Recruitment Privacy Policy

1. DATA CONTROLLER AND DEFINITIONS

With the present Recruitment Privacy Policy (hereinafter: “Policy”), IncepLabs Ventures Kft. (hereinafter: “Company” or “IncepLabs” or “We”) intends to ensure that it gathers, stores and handles data fairly, lawfully, transparently and with respect towards individual rights. This Policy applies to the recruitment procedure of IncepLabs and its affiliates. This Policy gathers the Company’s guidelines and principles for collecting, storing, using, processing and disclosing personal data regarding your job application procedure(s).

In this Policy, Data Subject or “you” means a person who applies to or has previously applied to a position at IncepLabs Ventures Kft. or any affiliate.

The processing and collection of personal data by the Company is in harmony with the directly applicable laws of the European Union and the provisions of Hungarian laws in effect. In case of personal data processing, the Regulation (EU) 2016/679 of the European Parliament and of the Council (hereinafter: “GDPR”; for relevant definitions please see Appendix No. 1), the Act CXII of 2011 on the Right to Informational Self-determination and Freedom of Information (hereinafter: “Freedom of Information Act”), furthermore the recommendations and the data protection practice of the Hungarian National Authority for Data Protection and Freedom of Information (hereinafter: “NAIH”) and the recommendations of the Article 29 Data Protection Working Party (hereinafter: “WP29”) shall apply.

During the recruitment process we process your personal data provided by you during the application procedure, especially in your curriculum vitae and cover letter. During the tests and interviews we may obtain further information about you that can potentially constitute personal data. The Company will keep the received personal data confidential and takes all necessary steps to secure data processing. As IncepLabs determines the purposes and means of the processing of any personal data collected or received from you, the Company is a data controller of any personal data described in this Policy. You are the data subject related to the personal data that the Company receives during the application procedure.

2. SCOPE OF PROCESSED DATA, PURPOSE, LEGAL BASIS OF DATA PROCESSING, THE PERIOD FOR WHICH THE PERSONAL DATA IS STORED

No automated individual decision-making or profiling is performed in the course of the data processing of the Company concerning the applicants.

3. RECIPIENTS OF THE PERSONAL DATA

The visibility of personal data is restricted and will be accessible only by the relevant people at IncepLabs who are taking care of your application. Except as expressly described below, we neither rent nor sell your information to third parties or non-affiliated companies. We may share your information only when we have your permission.

The Company may request data processing service for processing the personal data. During the service of data processing, the data processor shall abide under the present Policy, relevant legislations in force, furthermore the provisions of the existing contracts of the Company.

In order to fulfil its purposes as a data controller, IncepLabs cooperates with the data processors listed below. IncepLabs reserves the right to change the data processors at any time.

If the applicant does not directly apply for a position at the Company (that is, for example through a recruitment agency or through a temporary employment agency or a student labour association) then the Company may collect certain data from these sources as well, and will handle these data in line with this Policy.

4. DATA SECURITY

IncepLabs observes all applicable regulations regarding the security of personal data, therefore both IncepLabs and its authorized data processors implement appropriate technical and organizational measures to protect personal data, and establish adequate procedural rules to enforce the provisions of the GDPR and all relevant local laws concerning confidentiality and the security of data processing.

5. RIGHTS OF THE DATA SUBJECT

6. RIGHTS AND ENFORCEMENT

6.1. Any personal information which you provide for IncepLabs must be true, complete, and accurate in all respects. You agree to notify us of any change in your personal information via IncepLabs’s email address specified in Section 1 without delay.

6.2. The Data Subject may exercise the following rights in relation to IncepLabs’s data processing activities:

• request information on and have access to his/her personal data being processed;
• request the rectification of his/her personal data;
• request the deletion of his/her personal data or restriction of the processing of his/her personal data;
• object to IncepLabs’s data processing;
• request data portability.

6.3. Right to get information and to have access to personal data being processed:

The Data Subject has the right to obtain confirmation from IncepLabs as to whether or not personal data concerning him or her are being processed, and, if that is the case, to have access to the personal data and the following information:

1. the purposes of the data processing;
2. the categories of personal data concerned;
3. the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations;
4. if possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
5. the Data Subject’s right to request from IncepLabs the personal data’s rectification, erasure or the restriction of their processing if these personal data are related to the Data Subject or the Data Subject’s right to object to such data processing;
6. the right to lodge a complaint with a supervisory authority;
7. if the personal data are not collected from the Data Subject, any available information as to their source;
8. the existence of automated decision-making, including profiling, and at least in these cases meaningful information about the logic involved, as well as the significance and the envisaged consequences of such data processing for the Data Subject.

If personal data are transferred to a third country or to an international organization, the Data Subject shall be informed of the appropriate safeguards relating to the data transfer.

IncepLabs provides the Data Subject with a copy of his or her processed personal data. For any further copies requested by the Data Subject, IncepLabs may charge a reasonable fee based on administrative costs. If the Data Subject submits the request by electronic means, the information shall be provided in a commonly used electronic form, unless otherwise requested by the Data Subject.

The right to obtain a copy referred to in the previous paragraph shall not adversely affect the rights and freedoms of others.

The rights mentioned above can be exercised through the IncepLabs contact details indicated in Section 1.

6.4. Right to data portability:

The Data Subject has the right to receive personal data concerning him or her, which he or she has provided to IncepLabs, in a structured, commonly used and machine-readable format and has the right to transmit those data to another data controller without hindrance from IncepLabs, if the data processing is based on consent or on a contract and the processing is carried out by automated means.

