Privacy Notice
Opus Group
Contents
Preamble
Definitions
Data processing principles of the controllers and legal bases of processing
Data subjects and categories of data processed
Purpose and duration of processing personal data
Temporary staffing and recruitment
Duration of processing
Storage of tests and aptitude assessments
Establishing employment and processing during employment
Rights of data subjects
Final and interpretative provisionsk
Preamble
In this joint and uniform privacy notice, the term controller refers to the members of the “Opus Group”, which consists of the following companies:
Details of the controllers:
Opus LKG Iskolaszövetkezet (school cooperative)
Registered office: Szinyei Merse u. 10, 1063 Budapest, Hungary
Tax number: 12509269-2-42
Represented by: Dávid Merkel, board member
HSC Munkahelyteremtő Szociális Szövetkezet (social cooperative)
registered office: Szinyei Merse u. 10, 1063 Budapest, Hungary
Tax number: 24732064-2-42
represented by: Dávid Merkel, board member
Opus Európa Kft.
registered office: Bátky Zsigmond u. 3., 8000 Székesfehérvár, Hungary
Tax number: 25550021-2-07
represented by: Gábor Gurisatti, managing director
NowaPRO Quality Kft.
registered office: Bátky Zsigmond u. 3., 8000 Székesfehérvár, Hungary
Tax number: 27466094-2-07
represented by: Krisztián Tibor Izsay, managing director
hereinafter: the controllers.
The controllers acknowledge the content of this privacy notice as binding on themselves and undertake to comply, in connection with their activities, with all data protection legislation and with this privacy notice, to treat personal data confidentially, and to take every measure that protects the security of the data.
Definitions
1. “data subject”: any specific person identified or identifiable on the basis of personal data.
2. “personal data”: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
3. “processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
4. “controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
5. “data transfer”: making data available to a specified third party.
6. “processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller; “restriction of processing”: the marking of stored personal data with the aim of limiting their processing in the future;
7. “profiling”: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, competences, behaviour, location or movements.
8. “pseudonymisation”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person;
9. “filing system”: any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
10. “recipient”: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
11. “third party”: a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
12. “consent of the data subject”: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
13. “personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
14. “data concerning health”: personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status;
15. “representative”: the person who represents the controller or processor with regard to their respective obligations under Regulation (EU) 2016/679 of the European Parliament;
16. “enterprise”: a natural or legal person engaged in an economic activity, irrespective of its legal form, including partnerships or associations regularly engaged in an economic activity;
17. “right to object”: the data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of his or her personal data (…) where the processing is based on the legitimate interest of the controller or is carried out in the exercise of official authority.
18. “right of access”: the data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information listed in the Regulation.
19. “right to rectification”: the data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
20. “right to erasure”: the data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller has the obligation to erase personal data without undue delay where certain conditions apply.
21. “right to be forgotten”: where the controller has made the personal data public and is obliged to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
22. “right to restriction of processing”: the data subject has the right to obtain from the controller restriction of processing where one of the following applies:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.
23. “right to data portability”: the data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided.
24. “objection to direct marketing”: where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, including profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
To enforce their rights, data subjects may turn to the courts or to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Data processing principles of the controllers and legal bases of processing
The controllers process personal data only in cases where:
- the data subject has given explicit and unambiguous consent to the processing of personal data
- it is required by law or other legislation
- it is based on the legitimate interests of the data subjects.
Personal data may only be processed for a specified purpose. The personal data processed are limited to data that correspond to the purpose of the processing and are essential to achieve that purpose.
Processing of personal data may only begin once the data subject has given unambiguous consent, having been properly informed.
The consent of a legal representative is required for the declaration of a minor who lacks or has limited legal capacity, except for those parts of the service where the declaration concerns a registration that occurs commonly in everyday life and requires no particular consideration.
Our companies inform data subjects of all relevant facts, in particular the purpose and legal basis of the processing.
The data subject must be informed clearly and in detail of all facts relating to the processing of his or her data, in particular the purpose and legal basis of the processing, the person entitled to process the data, the duration of the processing and who may have access to the data. The information must also cover the data subject's rights and legal remedies in relation to the processing.
