Information notice on the processing of candidates' personal data

Information notice on the processing of candidates' personal data

I. The controller and its contact details; contact details of the Data Protection Officer

The company INOVUM S.R.L., with its registered office in Sântion 171D, Borș commune, Bihor county, registered with the Trade Register Office attached to the Bihor Tribunal under no. J2011000660055, tax code RO28310745 (“INOVUM”),

acting as controller and hereinafter referred to as “the Controller” or INOVUM (SRL),

with, as its dedicated contact for matters relating to the processing of personal data, the e-mail address gdpr@inovum.ro, or the address of the registered office mentioned above, marking the envelope, please, “For the attention of the Data Protection Officer” for correspondence on paper/by courier or post,

and a contracted Data Protection Officer, who can be contacted in the ways mentioned above,

• in accordance with the provisions of Regulation No 679 of 27 April 2016 of the European Parliament and of the Council of the European Union on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – “GDPR”),
• on the basis of the principles of fairness and transparency

informs you of INOVUM's policy on the processing and protection of the personal data of candidates for a position at INOVUM, as follows:

II. Categories of data subjects

These are persons who apply for a position at INOVUM through the “Careers” page of the INOVUM website; persons contacted by, or interacting with, recruitment companies which, in turn, are engaged for this purpose beforehand or afterwards by INOVUM; persons who make known their availability for a change of job/a new professional activity and are contacted for this purpose by INOVUM; persons who upload their CVs/professional summaries/cover letters to a recruitment platform accessed by INOVUM; and others of the kind.

III. The categories of personal data that the Controller processes in relation to candidates are mainly:

A. in the first part of the recruitment process:

1. personal contact and general identification data such as surname and first name and, to the extent that they are made available to the Controller, usually by the candidate, possibly also home address, residence, date of birth, telephone number and e-mail address, nationality, citizenship, the signature acknowledging the Information Notice and/or on the form of consent to the storage of data for recruitment purposes and after recruitment;
2. information allowing the eligibility and selection conditions of the recruitment process to be checked: educational documents (e.g. baccalaureate diploma, bachelor's degree, master's degree, doctorate, etc.), professional certificates/attestations or attestations issued by regulatory authorities, specific qualifications/attestations, residence visas, references, interview notes, records/results of pre-employment checks, information included in the Data Subject's CV and/or in any application forms;
3. for candidates who interact with one of the Controller's locations during this process, also data collected through video surveillance of the access routes into/out of the Controller's premises concerned — video cameras used for the safety and security of access, for the guarding and protection of property and of persons and to deter incidents in this respect, where applicable and if relevant images are still stored, and for the use of those images for investigations and legal proceedings;
4. information on and data resulting from the professional examination of the Data Subject: references, interview notes, records/results of checks on the Data Subject, professional experience, performance analyses and evaluations, performance improvement plans and related correspondence (during the recruitment process, the Data Subject will take general and/or specific tests, in line with the requirements of the position concerned, and will take part in discussions/interviews with the company's employees about the Data Subject's level of preparation in relation to the requirements of the position/field concerned, with the aim of identifying and selecting the most suitable candidate. The results of the general and/or specific tests, those of the interviews and the discussions held will be used by the Controller exclusively for the purpose of identifying and selecting the most suitable candidates);
5. information on remuneration: such as that in the job offer and data on the proper payment of contributions to the state budget by the previous employer;
6. information on health, in general terms and only when necessary: information about the Data Subject's general medical condition, details of any disabilities or work restrictions;
7. data on the Data Subject's discipline at work: information about any behaviour of the Data Subject in the working environment and/or disciplinary proceedings in which they have been involved;
8. and, where the Controller and the candidate reach an advanced stage of the recruitment process, namely the communication of an offer with a view to contracting, the identity card or passport will also be requested for this purpose, together with data such as the personal identification number (CNP), the series and number of the identity card/passport, the personal e-mail address and/or other necessary identification data.