When exercising the right to data portability defined above, the Data Subject shall have the right to have the personal data transmitted directly from one controller to another, if it is technically feasible.

Exercising the right to data portability is without prejudice to the right to erasure (“right to be forgotten”).

The right to data portability shall not adversely affect the rights and freedoms of others.

6.5. Right to rectification:

Upon the request of the Data Subject, IncepLabs will rectify any inaccurate personal data related to the Data Subject without undue delay. Considering the purposes of the data processing, the Data Subject has the right to have his or her incomplete personal data completed, including by providing a supplementary statement.

6.6. Right to erasure (“Right to be forgotten”):

The Data Subject has the right to request the erasure of personal data concerning him or her and IncepLabs shall comply with this request without undue delay if any of the following reasons exists:

1. the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
2. the Data Subject withdraws his or her consent on which the data processing is based, and if there is no other legal ground for the data processing;
3. the Data Subject objects to the data processing and there are no overriding legitimate grounds for the data processing, or if the personal data are processed for direct marketing purposes;
4. the personal data have been unlawfully processed;
5. the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which IncepLabs is subject;
6. the personal data have been collected in relation to the offer of information society services.

Erasure of data cannot be initiated if data processing is necessary:

1. for exercising the right of freedom of expression and information;
2. for compliance with a legal obligation which requires processing by Union or Member State law to which IncepLabs is subject to or for the performance of a task carried out in the public interest;
3. for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, for medical diagnosis, for the provision of health or social care or treatment or for the management of health or social care systems and services, on the basis of Union or Member State law or pursuant to contract with a health professional and if those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies;
4. for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the Data Subject, in particular as for professional secrecy;
5. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, if the right of erasure would make such data processing impossible or would seriously jeopardize such data processing¹; or
6. for the establishment, exercise or defence of legal claims.

6.7. Right to restrict data processing:

The Data Subject has the right to request the restriction of data processing concerning him or her from IncepLabs, and IncepLabs shall comply with this request without undue delay if any of the following reasons exists:

1. the accuracy of the personal data is contested by the Data Subject, in this case restriction is related to a period enabling IncepLabs to verify the accuracy of the personal data;
2. the data processing is unlawful and the Data Subject opposes the erasure of the personal data and requests the restriction of their use instead;
3. IncepLabs no longer needs the personal data for the purposes of the data processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
4. the Data Subject has objected to data processing based on public interest or legitimate interest, in this case restriction is applied for a period in the course of which it can be verified whether the legitimate grounds of IncepLabs override those of the Data Subject.

If processing has been restricted according to the above, such personal data shall, with the exception of storage, only be processed with the Data Subject’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

A Data Subject who has obtained restriction of data processing according to the above shall be informed by IncepLabs before the restriction of data processing is lifted.

6.8. Right to object:

The Data Subject has the right to object, on grounds relating to his or her particular situation, at any time to the processing of personal data concerning him or her, if the legal ground of data processing is to perform a task carried out in the public interest or in the exercise of official authority vested in a data controller, or the data processing is necessary for the purposes of the legitimate interests pursued by a data controller or by a third party, including profiling based on these provisions. IncepLabs shall no longer process the personal data unless it can demonstrate compelling legitimate grounds for the data processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defence of legal claims.

6.9. Procedure in the event of a request submitted by the Data Subject:

IncepLabs provides information to the Data Subject on any action taken upon the Data Subject’s request related to the rights defined in this Policy without undue delay and in any event within one month of receipt of the request. This period may be extended by two further months where necessary, considering the complexity and number of the requests. IncepLabs informs the Data Subject of any such extension within one month of receipt of the request, with the reasons for the delay. If the Data Subject makes the request by electronic means, IncepLabs will provide the information by electronic means where possible, unless otherwise requested by the Data Subject.

If IncepLabs does not act on the Data Subject’s request, IncepLabs informs the Data Subject without delay and at the latest within one month of receipt of the request of the reasons for not acting and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

Any and all information and communication requested by the Data Subject are provided by IncepLabs free of charge, unless requests from the Data Subject are manifestly unfounded or excessive, in particular because of their repetitive character. In this case, IncepLabs may either charge a reasonable fee considering the administrative costs of complying with the request or refuse to act on the request.

IncepLabs shall communicate any rectification or erasure of personal data or restriction of data processing carried out by IncepLabs to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. IncepLabs shall inform the Data Subject about those recipients if the Data Subject requests it.

6.10. You may lodge a complaint about the processing of your personal data to the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság – NAIH; address: H-1055 Budapest, Falk Miksa utca 9-11; postal address: 1363 Budapest, Pf.: 9.; phone: +36-1-391-1400; facsimile: +36-1-391-1410; email: ugyfelszolgalat@naih.hu) or to the data protection authority of your home country or country of your residency.

6.11. Independently from lodging a complaint to NAIH, you may turn to court pursuant to the provisions set forth in the Privacy Act if your rights are infringed. Upon your decision, the procedure may be launched before the tribunal in whose jurisdiction you are domiciled or you have a temporary address. Prior to initiating a legal procedure, it may be useful to discuss the complaint with IncepLabs.

6.12. Your detailed rights and remedies are set out in subsections 14–18 and 21–23 of the Privacy Act and in Articles 15–21 of the GDPR.