Personal data protection

Privacy Policy - Profesia CZ, spol. s r.o. www.profesia.cz


1. Introductory Provisions
2. Definitions
3. Principles of Processing and the Security of Personal Data
4. Processing of Personal Data When Providing Services on the Website
5. Rights of Data Subjects


1. Introductory Provisions


Profesia CZ, spol. s r.o. is an organisation with a long tradition of providing services to entities operating on the labour market. It is the strategic objective of Profesia CZ, spol. s r.o. to ensure financial and economic stability, improve the quality of the services provided, develop good relationships with its partners, and enhance the company’s reputation.

Implementing these objectives depends on the constant improvement of the management quality, as well as the quality and efficiency of the provided services that apply the latest IT-assisted procedures. We realise that the security and protection of personal data is an integral part of the use of information technologies.

The Security Policy of Profesia CZ, spol. s r.o. stipulates the necessary and economically appropriate measures to protect the assets of the information system, individuals, and property, and to implement security mechanisms into the system of technologies used.

Profesia CZ, spol. s r.o. management is responsible for proper risk assessment and its efficient management with respect to the protection of assets that are essential for ensuring the proper functioning of the organisation. The primary objective of managing such risks is to prevent, manage, and recover from security incidents.

To protect vital assets falling within internal security, we have, in cooperation with experts, applied security measures that are adapted to the latest knowledge and needs of the organisation. In designing them, we implemented technical and organisational measures that aim to:

At the same time, Profesia CZ, spol. s r.o. announces that it entrusted the company Profesia, spol. s r.o., TIN 35800861, with its registered seat at Pribinova 19, 811 09 Bratislava, Slovakia with the task of processing personal details of job seekers for the purposes of technical support of the web site www.profesia.cz.

Therefore, Profesia CZ, spol. s r.o. has adopted appropriate technical and organisational measures to ensure the level of security in the processing of personal data (including the DPIA dossier), and has developed a security project that is regularly updated and defines the scope and method of security measures needed to eliminate and minimise threats and risks affecting our company’s information systems.

Profesia CZ, spol. s r.o. processes the personal data of the Data Subjects exclusively in accordance with Act No. 110/2019 Coll. on the Protection of Personal Data and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC on the protection of individuals with regard to the processing of personal data. Profesia CZ, spol. s r.o. is an operator of personal data.

Profesia CZ, spol. s r.o. has issued this document, which includes the basic rules for the processing of personal data in providing services through the website www.profesia.cz (hereinafter the “Website”). Profesia CZ, spol. s r.o. reserves the right to amend and supplement this document, while informing its business partners immediately by posting any changes on the Website and specifying the date from which such changes take effect. All rights which are not explicitly provided for herein shall be governed by the General Terms and Conditions of Profesia CZ, spol. s r.o. and by the applicable Czech legislation.

This document is in accordance with the applicable provisions of:

The Privacy Policy shall always be available at www.profesia.cz

Up

2. Definitions



Personal data
is any information regarding an identified or identifiable natural person (hereinafter the “Data Subject”); an identifiable natural person is a person who can be identified directly or indirectly, in particular by reference to an identifier such as name, identification number, location data, online identifier, or a reference to one or more elements specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person;

Data Subject means the person to whom the personal data relates.

An Administrator is a natural or legal person, a public authority, an agency, or other entity that, alone or jointly with others, determines the purposes and means of processing personal data; where the purposes and means of such processing are laid down in European Union law or in the law of a Member State, the Administrator or the specific criteria for the Administrator’s designation may be determined by European Union law or by the law of a Member State;

An Agent is a natural or legal person, a public authority, an agency, or other entity that, alone or jointly with others processes personal data on behalf of an Administrator;

A Client is a natural person or a legal entity that uses or intends to use the services provided on the Website; a Client is a natural person who is a job seeker.

A Business Partner is a natural person or a legal entity using the services provided on the Website to find a suitable employee. A Business Partner is a registered client of our company.

A Job Seeker may only be a natural person who uses the services provided on the Website to find a suitable job with a Business Partner.

A CV is a summary of data on a Job Seeker.

The CV Database is a database containing CVs created and/or published by Job Seekers.

Services represent the products that Profesia CZ, spol. s r.o. provides to Business Partners and Job Seekers via the Website. Services provided to Job Seekers involving the processing of personal data include: the ability via the Website to answer or respond to a published job advert or short-term temporary job offer, to create/save and publish/provide a CV in the CV Database, send matching job adverts via email, recommend a job advert to a friend, communicate in the job forums, and request references via the Website. Services provided to Business Partners involving the processing of personal data include: the publication of job adverts and providing access to the CV Database.

