GDPR candidate privacy notice

Date: 29 May 2024

CONTENT:

PURPOSE OF THIS NOTICE
CONTACT DETAILS
CONTROLLER
DATA PROTECTION PRINCIPLES
THE DATA WE COLLECT
HOW IS YOUR PERSONAL DATA COLLECTED
PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA
FAILURE TO PROVIDE YOUR PERSONAL DATA
HOW WE USE SENSITIVE PERSONAL DATA
AUTOMATED DECISION MAKING
DATA SHARING
DATA SECURITY
DATA RETENTION
YOUR LEGAL RIGHTS

1. PURPOSE OF THIS NOTICE

1.1. This Privacy Notice sets out how we collect and use your personal data when you apply for a job vacancy or you send us your CV and/or cover letter and/or any other personal data relating to the recruitment process, and the choices available to you in relation to the use of your personal data (the “Privacy Notice”). This Notice is designed to help you understand our privacy practices, including what personal data we collect, why we collect it, what we do with it and how we protect it, as well as your individual rights. It also describes how you may contact us to learn more about our data practices or to exercise your rights.

1.2. It is important that any data we collect, and store is accurate. Therefore, if anything changes regarding your personal data during your relationship with us, please keep us informed.

1.3. We may change this Notice from time to time, to reflect how we are processing your data, and if we make changes, we will notify you by revising the effective date at the top of this Notice. If we make significant changes that materially affect your privacy rights, we will provide advanced notice and make that clear on the website, so that you are able to review the changes before you send us your CV and/or cover letter and/or any other personal data relating to the recruitment process.

1.4. If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact us using the details set out below in Clause 2 “Contact Details”.

2. CONTACT DETAILS

1 Iapetou, Agios Athanasios, 4101, Limassol, Cyprus

E-mail: dpo@asbis.com

Phone: +357 25 857 097 or +357 25 857 098

3. CONTROLLER

ASBISC ENTERPRISES PLC, a company registered under the legislation of the Republic of Cyprus, with registered number HE 75069, registered address: 1 Iapetou,4101, Agios Athanasios, Limassol, Cyprus (the “Company”, “We”, “Us” “Our”) and its affiliated companies, are the Data Controllers and responsible for your personal data. For the purposes of this Privacy Notice an affiliated company means an entity which, directly or indirectly, owns or controls, is owned or is controlled by or is under common ownership or control with another entity. As used herein, “control” means the power to direct the management or affairs of an entity, and “ownership” means the beneficial ownership of fifty percent (50%) or more of the voting equity securities or other equivalent voting interests of the entity.

4. DATA PROTECTION PRINCIPLES

4.1. We will comply with data protection law and principles, which means that your data will be:

used lawfully, fairly and in a transparent way.
collected only for valid purposes stated in this Privacy Notice and not used in any way that is incompatible with those purposes.
relevant to the purposes and limited only to those purposes.
kept only as long as necessary for the purposes we have communicated to you in this Privacy Notice.
kept securely as described in this Privacy Notice.

5. THE DATA WE COLLECT

5.1. When using the term “Personal Data” in our Privacy Notice, we mean data that relates to you and allows us to identify you, either directly or in combination with other data that we may hold. We collect, use, store and transfer different kinds of personal data grouped together as follows:

The personal data you have provided to us through your CV and Cover Letter (if applicable).
The personal data entered by you in SHL online system for psychometric assessment, meaning your name, email, address, gender (optional), language, demographic information (optional), responses to assessments or surveys (if applicable). If you don’t want us to process these data, please let us know. We do not mandate the provision of such personal data from you.
The personal data you have provided through our application form, including name, last name, title, email address, phone number, location, LinkedIn profile (If applicable).
Any information you provide during an interview. Including but not limited to title, date of birth, gender, employment history, qualifications, nationality, marital status.
Information about criminal convictions and offences, information about health, including any medical condition, health and sickness records (if applicable).
Any personal data provided by your referees (if applicable).

6. HOW IS YOUR PERSONAL DATA COLLECTED

6.1. We collect your personal data from the sources indicated below:

you, the candidate
our authorized third-party recruitment agencies, from which we collect personal data about you, including but not limited to name, title, address, telephone number, personal email address, date of birth, gender, employment history, references and qualifications.
your named referees, from whom we collect the following categories of data: full name, periods of previous employment, performance during previous employment.
from publicly accessible sources such as LinkedIn, Facebook etc., where we collect your full name, email, work history, and any other information available in your profile.

7. PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

7.1. We will use the personal data we collect about you for the following purposes:

communicate with you about the recruitment process.
carry out background and reference checks.
assess your skills, qualifications, and suitability for the position.
keep records related to our hiring process.
comply with legal or regulatory requirements.

7.2. After receiving your CV and cover letter (if applicable), we will process these data to decide whether you meet the basic requirements to be shortlisted for the position. If shortlisted, we will evaluate whether to extend an invitation for an interview. We may also conduct an online psychometric assessment which you have the right to deny. In case you don’t want us to conduct the psychometric assessment, kindly inform the recruiter or contact us using the details indicated at clause 2 above. If you are called for an interview, we will use the personal data you provide during the interview, to decide whether to offer the position to you. If we decide to offer you the position, we will take up references. We also carry out a criminal record check.

You provide us with your consent to process your personal data.

It is in our legitimate interest to decide whether to appoint you to a position since it would be beneficial to our business to appoint the appropriate candidate to that position.

We also need to process your personal data to decide whether to enter into a contract of employment or engagement with you.

8. FAILURE TO PROVIDE YOUR PERSONAL DATA

8.1. You are under no obligation to provide personal data to the Company during the recruitment process. However, if you do not provide your personal data, the Company may not be able to process your application properly or at all.

9. HOW WE USE SENSITIVE PERSONAL DATA

We will use your sensitive personal data in the following ways and only when permitted by applicable laws:

We will use your personal data about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example whether adjustments need to be made during a test or interview.

We will use your personal data about your nationality or ethnicity, to assess whether a work permit and a visa will be necessary for the role.

We will collect personal data about your criminal convictions history if we would like to offer you a role which is conditional on criminal background checks in order to make sure that there is nothing in your criminal convictions history which makes you unsuitable for the role. In particular, for roles that require a high degree of trust and integrity we may ask you to seek a basic disclosure of your criminal records history.

10. AUTOMATED DECISION-MAKING

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

11. DATA SHARING

We will only share your personal data with the following third parties for the purposes of processing your application: ASBISC affiliates.

12. DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, who have a business need-to-know and are under confidentiality.

13. DATA RETENTION

13.1. We will retain your personal data as indicated below:

Type of data:	Unsuccessful Candidates:	Successful Candidate:
Psychometric Assessment	We immediately delete them after rejection.	We store them based on the retention period for employee data.
CVs and Cover Letters	We delete them after 6 months following the rejection.	We store them based on the retention period for employee data.
Job Offer	We delete them after 6 months following the rejection.	We store them based on the retention period for employee data.

13.2. We retain your personal data for the above-mentioned periods so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal data in accordance with our data retention policy.

14. YOUR LEGAL RIGHTS

14.1. Under certain circumstances, you have rights under data protection laws in relation to your personal data.

14.2. Access. Request access to your personal data (commonly known as “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

14.3. Rectification, Portability, and Deletion of your Personal Data. You have the right to correct or update your personal data, object to the processing of your personal data, ask us to restrict processing of your personal data, or request the portability of your personal data. To protect the privacy and the security of your personal data, we may request data from you to enable us to confirm your identity and your right to access such data, as well as to search for and provide you with the personal data we maintain upon your request. There are instances where applicable laws or regulatory requirements allow or require from us to refuse to provide or delete some or all the personal data that we maintain.

14.4. Request erasure of your personal data. This enables you to request the deletion or removal of your personal data when there is no good reason for us to continue processing it. You also have the right to request for deletion or removal of your personal data when you have successfully exercised your right to object to processing (see below), where we may have processed your personal data unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons which will be communicated to you, if applicable, at the time of your request.

14.5. Object to processing of your personal data when we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data which override your rights and freedoms.

14.6. Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the accuracy of the personal data; (b) where our use of the personal data is unlawful but you do not want us to erase it; (c) where you need us to hold the personal data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to the use of your data but we need to verify whether we have overriding legitimate grounds to use it.

14.7. Request the transfer of your personal data to you or to a third party. We will provide to you, or to a third party of your choice, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated data which you initially provided consent for us to use or where we used the data to perform a contract with you.

14.8. Withdraw consent at any time when we rely on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

14.9. Lodging Complaints. If you believe we have infringed or violated your privacy rights, please contact us so that we may attempt to resolve any issues to your satisfaction. Notwithstanding the approaches of exercising your rights stated above, this is without prejudice to your right to lodge a claim or complaint to your data protection authority (more details on personal data protection authorities and their contact info can be found at https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en).

14.10. If you wish to exercise any of the rights set out above, please Contact us. We will aim to respond to you within 30 days from receipt of request. We will need to verify your identity before we are able to disclose any personal data to you.