The personal data processed must meet the following requirements:
a) they are collected and processed fairly and lawfully;
b) they are accurate, complete and, where necessary, kept up to date;
c) they are stored in a way that permits identification of the data subject for no longer than is necessary for the purpose of storage. The use of a general and uniform personal identification number usable without restriction is prohibited.
The controller may also process special categories of personal data, on the basis of legislation or the lawful consent of the data subject. Personal data may be transferred, and different data processing operations may be combined, if the data subject has consented or the law permits it, and if the conditions of processing are met for each item of personal data. Personal data (including special categories of data) may be transferred from the country, regardless of the data carrier or the method of transmission, to a controller or processor in a third country if the data subject has expressly consented or the law permits it, and an adequate level of protection of personal data is ensured in the third country during the handling or processing of the transferred data. Transfers to EEA states shall be regarded as transfers within the territory of Hungary. Courts, prosecutors and investigating authorities, as well as other bodies authorised by law, may request the controllers to provide information, disclose or transfer data, or make documents available. The request must specify the exact purpose of the processing and the scope of the data requested. The request may only cover personal data to the extent and of the type strictly necessary to achieve its purpose.
Data subjects and categories of data processed
1. Data subjects: Employees in an employment relationship or other work-related legal relationship with the Employer, and persons applying to the Employer for work.
2. Categories of data processed
1. name (surname, first name, birth name, title)
2. place and date of birth,
3. mother's name,
4. citizenship
5. sex
6. marital status
7. tax identification number
8. social security (TAJ) number
9. identity card number and validity
10. contact details (phone number, permanent address, place of residence, email address, fax)
11. marital status
12. nationality
13. details of children
14. education, name of educational institution, certificate number
15. information on qualifications and experience, previous and most recent workplaces,
16. employment-related data (start, type, end, status, position, FEOR occupation code, organisational unit, weekly working hours)
17. result and validity of the medical fitness examination
18. health status; in the case of reduced working capacity, the rehabilitation card number and the degree of reduced working capacity
19. any benefits related to health impairment
20. in the case of a pension, its start date, type and pension card number
21. details of spouse or partner required for claiming the family tax allowance
22. other data provided by the employee in connection with the employment
23. organisational unit
24. competences
25. bonus targets and results
26. completion and results of studies
Purpose and duration of processing personal data
Temporary staffing and recruitment
Purpose of processing: in the course of temporary staffing and recruitment activities, for data subjects
searching for and offering employment opportunities, and sending newsletters.
Legal basis of processing: the consent of the data subjects, the legitimate interests of the data subjects, Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information, Government Decree 118/2001 (VI. 30.) on the registration and conditions of temporary staffing and private employment agency activities, and Act CVIII of 2001 on certain issues of electronic commerce services and information society
services.
Data transfer: when registering in the database (online or on paper),
the data subject accepts that the controllers may transfer his or her personal data to partners using the service
for recruitment purposes.
Data security: personal data are stored and processed at the controllers' premises (Bátky Zsigmond u. 3., 8000 Székesfehérvár; Egyetem u. 10., 8200 Veszprém) and on a web server protected by 24-hour security. Our companies take all administrative, IT and physical security measures to protect personal data against unauthorised access and loss.
Duration of processing
“The personal data should be adequate, relevant and limited to what is necessary for the purposes for which they are processed. This requires, in particular, ensuring that the period for which the personal data are stored is limited to a strict minimum. Personal data should be processed only if the purpose of the processing could not reasonably be fulfilled by other means. In order to ensure that the personal data are not kept longer than necessary, time limits should be established by the controller for erasure or for a periodic review. Every reasonable step should be taken to ensure that personal data which are inaccurate are rectified or deleted. Personal data should be processed in a manner that ensures appropriate security and confidentiality of the personal data, including for preventing unauthorised access to or use of personal data and the equipment used for the processing.”
(REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL, Recital 39)
In view of the above, we set the duration of processing at 4 years and 12 months, and we pay close attention to keeping the data up to date in order to achieve the purposes.
Storage of tests and aptitude assessments
Purpose of processing: use of tests during the selection process, as part of searching for and offering employment opportunities to data subjects in the course of temporary staffing and recruitment activities.
