Privacy statement for job applicants and future coworkers

Since you have decided to apply for a position in our company Nice Reply, s.r.o., having its seat at Štefanovičova 2971/8, Bratislava - mestská časť Staré Mesto 811 04, Slovakia, ID number (IČO): 46 682 007, registered with the Commercial Registry of District Court Bratislava I, Section Sro, Insert No. 81612/B (the “Company”, or “we”, or “our”), after you approach us, or after you submit your application and when we start the selection process, this Privacy Statement for Job Applicants and Future Coworkers (the “Privacy Statement”) will apply to you and your personal data.

Please note that the content of this Privacy Statement might be updated from time to time. This version of the Privacy Statement is effective as of 1st January 2023. You can always find an up-to-date version of this Privacy Statement on our website Privacy Policy.

With respect to the Privacy Statement, we will be responsible for protection of your personal data as a data controller. This Privacy Statement explains how we will use your personal data obtained directly from you or from third parties during the selection process to find our future employee or coworker, who can fill a concrete position. In this Privacy Statement we provide you with the following information:

Whose data will be processed?
Why do we process your personal data, which data do we process and on which legal basis?
With whom may we share your personal data?
Do we transfer your personal data to third countries?
How long do we process your personal data?
Are you subject to automated decision making or profiling?
Which measures do we use to protect your personal data?
What are your rights?
How can you contact us?

For the purposes of this Privacy Statement, the abbreviation “GDPR” means General Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. Please be informed that the information provided in this Privacy Statement shall fulfil our information obligation based on art. 13 of GDPR and we use all our efforts to ensure our compliance with the applicable data protection legislation

Please note that this Privacy Statement applies exclusively to the processing of personal data carried out by us. This Privacy Statement does not deal with the processing methods and data protection practices of other third parties for which we are not responsible. Further, note that we do not process personal data of persons younger than 18 years old.

1. Whose data will be processed?

Since we are interested in finding the right candidates for the positions in our organisation, we process personal data of:

all candidates who actively applied for the concrete position,
persons, who approached us with the request to start a cooperation, or
of those about whom we got reference. (“you” or “your”).

We can obtain respective data either directly from you (e.g. if you are applying through dedicated job portals, web pages or via email) or from third parties, who refer to you as a right candidate for the respective position.

2. Why do we process your personal data, which data do we process and on which legal basis?

Our main purpose for processing your data is our legitimate interest to find a right candidate for the concrete position that we need to fill. There are several ways through which we are able achieve this legitimate interest, e.g. through collecting information about potential coworkers and candidates and keeping of their database for the future, during an interview conducted either in online form (video calls) or personally, through assessing the information included in your CV, motivation letter, references or videos, and through specific knowledge-based questionnaires provided by us.

provision of our services to you,
our legal obligations arising from our contractual relationship, and
our legitimate interest to promote our services and provide you with relevant marketing offers.

If you are interested, please find below more detailed overview of the purposes for processing of your data, concrete scope of processed data and applicable legal basis:

Purpose	Detailed purpose description	Scope of processed data	Applicable legal basis
Submission of application or contacting for potential cooperation	You may apply for a position in our organisation via our career page, or through job portals, or directly by contacting us via email. We can also search for the right candidate on professional social networks (e.g., LinkedIn) or use references from third parties provided to us.	When you apply for a position in our organisation, we will process your name, surname, email, information from your CV, information from your profile available on professional social networks, and possibly other details you decide to share with us.	Art. 6 (1) (f) of GDPR for the purpose of our legitimate interest to find suitable candidate for vacant position
Interview and candidate selection	Once we receive your application, your request for cooperation, or reference on you, or when we find you on the social website, we will approach you and ask you for an interview conducted either personally or via online tools (video call). We will review the professional information you shared with us in order to assess whether you fit in our organisation and for the concrete position. We may ask you to prepare a case study or assess your professional knowledge in a different way.	We process mainly your contact details (full name, academic degree, address (permanent and contact one), e-mail address, phone number) and information that you mentioned in your CV (information about your date of birth, your picture, previous work experience, education, skills, language skills and any other information that you decide to mention in your CV). We may also process data from your motivation letter, if you decide to send it to us. Further we may also process data concerning your knowledge assessment.	Art. 6 (1) (f) of GDPR for the purpose of our legitimate interest to find suitable candidate for vacant position
Pre-employment screening	Depending on the nature of the job, we may ask a pre-employment screening expert to determine whether there are any circumstances which would disqualify you as a candidate from that job (e.g. missing qualification, missing trade licence). Whether or not a screening will occur, as well as the scope and purpose will be discussed with you prior to the start of the screening.	In addition to the based data from the interview, we may process data required to prove legal eligibility for performance of respective jobs. Depending on the nature of the job, we may request you to provide us with a declaration from relevant public authority confirming that you have not been convicted of any crime, which would disqualify you from the selection process of applicant for the respective job, or that you are entitled to perform business.	Art. 6 (1) (f) of GDPR for the purpose of our legitimate interest to find suitable candidate for vacant position Art. 6 (1) (b) of GDPR for the performance of a contract or to take steps prior to conclusion of a contract
Obtaining references from third parties	We may decide to obtain references from individuals who have worked with you in the past. Generally, we will only contact those individuals if you have provided us with their names and contact details. In addition, we may receive referrals to you from our colleagues or other people who know you and consider you a suitable candidate for us.	In this case we will process your basic contact details full name, academic degree, address (permanent and contact one), e-mail address, phone number) and information about your previous experience included in the references provided to us from third parties.	Art. 6 (1) (f) of GDPR for the purpose of our legitimate interest to find suitable candidate for vacant position
Conclusion of employment contract or contract of similar nature	If you are successful in the selection process, we will conclude an employment contract or similar contract for cooperation with you and you will become our employee or coworker. Prior to the contract conclusion, we need to obtain certain data from you in order to prepare your contract, to inform respective public authorities about your new employment and to ensure that everything is ready for you, when you start to work for us.	When we decide to enter into a contract with you, we will process data required to identify you in the contract - your full name, academic degree, contact details (address (permanent and contact one), e-mail address, phone number), your bank account number and bank related information. Further, we will process information required by public authorities ( especially, if we conclude an employment contract) and information needed to register you in the relevant internal systems (e.g., your date of birth, birth registration number, ID number). We will also process information about your health, however only in case this information is relevant for the performance of the job that you apply for.	Art. 6 (1) (b) of GDPR for the performance of a contract or to take steps prior to conclusion of a contract In the case of a special category of personal data (health data), our legal basis for the processing is art. 9 sec. (2) (b) of GDPR.
Database of job candidates and potential coworkers	Once you apply for a job in our organisation, we will include your details in our internal database of candidates, which we can use for another selection process.	In our database we keep your contact details and selected information originally included in your CV (e.g., information about your skills) that you provided to us, when applying for the job.	Our legal basis for processing of your data is art. 6 (1) (a) of GDPR, i.e. your consent
Dispute resolution	We may process your personal data for the purposes of solving legal disputes, claims complaints or other similar proceedings.	We will process your personal data mainly in the scope of information related to the selection process, contact details, content of our communication, any other personal data that may be included in your complaint, or part of the dispute and necessary for its solution	Art. (6) (1) (f) of GDPR for the purpose of our legitimate interest to handle disputes that may arise in relation to the selection process Art. 6 (1) (c) of GDPR for compliance with a legal obligation to which we are subject
Fulfilment of our legal obligations	We are obliged to process your personal data to fulfil our various legal obligations (e.g., tax obligations, accounting obligations). We may also be obliged to provide your personal data in case of inspection by public authorities, when requested by them and for preventing, monitoring and proving fraud, combating money laundering and other criminal activities. Further, we may have to process your personal data to comply with a decision of respective public authority or with a judicial order.	The scope of personal data we process for this purpose depends on the requirements imposed on us by the public authorities and by applicable law.	It is our legal obligation to process your personal data within the meaning of art. 6 (1) (c) of GDPR.