IV. Purposes for which the Controller processes personal data

1. receiving/taking over and analysing, including through internal consultation/with the managers involved, applications for open positions, CVs, professional summaries, and information received and/or stored from candidates, from recruitment firms, through recruitment platforms, etc.;
2. scheduling and conducting interviews, and drawing up and/or analysing the shortlist of the Data Subjects who come closest to the requirements of the open position;
3. preliminary examination of the Data Subject's right to work/work permit in Romania;
4. carrying out the other stages of the process of selecting and recruiting Data Subjects with a view to employment;
5. the Controller's final decision on hiring the Data Subject, and the giving of positive/negative feedback;
6. drawing up the job offer in the event of positive feedback and then communicating the offer;
7. collecting and storing the consent of candidates not hired who have chosen to have the Controller keep their professional summaries and/or contact details for future recruitment, and the purpose of proving that this Information Notice was communicated;
8. deleting the data of the Data Subjects who did not receive an offer, and keeping the personal data of the Data Subjects who have consented to their data being kept for the Controller's future recruitment (without, however, such retention giving rise to any obligation on the Controller to select or contract with the candidate);
9. reporting to competent authorities and bodies, where required by law/where applicable;
10. reporting to/communicating with authorities/institutions with powers of control/supervision/monitoring, where applicable under the relevant legal provisions;
11. video surveillance of the access routes into/out of the Controller's premises with which candidates interact, if the interview takes place there, for the safety and security of access, for the guarding and protection of property and of persons and to deter incidents in this respect, where applicable and if relevant images are still stored, and for the use of those images for investigations and legal proceedings;
12. preserving the Controller's right of defence (in the event of any disputes).

V. The legal grounds for the Controller's processing mentioned above are, as the case may be:

• the Controller's legitimate interest;
• compliance with a legal obligation to which the Controller is subject;
• the Data Subject's consent, where applicable and if the Data Subject decides to give it;
• taking steps with a view to concluding an employment contract with the candidate who receives an offer to that effect.

If you also interact with INOVUM by telephone, the call may be recorded for the purpose of analysing its content with a view to improving how INOVUM SRL employees interact with the people they speak to; in exceptional cases the recording may also be used in legal proceedings and in defence of INOVUM's own rights and legitimate interests. The legal ground for this processing is legitimate interest; the recording is not stored for more than 30 days and is deleted automatically within that maximum period, with the exceptions justified under the law.

If you choose to send the Controller a petition and/or a request to exercise your rights, or the like, the Controller will process the data contained in that petition/request, mainly in order to receive it, handle it internally and then communicate its reply/solution to you, to fulfil the legal obligations incumbent on it and/or to defend and exercise its own rights and legitimate interests. The legal grounds for this processing are, as the case may be, INOVUM's legitimate interest or the legal obligation to reply where the reply is required by law. The petition/request will normally be stored for the necessary period and the applicable limitation period and/or archived for the period provided by law.

VI. Source of the personal data

As a rule, INOVUM collects the personal data needed for recruitment directly from the Data Subject. However, for processing for recruitment purposes, it may also collect/receive data from recruitment companies, from the databases of recruitment platforms, from authorised third parties who communicate their recommendations in accordance with the law, from public information, from authorised available information from social media accounts, and others of the kind.

VII. Confidentiality of the processing and the means of processing used by the Controller

(i) The Controller assures and guarantees data subjects that it respects the confidentiality of the personal data processed, including by putting in place technical and organisational measures to protect them.

(ii) The means of processing used by the Controller are usually mixed (that is, technical, automated, but also manual). At the date hereof, the Controller does not use new technologies such as biometric technologies, Artificial Intelligence or the like, specifying, however, that for the location (if your interview takes place there) where the Controller uses surveillance cameras, also for guarding and protection purposes, its supplier declares Artificial Intelligence algorithms for recognising the shape of the human body — a system that triggers alerts when it detects movement/human presence according to the algorithm above, the alert in turn automatically triggering recording by the video surveillance cameras.