The processing of personal data is conducted in operations or sets of operations involving personal data, especially their procurement, aggregation, dissemination, recording, configuration, adaptation or modification, searching, browsing, rearrangement, combination, relocation, use, storage, blocking, disposal, provisioning, disclosure/provisioning, or publication.

The provisioning of personal data is the handover of such personal data to a third party for further processing.

The disclosure of personal data includes the notification of personal data or providing access to such data to the recipient, with no further processing.

Consent from the Data Subject is granted freely in the form of an express and comprehensive manifestation of will, by which the Data Subject expresses their consent to the processing of their personal data. Consent shall be demonstrated by an audio or audio-visual recording or by an affidavit of the person who provided the personal data stored in the filing system, or in another reliable manner. Written Consent is demonstrated by a document that confirms the granting of Consent. The proof of Consent shall in particular contain information on the person granting the Consent, the entity to which the Consent was granted, the purpose, list, or scope of the personal data provided, and the term of validity of the Consent.

The anonymisation of personal data is a step via which personal data is modified into such a format that prevents its assignment to the Data Subject whose personal data is involved.

Up

3. Principles of Processing and the Security of Personal Data



Personal data
must be:

The Administrator is responsible for compliance with the above principles and must be able to demonstrate this compliance (“responsibility”).



The processing of personal data
is legal only if and only to the extent that at least one of the following conditions is met:



The Administrator
is particularly obliged:

Up

4. Processing of Personal Data When Providing Services on the Website


Personal Data in CVs and in the CV Database

Services provided to Job Seekers include the ability, through an online form filled out on the Website or through a printed form delivered to the address of the company Profesia CZ spol. s r.o. with the seat Opletalova 55, Praha 110 00, Česká republika or Workania Magyarország Kft. with the seat Mozsár utca 16, Budapest 1066, Hungary (hereinafter referred to as "Joint Operators“), to create a CV and to make it accessible/provide it in the CV Database to Business Partners of the Profesia CZ spol. s r.o. Company. The CV Database is a joint database of the companies named above, who make it up together and who process the personal data contained there as Joint Operators. Mutual cooperation of the Joint Operators was declared in a written contract that was concluded for an indefinite period and states the conditions for personal data processing among Joint Operators. The Joint Operators have agreed: The contact place for concerned parties will be each of the Joint Operators, the information about the contact place will be published by each of the Joint Operators on their websites, the concerned parties can claim their rights pursuant to GDPR with each of the Joint Operators and against each of the Joint Operators, the obligation to provide information mentioned in articles 13 and 14 of the GDPR Regulation will be fulfilled by each of the Joint Operators, the obligations and tasks related to exercising rights of the concerned parties will be fulfilled by Profesia CZ, CZ spol. s r.o. The Joint Operators are obliged to provide mutual interaction when fulfilling obligations according to the GDPR Regulation, especially concerning the rights of the concerned parties, fulfilling the obligation to inform the concerned parties, when assessing and reporting security incidents, as well as when taking suitable measures for personal data protection. Each of the Joint Operators is obliged to publish the basic parts of this Agreement on their Website.

CVs stored in the CV Database include data classified as Personal Data under the Regulation and the Act. Therefore, such Personal Data may only be processed with the consent of the Data Subject. Prior to saving the CV, the Data Subject declares that all disclosed Personal Data is true and grants its consent to Profesia CZ, spol. s r.o. to process its Personal Data.

The purpose of the processing of this Personal Data is to provide assistance to the Data Subject as a Job Seeker to find a suitable job. Profesia CZ, spol. s r.o. is authorised to disclose/provide the Personal Data contained in the Concerned Person’s CV to its Business Partner based on the consent of the Data Subject and for the purposes disclosed in the previous sentence.

The Personal Data contained in the Data Subject’s CV is disclosed/provided to a Business Partner over the Internet via the Website for a period of 3 months from the date of consent to such processing of their personal data. After the expiration of this period, the Personal Data contained in the CV shall not be made accessible and will remain stored in the CV Database in case the Data Subject once again discloses/provides this data.

Once a period of 3 years has passed since the Job Seeker’s last login to their registered account at www.profesia.cz, the data contained in the CV Database shall be rendered permanently anonymous and shall further only be used for statistical purposes . The making accessible/providing of the CV may be terminated or renewed any time on the basis of the Data Subject's decision. Upon written request from the Data Subject, Profesia CZ, spol. s. r.o. is obliged to definitively delete their Personal Data.

CVs stored in the CV Database include: at least one means of contact (email address or phone number), highest level of completed education, specification of the field and job they are interested in, the definition of a location in which they are looking for a job, the type of employment sought, and gender (exclusively for the purposes of statistical processing). A Data Subject as the Job Seeker alone decides what other data to provide in a CV; Profesia CZ, spol. s r.o. does not require that any other information be provided. Profesia CZ, spol. s r.o. in no way requires that a Job Seeker disclose any data considered a special category of personal data as defined in Article 9 of the Regulation or of the Act.

