Data protection notice for job applicants – Onespire Ltd.

Introduction

1.1. Onespire Ltd. as a data controller (hereinafter referred to as the “Company” or the “Data Controller“) informs job applicants in this notice (hereinafter referred to as the “Notice“) about the processing of personal data concerning them as data subjects (hereinafter referred to as the “Applicant(s)“) when applying for the job vacancies advertised by the Company.

1.2. The Data Controller shall handle, record, process and transmit the personal data of the Data Subject in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016) on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive No 95/46/EC (hereinafter “GDPR”), Act CXII of 2011 on the right to information self-determination and freedom of information, and other legal provisions and recommendations of public authorities on data protection.

1.3. To comply with data security requirements, the Data Controller shall ensure the protection and security of the Data Subject’s personal data, in particular in the event of accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access to personal data transmitted, stored or otherwise processed.

1.4. The Data Controller processes personal data with the consent of the Applicants and to the extent necessary for the fulfilment of a contract, based on a law or in connection with the enforcement of the legitimate interests of the Data Controller. Through its internal organizational units, Data Controller shall take all data security, technical and organizational and administrative measures to ensure an adequate level of security of personal data. To this end, the functions of operating and developing security, data protection and information technology systems within the Company are separate and independent of each other.

Please read this Notice carefully before submitting your application to us, to ensure that you understand how we process your personal data, and your rights regarding data processing. If you require any further information beyond what is included in this Notice, or if you have any comments or objections about the processing of your data, please get in touch with the Company using the contact details below:

Company name: Onespire Private limited company limited by shares
Registered office: 1123 Budapest, Alkotás utca 53.
Company registration number: 01-10-049612
Website: onespire.hu
Phone: +36 1 791 8331
Email: info@onespire.hu

Concepts related to data processing:

For the purposes of this Notice, each of the definitions set out below shall have the following meanings:

“personal data“: means any information related to an identified or identifiable Data Subject; an identifiable Data Subject (natural person) means a Data Subject who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, intellectual, economic, cultural or social identity of that natural person;

“data processing“: means any operation or set of operations which is performed on personal data or on sets of personal data, carried out by automated or non-automated means, such as collection, recording, organizing, splitting, storing, transforming or altering, retrieving, viewing, using, disclosing, forwarding, disseminating or otherwise making available, synchronizing or combining, restricting, erasing or destructing;

“data controller“: means the Data Controller, and the natural or legal person, or any other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

“data processor“: means a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the Data Controller;

“recipient“: means a natural or legal person, public authority, agency or any other body to whom or with which personal data is disclosed, whether or not a third party. Public authorities which may have access to personal data in the context of an individual investigation in accordance with European Union or Member State law are not recipients; the processing of those data by those public authorities must comply with the applicable data protection rules in accordance with the purposes of the processing;

“third party“: means a natural or legal person, public authority, agency or any other body other than the Data Subject, the Data Controller, the data processor or the persons who, under the direct authority of the Data Controller or data processor, are authorized to process personal data;

“the data subject’s consent“: means a freely given, specific, informed and explicit expression of his or her wishes by which the Data Subject signifies, by a statement or by an act unambiguously expressing his or her consent, that he or she gives his or her agreement to the processing of personal data concerning him or her;

“sensitive data“: means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, genetic data and biometric data revealing the identity of natural persons, health data and personal data concerning the sexual life or sexual orientation of natural persons;

“health data“: means personal data related to the physical or mental health of a natural person, including data relating to the provision of health services to a natural person which contains information about the health of the natural person;

“data transfer“: means the disclosure of personal data to a specific recipient;

“data breach“: is a violation of security relating to the processing of personal data that results in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted or stored or otherwise processed.

Other terms defined in the Regulation are set out in Article 4 of the Regulation

The group of Applicants affected:

The scope of this Notice applies to anyone who applies for a job advertised by the Data Controller or for a position not advertised by the Data Controller (hereinafter referred to as the “Applicant” or “Data Subject”). By submitting an application to the Company, the Applicant accepts the provisions of this Notice and consents to the processing of his/her data in accordance with this Notice.

Following the application without an advertised position (“fly-in resume”), the Data Controller will promptly notify the Applicant of this Notice, and request confirmation from the Applicant that he/she has become aware of the content of this Notice.

The Data Controller shall be entitled to unilaterally amend this Notice at any time.

