Data processing notice

Effective from: 16 February 2023

The purpose of this notice is to inform you about the data processing practices followed and applied by BlackBelt Technology Zrt. (hereinafter: the Controller or BlackBelt) with regard to the personal data of candidates and of persons contacting us.

Please read this notice carefully before providing your data or sending your CV.

BlackBelt is committed to fully respecting its partners' rights relating to data processing and processes personal data in accordance with Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Infotv.) and Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (GDPR).

By sending your CV or our application form, you accept BlackBelt's privacy notice. You declare that you have understood and acknowledged the information contained herein, that you provide your data voluntarily, and that you expressly consent to the processing of your data as set out in this notice.

“CV” means the User's curriculum vitae and cover letter, together with any attached or uploaded references and other documents, including their full content.

The Controller accepts no responsibility for special categories of personal data disclosed to it without its express request (e.g. included in a CV); therefore, unless expressly requested, please do not provide such data. You may name a reference (e.g. a former employer). In that case, it is your task and responsibility to obtain the consent of the person named as a reference for us to contact them.

By applying, you consent to our contacting you via any of the contact details you have provided.

Controller's details and contact information

Name of the Controller: BlackBelt Technology Zrt.

Registered office: Ganz utca 16, 3rd floor, 1027 Budapest, Hungary

Main telephone number: +36 1 611 0462

Email: info@blackbelt.hu; dataprotection@blackbelt.hu

Website: www.blackbelt.hu

The Controller has designated Róbert Sövegjártó as the contact person for data subjects.

Collection of data

The Controller collects data primarily from the data subject. Data may be collected via the Website, through promotional materials published by the Controller, through order forms, in person, or by an employee of the Controller contacting the data subject by telephone.

Purpose and duration of processing

For candidates:

Contacting, notifying and informing candidates about job opportunities aimed at filling specific positions in line with their stated preferences, and presenting candidates to our clients.

Providing personalised services to candidates, keeping records of candidates, displaying targeted job offers, ensuring the quality of the search service, storing CVs for applications to positions that may be advertised later (CV storage service), and sending job newsletters.

Presenting candidates to potential partners for the purpose of winning and delivering projects.

Data are processed for the duration of the registration, i.e. for 2 years from the last activity relating to the candidate (for example, the last job application), or until the registration otherwise ends, including where the candidate requests the erasure of their data. The data subject may withdraw their consent at any time.

For persons contacting us:

Providing a name and an email address is mandatory for sending a message. We process these data for the purpose of responding to your enquiry and – if you expressly consent – to subscribe you to our newsletter. You can give this consent by ticking a separate checkbox.

BlackBelt processes the data collected in the course of contact until the purpose has been fulfilled – i.e. until the subject of the message (the question to which the sender expects an answer) can be considered settled – but no later than 1 year from the date the message was sent.

If you subscribe to the newsletter, we process your data until you unsubscribe.

The candidate or the person providing the data is solely responsible for the authenticity and accuracy of the personal data.

Legal basis for processing

For candidates:

The data subject's personal data are processed primarily on the basis of their voluntary consent under Article 6(1)(a) GDPR and on the basis of the Controller's legitimate interests under Article 6(1)(f) GDPR. The data subject gives consent by providing their data and accepting this privacy notice.

For persons contacting us:

The data subject gives voluntary consent by providing their data, ticking the checkbox and accepting this privacy notice.

If the data subject subsequently enters into a contract with the Controller, the legal basis for processing those personal data specified in the contract that are necessary for the performance of the contract will be Article 6(1)(b) GDPR.

Categories of data processed

For candidates:

Data provided in the CV (typically):

Name, photograph, date of birth, telephone number, email address, previous employers, education, skills, qualifications, hobbies, personal assessment.

For persons contacting us:

Data provided by you: name, email address, and any telephone number given in the message.

Possible consequences of failure to provide data

Providing your data enables us to offer you the appropriate service and to contact you. If you do not provide the data, this is not possible.

Data transfers

For candidates:

Where a CV is submitted for an open position, we may forward the candidate's CV to our partners following a personal or telephone consultation.

Should we wish to forward the candidate's data to another partner or for another position, we will inform the candidate separately in advance, and the candidate may object to the transfer by sending a message to the Controller.