Legal basis of processing: the consent and legitimate interests of the data subjects, and Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information.
Categories of data processed: personal identification data (surname, first name, date of birth, address) and other data necessary for recruitment activities (address, education, current studies, student status, competences, skills, foreign language skills, willingness to travel or relocate, salary expectations, preferred position, previous workplaces). The results of tests (job aptitude tests, personality tests, logic tests, skills and ability tests, knowledge assessment tests) after completion of the tests and the consent declaration.
Data transfer: when completing the tests, the data subject accepts in a declaration that the controllers may transfer his or her personal data and test results to partners using the service for recruitment purposes.
Establishing employment and processing during employment
The controllers process the personal data during the employment relationship for the period essential to achieve the purposes set out in this notice and, in the case of mandatory processing, after the end of the employment relationship until the deadline required by law. The controller does not process data that is not necessary to achieve the purposes.
The purpose of processing is to record and manage information and data arising in connection with employment, primarily but not exclusively:
- establishing, amending and terminating employment
- recording the duration of employment and reporting it to the competent authorities
- determining and paying wages
- determining eligibility for, and the amount of, monthly bonuses and fringe benefits based on feedback from partners
- determining and paying allowances
- payroll and related activities
- determining rest periods, paid leave and additional leave
- determining entitlements to tax allowances
Rights of data subjects
Every data subject may request the correction, updating and erasure of his or her personal data. Data subjects may request the modification, updating or erasure of personal data by post addressed to the registered office of one of the controllers (Bátky Zsigmond u. 3., 8000 Székesfehérvár; Szinyei Merse u. 10., 1063 Budapest), electronically by email to info@opuswork.eu, or in person at the controllers' registered offices or premises.
1. Right of access
The data subject has the right to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the information listed in the Regulation.
2. Right to rectification
The data subject has the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement.
3. Right to erasure
The data subject has the right to obtain from the controller the erasure of personal data concerning him or her without undue delay, and the controller has the obligation to erase personal data without undue delay where certain conditions apply.
4. Right to be forgotten
Where the controller has made the personal data public and is obliged to erase them, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
5. Right to restriction of processing
The data subject has the right to obtain from the controller restriction of processing where one of the following applies:
• the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
• the data subject has objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.
6. Right to data portability
The data subject has the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided (…).
7. Right to object
The data subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of his or her personal data where the processing is based on the legitimate interest of the controller or is carried out in the exercise of official authority.
8. Objection to direct marketing
Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning him or her for such marketing, including profiling to the extent that it is related to such direct marketing. Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
To enforce their rights, data subjects may turn to the courts or to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).
Opus Európa Kft.:
Company registration number: 07-09-027709
Registering court: Court of Registration of the Székesfehérvár Regional Court
Private employment agency licence number: FE/12/2033-2/2017
Temporary staffing licence number: FE/12/587-2/2017
Opus LKG Iskolaszövetkezet:
Company registration number: 01-02-054288
Registering court: Court of Registration of the Budapest-Capital Regional Court
HSC Munkahelyteremtő Szociális Szövetkezet (social cooperative)
Company registration number: 01-02-054287
Registering court: Court of Registration of the Budapest-Capital Regional Court
NowaPRO Quality Kft.
Company registration number: 07-09-032771
Registering court: Court of Registration of the Székesfehérvár Regional Court
Duration of processing: 4 years and 12 months from the start of processing.
Final and interpretative provisions
- If you believe your rights concerning your personal data have been infringed, you may turn to the courts under the Hungarian Privacy Act (Infotv.) and the Civil Code (Act V of 2013), or initiate an investigation with the Hungarian National Authority for Data Protection and Freedom of Information (president: dr. Attila Péterfalvi, Szilágyi Erzsébet fasor 22/C., 1024 Budapest, ugyfelszolgalat@naih.hu, +36 1 391 1400, www.naih.hu).
Legal background of the processing:
- Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information is available here (in Hungarian): National Legislation Database (http://njt.hu/cgi_bin/njt_doc.cgi?docid=139257.381624)
- REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL
on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance). Available here: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679