Personal data in a response to a job advert or a short-term temporary job offer

Services provided to Job Seekers include the ability to answer or respond to a job advert or short-term temporary job offer published on the Website. Business Partners publish such job adverts or short-term temporary job offers. A Job Seeker may respond to such job adverts/short-term temporary job offers published on the Website. Profesia CZ, spol. s r.o. archives the answers sent by Job Seekers to job adverts posed on the Website.

Answers on the Website to published job adverts archived by Profesia CZ, spol. s r.o. contain data considered Personal Data under the Regulation and the Act. Therefore, such Personal Data may only be processed with the consent of the Data Subject. Before sending an answer or a response to a job advert or a short-term temporary job offer, the Data Subject declares that all provided details are true and then grants their consent to the processing of their personal data by Profesia CZ, spol. s r.o. and its Business Partner that published the specific job advert.

The purpose of the processing of this Personal Data is to provide assistance to the Data Subject as a Job Seeker to find a suitable job. Profesia CZ, spol. s r.o. archives the answers sent by Job Seekers to job adverts posed on the Website. Consent is granted for a period of 3 years. After a period of 3 years, the Personal Data will be made anonymous and used for statistical purposes only. A Job Seeker may work with (e.g. review, re-use, re-send, etc.) the answers to reactions sent to a Business Partner during this period using their registered account created on the Website.

The period of three years is considered the time in which no significant changes are expected with respect to the Job Seeker’s qualifications and prerequisites and qualification requirements for a specific job. The three-year period was also defined based on HR-specific knowledge and expertise.

Answers on the Website to a published job advert or short-term temporary job offer include: at least one means of contact (email address or phone number), highest level of completed education, and gender (exclusively for the purposes of statistical processing). A Data Subject as the Job Seeker alone decides what other data to provide in an answer or response to a job advert or a short-term temporary job offer; Profesia CZ, spol. s r.o. does not require that any other information be provided. The Profesia CZ, spol. s r.o. Company in no way requires that a Job Seeker disclose any data considered a special category of personal data as defined in Article 9 of the Regulation or of the Act.

The Data Subject sends its CV with all attachments to the Client (Business Partner) through a website and grants its consent to the Client to the processing of their personal data for inclusion in the Client’s selection process via the Website. The selection process is not only a process for selecting a person for a published job position, but the Client's ability to process the personal data of the applicant during the period specified in the personal data processing agreement for the Client and, if contacted, for the selection procedure for another suitable job position. The consent to the processing of personal data is editable at the request of the Client; the editing of consent for the processing of personal data is subject to approval by the Operator.

When offering services the company Profesia CZ, spol. s r.o. and also the Client (Business Partner) have the position of an Administrator, they deal with the Data Subject independently and in their own name. This is without prejudice to the right of the Job Seeker as the Data Subject to exercise its rights under the Regulation or the Act with each Administrator and against each Administrator.

The purpose of the personal data processing for Business Partners is „Finding a suitable employee“. The Business Partner is not entitled to use the personal data obtained through the Website for another purpose.

Profesia CZ spol. s r.o. provides through the Website the information according to Article 13 of the Regulation and § 19 of the Act to the Data Subjects. The legal basis for the personal data processing for Profesia CZ, spol. s r.o. is the consent of the Data Subject.

After obtaining the personal data, the Business Partner is obliged to fulfil his liability to notify the Data Subject according to Article 14 of the Regulation and § 20 of the Act.

Information concerning the contractual relationship between Profesia CZ spol. s r.o. and the Business Partner are published on the website and they are publicly accessible to Data Subjects. The contract on providing services is concluded for a definite time period, not longer than one year (https://www.profesia.cz/en/vseobecne-obchodni-podminky)

Sending matching job adverts via email

Services provided to Job Seekers include the ability to set up an “alert” via the Website to send matching job adverts. This Service gives Job Seekers the ability to define specific search criteria for job adverts published by Business Partners on the Website. These Job Adverts are then sent to the Job Seeker’s provided email address.

Given that an email address may be considered personal data under the Regulation and Act, the Data Subject must provide consent to the processing of their personal data before activating the alert; the processing of personal data in the scope of an email address is technically required to provide this service. Consent is granted for a period of 3 years.

The Job Alert service is activated by registering an account on the Website.

Recommending a job advert to a friend

Services provided to Job Seekers include the ability to recommend a job advert to someone else via the Website. These job adverts are then sent to another person together with a special link and the email address provided by the Job Seeker.