This Notice is made available by the Data Controller to the Applicants:

a) whenever it has the possibility to do so, prior to the provision of the data; or
b) with regard to the specific circumstances in which the personal data are processed, simultaneously with the acquisition of the personal data;
(c) if the personal data is used for the purpose of contacting the Applicant, at the time of the first contact with the Applicant; or
(d) if the data are likely to be disclosed to other recipients, no later than at the time of the first disclosure of the personal data.

1. Purposes, legal basis, scope and duration of data processing, data security

1.1. The purposes of the different data processing activities:

(I) recruitment;
(II) maintaining contact with;
(III) enforcement of rights.

For data processing purposes I and II:

Legal basis of data processing: voluntary consent of the Data Subject, pursuant to Article 6(1)(a) of the GDPR. If the Data Subject also provides sensitive personal data in connection with his/her application, the legal basis for processing is the voluntary, explicit and informed consent of the Applicant, pursuant to Article 9(2)(a) GDPR. If the Applicant also provides personal data in connection with his/her application material relating to his/her reduced capacity for work, deterioration of health or impairment of health, the Data Controller shall also process such data on the basis of the express consent, pursuant to Article 9(2)(a) of the GDPR.

Purpose of data processing: the data are processed by the Data Controller for the purposes of keeping a record of applicants who have registered to its database on its website and other job posting sites, evaluating the applications submitted, notifying Applicants for advertised positions following the closure of the selection process, and for continued storage in the Data Controller’s own database.

For data processing purpose III:

Legal basis for data processing: the processing of the Applicant’s personal data for the Company’s legitimate interest pursuant to Article 6(1)(f) of the GDPR.

The purpose of the data processing: to enable the Company to meet its obligation to provide evidence in the event of possible enforcement of rights by the Applicant. In case of a rejected job application, the Company will store the online- and paper-based Applicant Data for 2 years from the date of application for a possible appeal to the Office of the Commissioner for Fundamental Rights regarding the provisions of the Equal Treatment Authority. For this data processing purpose, there is no active data processing activity carried out by the Company, only data storage.

1.2. Scope of data processed and duration of data processing

Scope of the data processed for the purposes of recruitment/maintaining contact regard to point I and II

The Applicants’ data processed by the Company are the following: all the data provided by the Applicant in the Data Submission Form or in his/her application/resume, in particular:

Scope, limits and duration of data processing

The Data Controller will process the personal data of Applicants only to the extent and for the duration necessary for the purposes set out above. Only personal data that is essential for the purpose of data processing and suitable for achieving the purpose may be processed.

The Data Controller shall process the data of the Applicants for recruitment/contact maintaining purposes for a period of 2 years from the date of the Applicants’ application or consent to data processing, or until the Applicant’s request for deletion is fulfilled, in order to enable the Company to evaluate the suitability of the Applicant’s competences and if necessary to contact the Applicant in case of a vacancy in the same or a similar position at a later date. A request for deletion made by the Applicant in the meantime interrupts the data processing, in which case the end of data processing is the date of the execution of the deletion. In the absence of a request for deletion by the Applicant, the Company will automatically erase the Applicant’s personal data at the end of the contact maintaining period (purpose of processing fulfilled) (except for the purpose of data processing based on legitimate interest). The data of the employed Applicant will be further processed in accordance with the Company’s Privacy Policy for Employees.

ad. III., Scope of data processed for enforcement of rights

The scope of the data processed for this purpose is consistent with the scope of the data processed in the course of the recruitment process.

Scope, limits and duration of data processing

In case of a rejected job application, the Company will store the data of the Applicant’s processed for the purpose of enforcement of rights for 2 years from the date of the Applicant’s application, for a possible appeal to the Directorate General for Equal Treatment of the Office of the Fundamental Rights Commissioner. For this data processing purpose, there is no active data processing activity by the Company, only data storage.

2. Recipients of the processing

The Data Controller’s employees and collaborators are entitled to become acquainted with the personal data of the Applicants only to the extent necessary for the fulfilment of their professional tasks. Individuals having access to personal data at the Data Controller are bound by the obligation of confidentiality with regard to the personal data of Applicants, i.e. they must keep personal data and other information obtained through their professional duties or otherwise confidential, and not disclose it to third parties. This obligation continues even after the termination of the employment relationship without any time limit.

Data controllers are required to maintain the confidentiality of the personal data they process, not to use it for their own purposes, and not to disclose, transfer or make it available to others, except in the cases listed in the Notice.

3. The source of the data

The Data Controller receives the data of the Applicants either directly from the Applicants or from a recruitment agency.
The Applicant may withdraw consent at any time, without prejudice to the lawfulness of the processing carried out on the basis of the consent prior to the withdrawal.