VIII. Possible recipients of your personal data

In general terms, categories of recipients are the natural persons or legal entities to whom your personal data, processed in at least one of the processing cases above, may be disclosed. Thus, for example, to the extent necessary, and within the limits of what is needed to carry out the services/activity concerned for INOVUM or to fulfil a legal obligation, etc., they may reach:

• a) (internally) natural persons employed by INOVUM who need to process the personal data concerned (referred to as persons authorised for this purpose);
• b) (outside the company) service companies, authorised natural persons, etc., engaged by the Controller for technical or specialist support services (for example recruitment companies, consultants, etc.);
• c) (outside the company), where required in exceptional situations, the Data Protection Officer engaged by the Controller;
• d) (outside the company) companies providing the Controller with various other technical, operational or similar support services, such as cloud services, document archiving, other similar processing services, IT&C services, companies managing security, guarding and access protection at INOVUM's locations, courier service providers, and others of the kind;
• e) (outside the company), when and if required under the applicable legal provisions, authorities to which the data must be communicated in order to fulfil an obligation laid down by law, by a regulation or by EU rules (e.g. ANAF, ITM, etc.).

IX. Information on the transfer of data outside the EEA

INOVUM has contracted specialist services for data stored electronically online/in the cloud, for which INOVUM uses the services of a specialised provider based in Romania (but with subcontractors in the EU/EEA, and also in third countries such as the USA).

For the avoidance of doubt, INOVUM has concluded a Data Processing Agreement with that provider in accordance with the requirements of Art. 28 of the General Data Protection Regulation.

X. Duration of the processing of personal data

We store your personal data for as long as is necessary to carry out our recruitment activity and/or for other purposes such as complying with legal obligations, resolving any petitions, being able to respond to supervisory and control authorities, and others of the kind. Because these needs may vary, the actual retention periods may vary significantly. The criteria used to determine retention periods generally include:

• the duration of the recruitment;
• the period for which you have given your consent, if the processing is based on consent, noting that the consent form/proof itself and the proof of access to the Information Notice will be kept for up to a further 4 (four) years after that, given the applicable statutory limitation period;
• other applicable limitation periods, under Romanian legislation in force;
• the archiving periods imposed by specific legislation, where applicable;
• other relevant periods for which the Controller needs to store the data, such as data needed for investigations under the law, pending cases, and others of the kind.

XI. The data subject's rights and how to exercise them

The data subject has the following rights regarding their personal data processed by INOVUM as Controller:

• the right to be informed;
• the right of access to their personal data;
• the right to rectification and completion of their personal data;
• the right to erasure of their personal data (“the right to be forgotten”) (there may, however, be situations in which the Controller cannot act on the request to erase the data, in accordance with the exceptions set out in Art. 17 of the General Data Protection Regulation);
• the right to restriction of processing of their personal data;
• the right to portability of their personal data (Art. 20 of the General Data Protection Regulation), that is, the right to receive the personal data you have provided in a structured, commonly used and machine-readable format, in accordance with the General Data Protection Regulation;
• the right to object;
• the right to withdraw consent, where it has been given for any processing (Art. 7(3) of the General Data Protection Regulation).

Note: For the avoidance of doubt, we state that we do not take decisions about the natural persons mentioned in this Notice based solely on automated processing, nor do we profile them.

You may exercise your rights regarding your personal data, in accordance with the provisions of the General Data Protection Regulation, towards INOVUM as Controller, by sending a written request to that effect to the e-mail address gdpr@inovum.ro, or to the address of INOVUM SRL's registered office, marking the envelope, please, “For the attention of the Data Protection Officer” (for correspondence on paper/by courier or post).

You also have the right to lodge a complaint and/or to bring an action before the competent court. Any complaints about the protection of personal data may be addressed to the National Supervisory Authority for Personal Data Processing (A.N.S.P.D.C.P.), with its office at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, in the form of a written letter, at the institution's office or by e-mail to anspdcp@dataprotection.ro.