We may share with potential clients a CV prepared from the submitted CV that contains no personal data; we will inform the candidate of this separately in advance. The candidate may object to the transfer by sending a message to the Controller.

Use of data processors; transfer of data to third countries (outside the EU)

The Controller is entitled to engage data processors to carry out its activities. Data processors make no independent decisions and may act solely in accordance with their contract with the Controller and the instructions received. The Controller monitors the work of its data processors. Data processors may engage further processors only with the Controller's consent.

For candidates:

Recruitee BV (Keizersgracht 313, 1016 EE Amsterdam, the Netherlands)

HubSpot CRM system (HubSpot Ireland Limited, One Dockland Central, Guild Street, Dublin 1, Ireland; HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA)

For persons contacting us:

HubSpot CRM system (HubSpot Ireland Limited, One Dockland Central, Guild Street, Dublin 1, Ireland; HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA)

Automated decision-making

No automated decision-making takes place in the course of processing.

Access to data and data security measures

Access to data and data transfers

The personal data provided by the data subject may be accessed by the Controller's employees to the extent necessary for the performance of their duties, in particular: Human Resources staff responsible for recruitment, for handling applications; sales colleagues, when presenting candidates to clients (in order to organise and deliver the service); and the legal representative, where this is necessary and indispensable in the given case.

The Controller may transfer personal data to public authorities only in exceptional cases, for example where court proceedings are initiated in a matter concerning the data subject and the court requires documents containing the data subject's personal data, or where the police contact the Controller and request documents containing the data subject's personal data for the purposes of an investigation.

In the course of their work, the Controller's employees ensure that personal data are stored and kept in such a way that they cannot be accessed, altered or destroyed by unauthorised persons.

Data security measures

The Controller takes the necessary technical and organisational measures and has established appropriate procedural rules to ensure the security of personal data throughout the entire processing.

The Controller selects and operates the IT tools used for processing personal data in such a way that the data processed: are accessible only to authorised persons (availability); have assured authenticity and authentication (authenticity of processing); can be verified as unaltered (data integrity); and are protected against unauthorised access (confidentiality).

The Controller protects the data by appropriate measures against accidental or unlawful destruction, loss, alteration, damage, unauthorised disclosure or unauthorised access; restricts access to personal data by assigning authorisation levels; protects its IT systems with firewalls and antivirus software; ensures in electronic processing that data are accessed only for specified purposes, under controlled conditions, and only by persons who need them to perform their duties; and, to protect the data files processed electronically in its various records, ensures by appropriate technical solutions that the stored data – unless permitted by law – cannot be directly linked to one another or attributed to the data subject.

Rights of data subjects and conditions for exercising them

The data subject may at any time request from the Controller access to, rectification or erasure of, or restriction of processing of their personal data, and may object to the processing of their personal data.

The data subject may also request comprehensive and specific information about the processing.

The data subject may also request that, in accordance with the applicable legislation, we provide their personal data in a structured, commonly used and machine-readable format, or transmit their data to another controller. The Controller will fulfil such requests within 1 month. The detailed content of data subjects' rights and the detailed conditions for exercising them are set out in the Controller's data processing policy.

Where processing is based on Article 6(1)(a) GDPR, consent may be withdrawn at any time; however, this does not affect the lawfulness of processing based on consent before its withdrawal.

Right to legal remedy

If the data subject considers that BlackBelt has infringed any statutory data protection requirement in processing their personal data, they may – in order to end the allegedly unlawful processing – lodge a complaint addressed to BlackBelt's representative by email at info@blackbelt.hu or dataprotection@blackbelt.hu, or by post; lodge a complaint with the supervisory authority (Hungarian National Authority for Data Protection and Freedom of Information – NAIH; address: Falk Miksa utca 9–11, 1055 Budapest; email: ugyfelszolgalat@naih.hu; website: www.naih.hu); or bring the matter before a court.

In that case, the data subject may freely choose whether to bring the action before the regional court (törvényszék) competent for their place of residence (permanent address), their place of stay (temporary address), or BlackBelt's registered office.

We would appreciate it if you contacted us first with your complaint, so that we can investigate and remedy it as soon as possible.