If the Applicant fails to provide personal data or provides incomplete data, depending on the type of incomplete data, the establishment of contact with the Applicant will fail, or the Data Controller will not have sufficient data to assess the Applicant’s suitability for the position, and the Applicant’s suitability for the position cannot be assessed, therefore no employment contract can be concluded.

4. The place of data processing, the type of data processing technology used, data security:

The Data Controller takes into account the requirement of data security in the establishment of its entire data protection process, in accordance with the principle of privacy-by-design, which means default and built-in data protection. The Data Controller aims to minimize the processing of personal data in order to reduce the risks of data processing.

Individuals having access to personal data at the Data Controller are bound by the obligation of confidentiality with regard to the personal data of Applicants, i.e. they must keep personal data and other information obtained through their professional duties or otherwise confidential, and not disclose it to third parties. This obligation continues even after the termination of the employment relationship without any time limit. Data controllers are required to maintain the confidentiality of the personal data they process, not to use it for their own purposes, and not to disclose, transfer or make it available to others, except in the cases listed in the Notice.

The Data Controller shall also take technical and organizational measures and comply with the procedural rules necessary to ensure data protection and data security.

The Applicant acknowledges that the Data Controller shall not be liable for any damage or loss resulting from any failure or malfunction of the IT connection. The Applicant acknowledges that any files attached by the Applicant will be subject to virus scanning and other data and information security filtering by the Data Controller. The computer components of the system are located on the Data Controller’s servers.

The Data Controller shall ensure the security of data processing by technical, managerial and organizational measures that provide a level of protection appropriate to the risks associated with the processing, by selecting the IT tools used and by operating them in such a way that the data processed:

a. be accessible to those authorized to have access to it (availability);
b. its authenticity and verification must be ensured (authenticity of processing);
c. its immutability can be verified (data integrity);
d. be accessible only to those authorized to do so and be protected against unauthorized access (data confidentiality).

Backup

The Data Controller makes backups of its electronically stored data on a daily basis. The Data Controller will store the backups on its own server. Legal basis for data processing for backups: the legitimate interest of the Data Controller to comply with the requirements of the GDPR and to ensure the continuous and uninterrupted availability of data generated in the course of its activities. The Data Controller processes a significant amount of data, and there is a significant public interest in the safe storage of this data and its recovery in the event of possible damage.

The purpose of data processing: to increase data security, to preserve documents related to the operation of the Data Controller and to restore them in case of a possible data security problem, to ensure the continuity of work processes.

Duration of backup storage: up to 5 years.

Storage of personal data at the Data Controller’s headquarters on paper and electronically on the Data Controller’s servers.

5. Data protection incidents

In the event of a data protection or data security incident, the Data Controller’s employees are obliged to report the incident to the person responsible for data protection incidents within the Company immediately after the incident is reported/detected.

If the personal data breach poses a high risk to the rights and freedoms of the Applicant, the Data Controller shall inform the Applicant of the personal data breach without undue delay, in particular:

• the name and contact details of the Data Protection Officer,
• the likely consequences,
• the measures planned or taken to remedy the situation.

The Data Controller shall keep a record of the data breaches, their known impact and the measures taken.

6. Data processors

The Data Controller may use the services of third parties to carry out some of its tasks in order to achieve the data processing purposes set out in point 2, which may include the processing of Applicants’ personal data. These third parties (hereinafter referred to as “Data Processors”) shall carry out the data processing in accordance with the instructions of the Data Controller and in compliance with the provisions of the applicable legislation. For the purposes of data processing, personal data shall be transferred to each Data Processor only for the purposes necessary for the fulfilment of that purpose.

A list of the Data Processors used is set out in Annex 1.

7. Data transfer

The Data Controller may be entitled and also obliged to transfer the personal data of Applicants to certain third parties in specific cases specified by law, in particular, but not limited to, a court, public authority, police, prosecutor’s office, local government, national security service. The Applicant has the right to be informed of the transfer of his/her data to a third party, unless the provision of such information would jeopardize the purpose of the transfer.

The Data Controller shall keep a record of data transfers, which shall include:

• the date of transfer of personal data;
• the legal basis of the data transfer;
• the recipient of the transfer;
• the scope of the personal data transferred.

The Data Controller declares that it will not transfer (or make available to a data controller in a third country) the personal data of Applicants to a third country, i.e. a country outside the European Union.

The Data Controller shall ensure that the legal conditions for data processing (purpose, legal basis) are met during the transfer and that the transfer does not violate the rights of the Applicant.