In cases where we process your personal data based on our legitimate interest according to art. 6 (1) (f) of GDPR, you are entitled to object to such processing according to art. 21 of GDPR. If you decide to object to the processing, please do so by contacting us through the contact information below.

If the processing of your personal data is a contractual requirement according to art. 6 (1) (b) of GDPR and you decide not to provide us with this personal data, such action may result in the impossibility of concluding a contractual relationship with you, or other complications related to the fulfilment of our contractual obligations.

Whenever we process your personal data based on your consent given to us in accordance with the art. 6 (1) (a) of GDPR, you have the right to withdraw such consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. If you wish to withdraw your consent to the processing of your personal data, please contact us via the contact information below.

If we are legally required to process personal data, you may have an obligation to provide us with that personal data. If you refuse to do so, it may have various legal consequences for you and for us, including adverse consequences (e.g., impossibility to perform relevant action, impossibility of further cooperation, etc.).

3. With whom may we share your personal data?

We may share your personal data with our suppliers who support us in our business or provide us with partial services, e.g. recruitment agencies, postal services, physical security services, legal and audit services, tax advisors, various support services, technical subcontractors, etc. These include entities listed on the following link https://www.nicereply.com/list-of-processors

We do not permit our suppliers to sell any personal data we share with them, or to use any personal data we share with them for their own purposes or for other purposes than to perform the services they provide to us. Before engaging any supplier, we perform extensive due diligence, including detailed privacy, security and legal analysis. We do not engage a supplier unless our quality standards are met. Our suppliers are all subject to contract terms that enforce compliance with applicable data protection laws.

Certain of our employees and coworkers may have access to your personal data as well. In such a case, access shall be granted only if it is necessary for the purposes described and only if the respective employee is bound by the confidentiality duty.

Further, please be informed that our suppliers may engage additional contractors to support them in their business and to provide them with certain services, which can possibly also require processing of your data. Such services may include but are not limited to: cloud services and website hosting, data analysis, information technology and related infrastructure, customer service, email delivery, banks and payment method providers, accounting, legal, tax and audit services. These further contractors should provide their services based on the contract, under which they are obliged to follow applicable law, especially with respect to observance of applicable data protection legislation.

Lastly, please note that we may share your personal data if required to do so by law or decision of respective public authority or court order, for example with our suppliers or clients, tax authorities, social security agencies, law enforcement agencies or other governmental agencies.

4. Do we transfer your personal data to third countries?

We process your personal data also outside the EU/EEA. In addition, some of our partners with whom we cooperate are located outside the territory of the EU/EEA, respectively, have their subcontractors located in those countries or process personal data in third countries in a different way. We strive to ensure that your personal data is transferred exclusively to countries that are considered to have an equivalent level of personal data protection in accordance with the relevant European Commission decision, or where the appropriate personal data protection measures are in place. In general, we use standard contractual clauses for data transfers to third countries or require compliance with other additional guarantees and measures. Regardless of the country in which your personal data is processed, we take appropriate technical, security and organisational measures to ensure that the level of protection is the same as in the EU/EEA. If you would like to know more about the international transfer of your personal data and the relevant safeguards, we have in place to govern the transfer of your personal data, you can contact us via email sent to the address mentioned above.

5. How long do we process your personal data?

We store your personal data as long as is necessary to fulfil the purpose mentioned in this Privacy Statement, for which the data were obtained, i.e. to pursue our legitimate interests and comply with applicable laws. This means that we will retain most of your data during the selection process and will delete them within 6 months after we have found the suitable candidate. If you provide us with the consent to include you in our database of applicants, we will process your data for 1 year, unless you withdraw your consent concerning processing of your data in our database earlier. If you have been selected as a successful candidate, we will further retain your personal data in your personnel file in accordance with applicable legislation and our internal HR regulations.

