DATA PROTECTION POLICY

1. As part of our professional activities, WHINNS maintains a pool of CVs of those who voluntarily have provided us with that (i.e. active candidates). Passive candidates, on the other hand, are persons considered for a position without having actively applied. Passive candidates' data will be processed for recruitment purposes within 30 days of being gathered, not shared with any third party and deleted upon the lapse of 30 days.

2. WHINNS abides by the provisions and principles of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (i.e. the General Data Protection Regulation, GDPR).

​

3. The identity and the contact details of the controller: WHINNS Limited, Budapest, e-mail: info@whinns.com. WHINNS does not have a Data Protection Officer.

​

4. The GDPR requires WHINNS, acting as the data controller, to process data in accordance with the principles of data protection. These require that data shall be:

1. processed fairly, lawfully and in transparent manner,

2. processed for specified, explicit and legitimate purposes,

3. adequate, relevant and limited to what is necessary in relation to the purposes,

4. accurate and, where necessary, kept up to date,

5. not kept longer than necessary,

6. processed in accordance with the data subject’s rights

7. kept securely and

8. not transferred to countries outside the European Economic Area without adequate protection.

5. Personal data means data, which relates to a living individual who can be identified from the data or from the data together with other information, which is in the possession of, or is likely to come into possession of, WHINNS.

WHINNS will not process special categories of personal data (i.e. personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation) as well as personal data relating to any offence committed or alleged to be committed by the data subject, or to proceedings in relation to any offence and any sentence passed, unless it is necessary for the purpose specified in point 7 and data subject has given his/her explicit consent to the processing of those personal data for the said purpose.

6. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

7. WHINNS holds data on individuals for administration and processing of work-seekers personal data for the purposes of offering them suitable job at the partners of WHINNS meeting their preferences. For this purpose, WHINNS will analyse the data of the data subjects (profiling) by regularly filtering the data subjects.

8. Data may only be processed with the explicit consent of the person whose data is held. Users of WHINNS’ database can upload the data of their CVs and other documents only after giving their consent by ticking the appropriate checkbox after declaring that they have read and understood this Policy.

By instructing WHINNS to look for work and providing us with personal data contained in a CV, work-seekers will be giving their consent to processing their details for work-finding purposes. If WHINNS intends to use data for any other purpose, WHINNS will obtain your specific consent prior to doing so.

The data subject may withdraw his/her consent at any time by deleting his/her account. The withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

9. WHINNS will delete the personal data stored its database for 12 months after uploading unless the data subject, before the said deadline, instructs WHINNS to further process the data for another 12 months.

10. Based on the preferences of the data subjects marked when uploading their CVs, WHINNS will seek suitable jobs for the data subjects that meet the demand of the employers who charged WHINNS with recruitment.

In case of match, WHINNS will obtain the consent of the data subject to reveal his/her data to the employer.

11. Employers, on behalf of whom WHINNS seeks candidates, are from Western Europe, Israel, the United States, Canada and Australia. Western European countries are member states of the EU and are under the GDPR. Israel is such a third country which is considered as providing level of data protection adequate to the GDPR. Transfer of personal data to companies from the United States that accept and comply with the EU-US Privacy Shield regime, as well as transfer of personal data to commercial organisations from Canada are considered as fulfilling the “adequate level of data protection” and no further safeguard is requested to be in place. Australia does not provide adequate level of data protection, therefore transfer of personal data to Australia is possible only when the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards.

​

11. WHINNS ensures that adequate security measures are in place during the entire period of data processing in order to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, to prevent personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data transmitted, stored or otherwise processed, as well as to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident.

​

​

12. All data subjects have the following rights under the GDPR and in dealing with personal data these will be respected at all times:

1. right to request from the controller access to personal data (Article 15 of GDPR),

2. right to rectification or erasure of personal data (Article 16 and 17 of GDPR),

3. right to restriction of processing concerning the data subject (Article 18 of GDPR),

4. right to data portability (Article 20 of GDPR),

5. right to object to processing (Article 21 of GDPR),

6. right to lodge a complaint with Nemzeti Adatvédelmi és Információszabadság Hatóság (1125  Budapest, Szilágyi Erzsébet fasor 22/c).

7. WHINNS does not use any automated decision-making.