Recruitment Privacy Policy
RADAYDRUG Ltd. (hereinafter referred to as the “Company” or “we”) is committed to the protection of personal data. The purpose of this Privacy Notice is to provide applicants with clear and understandable information on how we process personal data during the recruitment and selection process and on the rights available to you as a data subject.
In the course of processing personal data, we apply, in particular, the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
1. Details of the Data Processer
Data Processer: RADAYDRUG Kft.
Address: 4225 Debrecen, Rózsavölgy utca 151.
Company Registration Number: 09-09-008329
Contact Details of the Company’s Internal GDPR Coordinator:
Edina Csepregi
Tel.: 06 30 / 254 44 45
E-mail: edina.csepregi@radaydrug.com
Contact Details of the Company’s Data Protection Officer (DPO):
Edit Ágota Szűcs, LL.M.
Tel.: 06 30 / 856 40 89
E-mail: adatvedelemdebrecen@gmail.com
The data subjects may primarily contact the Company’s internal GDPR coordinator with any questions relating to data processing or the exercise of their rights. Data subjects are also entitled to contact the Data Protection Officer directly.
2. What personal data do we process and from what sources do we obtain them?
For the purposes of conducting the recruitment and selection process, the Company processes personal data only to the extent necessary and proportionate for the relevant purpose.
Application data: Name, contact details (e-mail address and telephone number), place of residence or temporary residence (where provided by the applicant), information contained in the curriculum vitae (in particular education, professional experience and skills), cover letter, salary expectations (if provided), the date of the application, and the title of the position applied for.
Reference information: Where reference checks are carried out during the recruitment process, the Company may process the name, position and contact details of the reference provider, as well as information relating to the applicant’s professional suitability. Reference checks shall only be conducted after the applicant has been informed in advance.
Sources of personal data: Personal data are obtained primarily directly from the data subject, for example through applications submitted by e-mail, job portals, or during in-person or online interviews. In certain cases, personal data may be obtained from recruitment agencies. Furthermore, during the recruitment process, where justified and taking into account the nature of the position concerned, the Company may review information available on an applicant’s publicly accessible social media profiles, particularly professional networking platforms. Such review shall be limited exclusively to professionally relevant information related to the position to be filled and shall not be intended to obtain information concerning the applicant’s private life. The Company does not request access to private or restricted profiles and does not use deceptive methods to obtain information.
3. Do we process special categories of personal data?
The Company does not request the provision of special categories of personal data, in particular information relating to health data, political opinions, religious or philosophical beliefs, trade union membership, or any other category of data referred to in Article 9 GDPR.
If application materials nevertheless contain such information, the Company will not take it into consideration during the recruitment process and will ensure that it does not form the basis of any recruitment or selection decision.
The Company seeks to avoid the use of such data, restrict access to them, and, where possible and appropriate, delete or redact them (for example, from a curriculum vitae).
Applicants are kindly requested, where possible, not to include or share special categories of personal data as part of their application materials.
4. Purpose and legal basis of processing
We process personal data for the following purposes:
4.1. Processing applications and conducting the recruitment process
This includes the review and assessment of applications, communication with applicants, arranging interviews, evaluating candidates’ suitability for the position, and making recruitment and selection decisions.
Legal basis: The legitimate interests of the Company pursuant to Article 6(1)(f) GDPR.
The Company’s legitimate interest is to identify and select a suitable candidate for the advertised position and to conduct the recruitment process in an efficient, transparent and properly documented manner.
In carrying out such processing, the Company ensures that the processing of personal data does not result in an unjustified interference with the rights and freedoms of applicants and is limited solely to what is necessary for conducting the recruitment and selection process.
4.2. Communication in connection with the application
This includes informing applicants about the status of the recruitment process, arranging interview dates, and requesting any missing information or documentation where necessary.
Communication shall be limited strictly to what is necessary for conducting the recruitment process.
Legal basis: The Company’s legitimate interest pursuant to Article 6(1)(f) GDPR – the reasonable and efficient conduct of the recruitment and selection process.
4.3. Applicant database for future opportunities
Where no employment relationship is established following the recruitment process, the Company may offer applicants the opportunity to have their application materials considered for future positions that may be relevant to them, based on the applicant’s separate consent.
Legal basis: The data subject’s consent pursuant to Article 6(1)(a) GDPR.
The provision of consent is voluntary, requires a separate declaration, and refusal to provide consent shall not affect participation in the recruitment process.
Consent may be withdrawn at any time by sending an e-mail to the internal GDPR coordinator. Such withdrawal shall not affect the lawfulness of processing carried out prior to the withdrawal.
The Company shall retain the application data for a maximum period of 1 year from the date consent is provided.
4.4. Legal claims, disputes and complaint handling
Where a legal claim, complaint or regulatory proceeding arises in connection with the recruitment process, the Company may retain and use certain personal data to the extent necessary for the establishment, exercise or defence of legal claims.