Please note that we may process some of your personal data for longer period of time, if e.g. :

the applicable law requires us to do so,
there is an ongoing legal proceeding, or
in exceptional cases, if you have given us the permission to keep your personal data on record for a longer period of time.

Please note that the above stated period may be prolonged in case of the request of the relevant public authority or of the court.

6. Are you subject to automated decision making or profiling?

Your personal data are not used for automated decision making or for profiling.

7. Which measures do we use to protect your personal data?

We make reasonable efforts to ensure a level of security appropriate to the risk associated with the processing of your personal data. We maintain technical and organisational measures designed to protect your personal data within our organisation against relevant security threats, including against unauthorised access, destruction, loss, alteration, or misuse. As already mentioned above, your data are accessible only to a limited number of personnel who need access to perform their duties. In case you wish to learn more about our technical and organisational measures, please do not hesitate to contact us on the contact details mentioned below.

8. What are your rights?

You are entitled to exercise your rights as a data subject with respect to the processing of your personal data. Please see the table below for more details.

Your right	What does it mean?
Right to access	You have the right to obtain the information whether your personal data are processed, and if yes, you can request a copy of your personal data we process, for which we may charge you with a fee. If we process your personal data, you can request information about: why we process your personal data, which personal data we process, with whom do we share your personal data, for how long we store your personal data and how do we determine the period, your rights to rectification or erasure, restriction or objection of processing of your personal data, your right to lodge a complaint with a supervisory authority, from where we collected your personal data, if not directly from you, whether you are subject to automated decision making or profiling, whether we transfer your personal data to third countries. All of the above-mentioned information is included in this Privacy Statement.
Right to rectification	It is important that we have the correct information, and we request you to notify us if any of your personal data is incorrect or if any of your personal data have been changed. We will rectify your personal data without undue delay upon your notification.
Right to erasure (“right to be forgotten”)	If the processing of your personal data is no longer necessary or has been unlawfully processed, you withdraw your consent or object to the processing of your personal data, you may request us to erase your personal data.
Right to restrict processing	From the moment when you asked for rectification of your personal data, or objected the processing, until we assess your request (e.g. to confirm the accuracy of your personal data or to rectify them according to your instructions), you are entitled to request us to restrict the processing. You may also request us to restrict the processing of your personal data if the processing was unlawful, but you do not want us to delete your personal data, or if we do not need your data anymore for the original processing purposes, however the data are important for defending your legal claims. This means that we (except for the retention of personal data) may process your personal data for which the processing was restricted, only if you consented with such processing, if it is necessary in connection with legal claims, to protect someone else's rights, or if there is a significant public interest in processing.
Right to object processing	If we process your personal data based on our legitimate interest or for direct marketing purposes, you may object to such processing. We can process your personal data further if we can demonstrate the compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.
Right to data portability	You may request us to provide you with the personal data that you provided to us for the processing based on the consent or for fulfilment of the contract. We should provide you with your personal data in a structured, commonly used and machine-readable format. You also have the right to request the transfer of these data directly to another data controller, if it is technically feasible.
Right to withdraw your consent	If some processing activities are based on the consent, you will have the right to withdraw such consent at any time. Please note that the withdrawal of your consent does not affect legality of the processing previously performed based on the originally granted valid consent.
Rights related to automated decision making and profiling	You have the right not to be subjected to automated decision-making, including profiling, which produces legal effect for you or has a similar significant effect. We do not use automated decision-making or profiling for the outlined purposes of data processing. However, if you have been subject to an automated decision and do not agree with the outcome, you can contact us using the details below and ask us to review the decision in a non-automated manner.

How can you contact us?

Privacy statement
for job applicants and future coworkers