8. The Applicant’s rights regarding data processing

The Company hereby informs the Applicants that in the event of a complaint or comment, it is advisable to contact the Company as Data Controller using one of the contact details provided in this Notice. Please contact us electronically if possible. Please note that the Data Controller will respond to data protection requests in electronic form wherever possible, unless you, as an Applicant, explicitly request another means of contact or the Data Controller does not know your electronic contact details.

The Applicant is entitled to exercise his or her data subject rights as follows:

Rights of the Applicant:

a) right of access

The Applicant has the right to receive feedback from the Data Controller as to whether his/her personal data are being processed and, if such processing is in process, the right to be informed about the personal data processed, the purposes of the data processing, the categories of data, the recipients, the storage period, the rights, and the source of the data.

The Company will provide the Applicant with a copy of the personal data processed. For additional copies requested by the Applicant, the Data Controller may charge a reasonable fee based on administrative costs.

b) right of rectification and correction

The Applicant has the right upon his/her request to have inaccurate personal data concerning him/her corrected by the Data Controller without undue delay. Taking into account the purpose of the processing, the Applicant shall have the right to request the completion of incomplete personal data, including by means of a supplementary declaration.

c) right to be forgotten

The Applicant has the right to have his/her personal data deleted by the Data Controller without undue delay upon his/her request. If the purpose of the data processing ceases to exist or the Applicant withdraws his/her consent to the data processing, the Data Controller shall no longer process the Applicant’s data and shall delete the personal data relating to the Applicant without further notice to the Applicant in accordance with its policy on disposal.

d) the restriction of data processing

The Applicant has the right to have the Data Controller restrict the processing of his/her data at his/her request if one of the following conditions is met:

• the Applicant contests the accuracy of the personal data, in which case the restriction applies for the period of time that allows the Data Controller to verify the accuracy of the personal data;
• the data processing is not legitimate, and the Applicant objects to the deletion of the data and requests instead the restriction of their use;
• the Data Controller no longer needs the personal data for the purposes of processing, but the Applicant requires them for the establishment, exercise or defense of legal claims; or the Applicant has objected to the processing; in which case the restriction shall apply for a period of time until it is determined whether the legitimate grounds of the Data Controller prevail over the legitimate grounds of the Applicant.

If processing is restricted on the basis of the above, such personal data, except for storage, may only be processed with the consent of the Applicant or for the establishment, exercise or defense of legal claims, or for the protection of the rights of another natural or legal person, or for important public interests of the Union or of a Member State. The Data Controller shall inform all recipients of the rectification, erasure, forgetting or restriction of data processing to whom or with which it has disclosed the personal data, unless this proves to be impossible or requires an unreasonably excessive effort.

e) the right to data portability

The Applicant is entitled to receive the personal data concerning him/her that he/she has provided to the Data Controller in a structured, commonly used, machine-readable format, and is also entitled to transfer these data to another controller without the Controller’s obstruction, if the data processing is based on consent and the data processing is automated. In exercising the right to data portability, the Applicant has the right to request, where technically feasible, the direct transfer of personal data between data controllers. Exercising this right must not violate the right to erasure. That right shall not apply where the data processing is necessary for the performance of a task carried out in the exercise of a right in the public interest. The exercise of the right must not adversely affect the rights and freedoms of others.

f) right to object

The Applicant has the right to object at any time, on grounds relating to his or her situation, against the processing of personal data based on point (e) or (f) of Article 6(1) of the GDPR concerning him or her, including profiling based on those provisions. In such a case, Data Controller can no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Applicant, or which are related to the establishment, exercise or defense of legal claims. The Applicant has the right not to be subject to a decision based solely on automated data processing, including profiling, which would produce legal effects on him or her, or similarly significantly affect him or her.

Except when the decision is:

• necessary for the conclusion or performance of a contract between the Applicant and the Data Controller;
• is permitted by Union or Member State law applicable to the Data Controller which also lays down appropriate measures to protect the rights and freedoms and legitimate interests of the Applicant; or is based on the Applicant ‘s explicit consent.

g.) Right to withdraw consent

If the processing of personal data is based on the Applicant’s consent, the Applicant has the right to withdraw it at any time. Upon withdrawal of consent, the data processing will be terminated by the deletion of the Applicant’s personal data, provided that there is no other legal basis for the processing of the Applicant’s personal data. Withdrawal of consent has no consequences for the Applicant. However, the withdrawal of the Applicant’s consent shall not affect the lawfulness of any processing previously carried out on the basis of that consent.