Legal basis: The Company’s legitimate interest pursuant to Article 6(1)(f) GDPR – the establishment, exercise and defence of legal claims, and, where applicable, compliance with a legal obligation pursuant to Article 6(1)(c) GDPR where a request is received from a court or other authority.
The Company shall retain personal data only for the period necessary to establish, exercise or defend the relevant legal claim and, in any event, no longer than the applicable statutory limitation period.
5. How long do we retain personal data?
The Company processes personal data only for as long as necessary, taking into account the purpose of the processing and any applicable limitation periods for legal claims.
In the case of an unsuccessful application (where the applicant has not consented to further processing of his or her data): personal data shall be retained for 6 months following the closure of the recruitment process. Upon expiry of this period, the data shall be deleted or anonymised.
Where personal data are retained in the applicant database: personal data shall be processed for a maximum period of 1 year from the date consent is provided or from the closure of the recruitment process, or until consent is withdrawn, whichever occurs first. Upon expiry of the retention period, the data shall be deleted.
Where the applicant is hired: the data processed during the recruitment process may become part of the employment documentation associated with the establishment of the employment relationship. Information regarding the processing of employee data is provided by the Company in a separate Employee Privacy Notice.
Due to technical characteristics of information systems (for example, backup copies), certain data may remain stored in backup systems for a limited period after deletion. Such data are not actively accessible and are retained solely for data security purposes. They are permanently deleted when the relevant backup cycle is overwritten.
6. Who has access to your personal data and to whom are they disclosed?
Access to personal data shall be restricted exclusively to authorised personnel involved in the recruitment and selection process, including, in particular, the Managing Director, employees responsible for HR-related functions, professional managers and other individuals participating in the decision-making process, and only to the extent necessary for the performance of their duties.
For the purpose of carrying out certain technical and organisational activities, the Company may engage data processors who process personal data on behalf of and under the instructions of the Company, subject to appropriate contractual and data security safeguards, including in particular:
- providers of e-mail and office productivity systems (e.g. Microsoft 365),
- hosting and cloud service providers,
- operators of job portals or applicant tracking systems,
- providers of information technology operations and system administration services,
- recruitment agencies or executive search service providers (where the application was submitted through such channels).
The Company shall disclose personal data to public authorities, courts or other competent bodies only where required by law or where necessary for the establishment, exercise or defence of legal claims.
7. Automated Decision-Making and Profiling
The Company does not make recruitment decisions solely by automated means and does not apply any automated decision-making that would produce legal effects concerning the data subject or similarly significantly affect the data subject.
No profiling is carried out during the recruitment process, and all decisions are made with human involvement.
8. Your rights and how to exercise them
In accordance with the GDPR, you are entitled to the following rights in relation to the processing of your personal data:
- to request information about how your personal data are processed and to obtain access to your personal data,
- to request the rectification or completion of your personal data,
- to request the erasure of your personal data or the restriction of processing,
- to object to the processing where the legal basis for processing is the Company’s legitimate interest,
- to withdraw your consent at any time where processing is based on consent,
- to request the portability of your personal data where the applicable legal conditions are met.
The Company shall respond to requests without undue delay and, in any event, within one month of receipt of the request.
Prior to fulfilling a request, the Company may verify the identity of the data subject.
Objection to Processing Based on Legitimate Interest: where you object to the processing of your personal data, the Company will assess whether there are compelling legitimate grounds for the processing that override your interests, rights and freedoms, or whether the processing is necessary for the establishment, exercise or defence of legal claims.
9. Data security
The Company implements appropriate technical and organisational measures to protect personal data and to ensure that personal data are accessible only to authorised persons and are safeguarded against unauthorised access, alteration, transfer, disclosure, deletion or destruction.
The measures applied include, in particular, access rights management, restriction of access on a need-to-know basis, logging of activities (where relevant), the use of encrypted communication channels, the implementation of backup procedures, and confidentiality obligations imposed on employees.
The Company determines the technical and organisational measures to be applied taking into account the nature, scope, context and risks of the processing activities and reviews such measures on a regular basis.
10. Complaint and remedies
If you believe that the processing of your personal data does not comply with applicable legal requirements, we recommend that you first contact us through the contact details of the Internal GDPR Coordinator, and we will make every effort to resolve the matter.
You have the right to lodge a complaint with the supervisory authority:
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9–11, Hungary
Postal Address: 1374 Budapest, Pf. 603
Telephone: +36-1-391-1400
E-mail: ugyfelszolgalat@naih.hu
Website: www.naih.hu
You also have the right to seek a judicial remedy if your rights relating to the processing of your personal data have been infringed. Proceedings may be initiated, at your choice, before the competent regional court having jurisdiction over your place of residence or habitual residence.
11. Amendments to this Privacy Notice
The Company reserves the right to review and amend this Privacy Notice from time to time where necessary.
The current version of the Privacy Notice is available on the Company’s website at www.radaydrug.hu
The amended Privacy Notice shall become effective on the date of its publication.
Where material changes are made to this Privacy Notice, the Company shall inform data subjects of such changes in an appropriate manner.