without undue delay the rectification of inaccurate personal data concerning him or her. The data subject shall also have the right to request the completion of defective personal data amongst others via a supplementary declaration.
4.4 Right of erasure (“right to be forgotten”)
- The data subject shall have the right to obtain from the Company the erasure of personal data concerning him or her without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed by the Company;
- the data subject withdraws its consent constituting the basis of data processing and there is no other legal basis of data processing;
- the data subject objects to the processing of its data and there is no prevailing legal cause for data processing in the given case;
- personal data were unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject;
- personal data were collected in relation to offering services related to the information society.
- Paragraph 1 shall not apply to the extent that processing is necessary, among others:
- for the purpose of exercising right to expressing opinions and obtaining information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which the Company is subject;
- for the purpose of public interest archiving, scientific and historical research or statistical purpose if the right mentioned in paragraph (1) would probably make it impossible or seriously threaten such data processing; or
- for establishing, enforcing or defending legal claims.
4.5 Right of restriction of data processing
- The data subject shall have the right to obtain from the Company restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a period enabling the Company to verify the accuracy of the personal data;
- the data processing is unlawful and the data subject objects to the deletion of data and requests the restriction of the use thereof instead;
- the Company no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing pending the verification whether the legitimate grounds of the Company override those of the data subject.
- If the data processing is restricted on the basis of paragraph (1), such personal data shall only be processed - apart from storage - with the consent of the data subject, for the establishment, enforcement or defense of legal claims or in order to protect the rights of other natural persons or legal entities or for important public interests of the European Union or a Member State.
- A data subject who has obtained restriction of processing shall be informed by the Company on the lifting of such restriction before the restriction of processing is lifted.
4.6 Liability of notification related to the rectification of personal data or erasure or the restriction of data processing
The Company shall communicate any rectification or erasure of personal data or restriction of processing carried out to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The Company shall inform the data subject about those recipients if the data subject requests it.
4.7 Right to data portability
- The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to the Company, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Company, where:
- data processing is based on consent or contract; and
- data processing is automated.
- In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another (that is the Company and another data controller), where technically feasible.
- The exercise of the above right may not infringe the provisions concerning the right to erasure (‘right to be forgotten’), and this right shall not adversely affect the rights and freedoms of others.
4.8 Right to object
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her. The Company shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or such data are related to the establishment, exercise or defence of legal claims.
4.9 Right to lodge a complaint with a supervisory authority
The data subject shall have the right to file a complaint at the supervisory authority in the member state of its usual residence, workplace or the place of the assumed injury in particular if according to the assumption of the data subject the processing of personal data of the data subject violates the provisions of GDPR. Competent supervisory authority in Hungary: Hungarian National Authority for Data Protection and Freedom of Information (website: http://naih.hu, address: H-1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf.: 9.; phone number: +36-1-391-1400; fax: +36-1-391-1410; e-mail: ugyfelszolgalat@naih.hu).
4.10 Right for effective remedy at the court of justice against the supervisory authority
- The data subject shall have the right for effective remedy at the court of justice against the legally binding decisions of the supervisory authority applicable for the data subject.
- The data subject shall have the right for effective remedy at the court of justice if the competent supervisory authority fails to deal with the complaint or fails to inform the data subject about the progress of the proceedings in relation with the complaint or the outcome thereof within three months.
- Proceedings against the supervisory authority shall be filed at the court of justice competent in the member state of the registered seat of the supervisory authority.
4.11 Right for effective remedy at the court of justice against the Company or the data processor
- The data subject shall have the right for effective remedy at the court of justice without prejudice to its administrative and out of court remedies available, including complaint at the supervisory authority if the data subject assumes that its rights under the GDPR were violated due to the improper processing of its personal data.
- Proceedings against the Company or the data processor shall be brought before the courts of the Member State where the Company or the data processor has an establishment. Such proceedings may be brought before the court of the Member State where the data subject resides. Such procedure falls within the competence of the tribunal in Hungary. The data subject may initiate the procedure – at his/her choice – at the tribunal of his/her domicile or residence. For further information on the competence and contact details of the court (tribunal) please visit the following website: www.birosag.hu.
Attachment: Balancing test concerning the competence test carried out by the Company
The following table contains the test for the balance of interests related to data processing based on the legitimate interest of the Company with respect to the processing of the Candidate’s data, which presents why the legitimate interests of the Company related to the completion of the competence test override the interests or fundamental rights or freedoms of the data subjects which require the protection of the personal data.
1. Is it absolutely necessary to perform a competence test in the case of Candidates submitting job application to certain posts? Are there any alternative solutions with the application of which the planned purpose may be reached without the processing of personal data? | There is no alternative data processing solution which affect the personal data of data subjects less and are efficient enough to ensure that data processing objectives are met. Considering the nature of the activities performed by the Company (shared service center – provision of financial, HR and IT services in a foreign language), compliance with the required quality of services, as well as rules on safety of persons and property, health and safety provisions, with respect to certain posts, it is absolutely necessary to carry out a competence test during the job interviews, which assesses the professional competence required by the post. Should a video recording be requested by the Company from the Candidate, then the data processing has the following additional reasons:
There is no alternative data processing solution which affect the personal data of data subjects less and are efficient enough to ensure that data processing objectives are met. |
|---|---|
2. Legitimate interest of the Company | Legitimate interests of the Company are as follows:
|
3. What is the purpose of data processing? In addition to what data processing purposes, and what kind of personal data shall be processed in accordance with the legitimate interest of the Company? | The purpose of data processing is the assessment of the professional competence of the Candidate to the post for which he/she applied. The Company shall process the results of the competence tests exclusively within the scope of competence necessary for the position (post) in question, and it has already been aware of this circumstance before drafting the questions asked during the competence test. Answers provided by the Candidate on the online surface / in test sheets / during personal observation are assessed by an expert employed or appointed by the Company. The expert employed or appointed by the Company shall process the results of the competence test and related documentation until the performance of the assessment, and after that, shall immediately transfer them to the Company (which may only have access to the results of the competence tests). The Company processes the results of the competence tests and related documentation (including primarily the completed test sheets) during the period specified in Sections 2 and 3 (this is limited to safe storage in case of test sheets and other similar related documentation). The Company informs Candidates of the necessity to carry out a test, the assessment of professional competence and the process of the test, as well as rights and remedies available to them in all cases before the start of the competence test. |
4. What are the interests of data subjects with respect to data processing? | Protection of the Candidates’ individual rights, the right to facial likeness and recorded voice, rights and freedoms related to personal data, which has been taken into consideration already at the elaboration of the competence test, as well as at the selection of the expert employed or appointed by the Company and at the conclusion of contract with him/her, before the actual performance of the competence test to the extent possible. |
5. Why does the Company’s legitimate interest restrict the rights and freedoms of data subjects proportionately? |
|