9. Procedure to be followed if the Applicant has a complaint or a claim relating to data processing

The Applicant may contact the Company’s representative at any of the contact details indicated above with any of the above requests or other questions or requirements concerning his/her personal data.

The Data Controller shall process the request within 30 days of receipt of the written request. If necessary and taking into account the complexity of the request or the number of pending requests, the Company may extend the time limit for processing the application by 2 months. The applicant shall be informed in advance of any such extension and of the reasons for such extension. If the Applicant’s request is justified, the Data Controller shall implement the requested measure within the procedural time limit and shall inform the Applicant in writing about the execution. If the Data Controller rejects the Applicant’s request, it has to prepare a written decision. In its decision, it must state the facts on which the decision is based, the justification for its decision, citing the relevant legislation or case law, and shall inform the Applicant of the legal remedies against the decision of the Data Controller.

The Applicant shall be liable to pay the costs related to the exercise of his/her rights only if the Data Controller has informed the Applicant in writing within 8 days of receipt of his/her request that his/her request is unfounded or excessive and at the same time informed him/her of the administrative costs, but the Applicant has maintained his/her claim in writing despite these circumstances. The claim is deemed to be maintained if the Applicant does not withdraw his/her application within 5 working days or by the end of the administration period, despite being informed by the Data Controller. The Applicant who is liable for the costs shall pay the costs within 8 days of receipt of the payment request issued by the Data Controller.

If the Applicant does not agree with the decision of the Data Controller, or if the Data Controller fails to comply with the relevant procedural time limit, the Applicant may appeal to the supervisory authority or to a court.

Supervisory Authority

If the Applicant considers that the processing of his/her personal data by the Data Controller violates the provisions of the data protection legislation in force, in particular the GDPR, he/she has the right to file a complaint with the Hungarian National Authority for Data Protection and Freedom of Information.

Contact details of the Hungarian National Authority for Data Protection and Freedom of Information:
Website: https://naih.hu/
Address: Falk Miksa street 9-11, 1055 Budapest
Postal address: 1363 Budapest, Pf.: 9.
Telephone: +36-1-391-1400 Fax: +36-1-391-1410
Email: ugyfelszolgalat@naih.hu

The Applicant also has the right to file a complaint with a supervisory authority established in another EU Member State, in particular in the Member State of habitual residence, place of work or place of the alleged infringement.

Right to take legal action (right to go to court)

Irrespective of their right to lodge a complaint, Applicant may take legal action if his/her rights under the GDPR have been infringed in the processing of their personal data.

The Data Controller may be brought before a Hungarian court as a Hungarian data controller. The contact details of the courts in Hungary can be found at the following link: https://birosag.hu/ugyfeleknek/birosagok/torvenyszekek.

10. Other measures

The Data Controller reserves the right to amend this Notice unilaterally at any time, in accordance with the legislation.

Annexes:

• No 1 – List of data processors and data transfers
• No. 2. – Applicants’ declaration of understanding of the Notice

Budapest, 2025.04.15.

Onespire Ltd.
Data Controller

Annex 1 of the Notice

List of data processors and data transfers

Annex 2 of the Notice

Statement

I, the undersigned (name) …………………………….. (mother’s name: ……………………………….., address: …………………………………………………………………) , as an Applicant for the job application announced by Onespire Ltd. (Registered office: 1123. Budapest, Alkotás street 53- hereinafter referred to as the Company), declare, that I have read and understood the relevant information on the facts concerning the processing of my personal data contained in the “DATA PROTECTION NOTICE FOR JOB APPLICANTS” issued by Onespire Ltd. as Data Controller, in force on the date below and that I have agreed to the provisions contained therein.

I, the undersigned, declare that I am aware of my responsibility, that the data I have provided is accurate and that I am entitled to process the data I have provided and to transmit it to the Data Controller.

I, the undersigned, expressly consent to the processing of my personal data provided below by the Data Controller in accordance with the provisions of the “DATA PROTECTION NOTICE FOR JOB APPLICANTS”. I do not include data to which I do not consent.

I further declare that I have been authorized by the data subject(s) to disclose any personal data that I may have provided to the Data Controller which are not my own.

I acknowledge that I may exercise my rights under the provisions of the applicable data protection legislation, I have the right of access and data portability, I may request the rectification, restriction or erasure of the processed data, I may object to the processing of my data by post, in person via my immediate manager and/or at the address of the Data Controller’s central administration or at the e-mail address of the Data Controller, I may withdraw my consent and I may exercise my rights of redress.

Dated: ……………………………….

…………………………………………..
Signature of the Applicant