Given that an email address may be considered personal data under the Regulation and Act, the Data Subject must provide consent to the processing of their personal data before submitting their e-mail.

The Job Advert Recommendation service is activated by registering an account on the Website. An email address is used to activate and administer a registered account on the Website; the processing of personal data in the scope of an email address is technically required to create a registered account on the Website. Consent is granted for a period of 3 years.

Communicating in job forums

Services provided to Job Seekers include the ability to communicate in job forums with other Job Seekers via the Website. This service is only accessible by registering an account on the Website. An email address is required to register an account on the Website.

Given that an email address may be considered personal data under the Regulation and Act, the Data Subject must provide consent to the processing of their personal data before registering an account. An email address is used to activate and administer a registered account on the Website; the processing of personal data in the scope of an email address is technically required to create a registered account on the Website. Consent is granted for a period of 3 years.

Only the Client is responsible for the personal data of the Job seekers obtained by the Client and entered afterwards into the HR application MARK, these personal data may only be processed with the consent of the Data Subject.

Requesting a reference via the Website

The Services provided to Job Seekers on the Website include requesting a reference. This service is only accessible by registering an account on the Website. An email address is required to register an account on the Website.

Given that an email address may be considered personal data under the Regulation and Act, the Data Subject must provide consent to the processing of their personal data before registering an account. An email address is used to activate and administer a registered account on the Website; the processing of personal data in the scope of an email address is technically required to create a registered account on the Website. Consent is granted for a period of 3 years.

Cookies

Cookies are small data files that are downloaded onto the device (PC, tablet, mobile phone, etc.) while using the Website. The Administrator uses cookies to examine the effectiveness of the Website. Cookies generally do not contain any information intended to identify individual persons, but instead are used to identify the browser on a specific device. Cookies may be temporary or may permanently remain on the device even after closing the browser for the time specified in the cookie.

These permanent cookies can be checked every time the Website is visited. The information we collect through the Website includes: browser type, the web address from which the Website was visited, the device operating system, and the IP address of the device. To display more relevant ads, some cookies are set up by a third-party advertising system, such as Google Adsense. This may be disabled in the Google account. The computer can be set to refuse cookies, although in that case some of the page functionalities will not work.

Personal Data of Client Employees

When using Services, Clients have the ability to provide and publish contact details for their employees in the following scope: first name, last name, email address, phone number and position. Under the Regulation and the Act, this is data that the Administrator, as the employer of such Data Subjects, may provide or publish, if necessary in connection with the performance of job, service or other functional duties on the part of the Data Subjects.

The provisioning or publication of personal data may not interfere with the standing, dignity and security of the Data Subject. Such data may be processed for up to 10 years from the delivery of the Client’s final order at the longest and will be definitively deleted after this period.

Subcontractors

For the purposes of the present GCTC, the agents procuring personal data are: Google Ireland Limited, the Google Cloud Platform service in keeping with Google Cloud Platform Terms of Service published on the website: https://cloud.google.com/terms/; Hotjar Limited, C 65490, Level 2, St Julian’s Business Centre, 3, Elia Zammit Street, St Julian’s STJ 1000, Malta

Up

5. Rights of Data Subjects

 

The Administrator will take appropriate measures to provide the Data Subjects with all the information referred to in Articles 13 and 14 of the Regulation and all communications under Articles 15 to 22 and Article 34 of the Regulation relating to processing, in a concise, transparent, comprehensible, and easily accessible form, clearly and easily formulated, especially in the case of information intended specifically for a child. Information shall be provided in writing or by other means, including where appropriate by electronic means. If the Data Subject so requests, the information may be provided orally, as long as the identity of the Data Subject has been proven in another way.

The Data Subject has the right to obtain from the Administrator a confirmation if personal data concerning themselves has been processed and, if so, they have the right to access this personal data and the following information:

The Data Subject has the right to require the Administrator to correct any incorrect personal data relating to them without undue delay. With regard to the purposes of the processing, the Data Subject has the right to supplement incomplete personal data, including through the provision of a supplementary statement.

The Data Subject is entitled to request that Profesia CZ, spol. s r.o. delete their personal data. All consent to the processing of personal data provided to Profesia CZ, spol. s r.o. is revocable. Please send your request to the e-mail address: [email protected]

The supervisory authority is the Office for the Protection of Personal Data of the Czech Republic. The Data Subject is entitled to file a complaint with the supervisory authority. With any questions, please contact the person responsible for the processing of your personal data: Ing. Jana Kaplická, Profesia CZ, spol. s.r.o., e-mail: [email protected]





In Prague, on  24.05.2018                      Mgr. Ivana Molnárová, Managing Director of Profesia CZ, spol. s r.o.