PRIVACY NOTICE
On the personal data processing activities carried out by VERTIS in relation to its employee recruitment process, as well as information on the whistleblowing reporting possibility
Vertis Environmental Finance Ltd. (hereinafter referred to as “VERTIS” or “data controller”) in accordance with Article 13 and 14 of the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (“General Data Protection Regulation”, “GDPR” or the “Regulation”), hereby provides information relating to the personal data processing carried out in the context of its HR recruitment process.
Identity and contact details of the data controller
| Name of the controller: | Vertis Environmental Finance Ltd. |
| Seat of the controller: | Csörsz utca 45, 1124 Budapest, Hungary |
| Email: | privacy@vertis.com |
| Contact details of the data protection officer: | vertis@dataprotection.eu |
Purpose, legal basis and retention period of the processing, in relation to each category of personal data processed
| Purpose of data processing | Personal data processed | Legal basis | Retention period |
| Assessing the eligibility of the candidate to the relevant job and selecting the candidate | – Name, – Private contact details (email and phone number) – Position the candidate is applying for – Content of the professional CV, including all personal data indicated on it by the candidate – Other personal information the candidate shares with the purpose of being selected (eg salary demand, copy of diploma, etc) – References, if any – Data contained in the offer given by Vertis, if the candidate is selected – Where the BrainsFirst test result is used in the selection process, your performance capacities profile provided to us by BrainsFirst |
VERTIS’ legitimate interest in selecting the best candidate for the job (Art 6 (1) f) of the GDPR) | Three years after the selection process |
| Keeping information collected during the recruitment process | All your above listed data, collected during the selection process | VERTIS’ legitimate interest in the availability of necessary evidence in case enforcement of a legal claim is initiated (Art 6 (1) f) of the GDPR) | Three years after the selection process |
| Considering your application for further open positions (placing your application data into our “Candidate pool”) | All your above listed data, collected during the selection process | Your consent (Art 6 (1) a) of the GDPR) | Three years after the selection process, or until the withdrawal of the consent, if that is earlier |
| Hiring the selected candidate | – Details of the job conditions (starting date, position, working hours, gross salary, etc) – Job description – Personal data contained in the data sheet for the hiring process (address, mother’s maiden name, place and date of birth, tax ID, social security ID, ID card/passport number, education details, bank account number) |
Taking the necessary steps prior to entering into the employment (or other) contract the candidate shall be a party to (Art 6 (1) b) of the GDPR) | Three years from the end of employment (or other contractual) relationship |
In addition to the above, for executive and other positions, for which applicable legal regulation requires specific professional qualifications, clean criminal report, or sets out disqualification criteria based on conflict of interest, we also collect and process personal data relating to these criteria and documents certifying them, based on our legal obligations (Art. 6 (1) c) of the GDPR), set out in (Hungarian) Act CXXXVIII of 2007 on Investment Firms and Commodity Dealers, and on the Regulations Governing their Activities (with special regard to Articles 19, 22 to 24/A, 26-26/A and 110). In case of criminal records, our legal basis is, in addition to the legal obligation mentioned above, Article 10 of the GDPR. We keep copies of the relevant documents on the basis of our legitimate interest in the verifiability of our compliance with the relevant legal obligations, by the regulatory authority. Retention periods are adjusted to the possible audits we may receive in relation to such requirements.
Whistleblowing reporting possibility and relating data processing
Please be kindly informed, that based on Hungarian Act XXV of 2023 (“Whistleblowing system Act”), You are entitled to report to us information on any illegal act or omission (including what You may assume to be illegal) or any abuse you might experience in relation to the recruiting or hiring process. The personal data contained in such report which are indispensable for our investigation of the case, shall be processed by us on the basis of our legitimate interest to comply with the rules set out in the Whistleblowing system Act, with the purpose of conducting such investigation and remedying or putting an end to the illegal act, omission or abuse. Your data related to such report will be treated with the highest confidentiality in line with the requirements of the relevant act, shared only with the internal or external investigators or advisors appointed for that, all data not strictly necessary for the investigation will be deleted, and no third country transfer shall take place in relation to that. The data will be retained for the period necessary in relation to the investigation of the report or the steps taken in relation to remedying or putting an end to the illegal act, omission or abuse or in relation to our obligations to keep records of that for compliance with the Whistleblowing system Act.
You may report to our whistleblowing system through whistleblowing@vertis.com, in a written letter or in person in our office at the address above (if you write a letter please indicate on the envelope “WHISTLEBLOWING” in order to make sure it gets directly to the appointed officer), or on the phone number +36 1 445 3904.
Sources of personal data
The sources of the personal data are normally You as the data subject or, if you apply for a job through a recruitment agency, then the agency. If BrainsFirst testing is applied during the selection process, BrainsFirst is the source the results of the test.
Other information on our data processing
You are generally not obliged to provide us with the personal data detailed above, but please consider that we may not be able to assess your application and select you for the job position without them. Thus, consequences of failure to provide your data may be that VERTIS cannot enter into or maintain employment or other relationship with You, or has to reject your application. In case of not providing your private availabilities, we would not be able to communicate with you regarding your application. Provision of your personal data is a statutory requirement in respect to all those data which we are required to collect based on a legal obligation VERTIS is subject to in relation to the position you apply for.
Where the legal basis for the data processing is Your consent, You can withdraw the consent at any time; however, the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
For certain job positions, we ask you to take the BrainsFirst test in order to get a better picture of your general performance capacities. Please note that BrainsFirst acts in this respect as an independent data controller, not as an involved party (as data processor) to VERTIS. Please for the processing of your personal data by BrainsFirst, consult their privacy policy at https://www.brainsfirst.com/wp-content/uploads/2022/12/BrainsFirst-Privacy-Policy-Business-TWNL-1.pdf. We only have access to and use for our selection process your ‘Personal Brain Profile’ prepared and provided by BrainsFirst to us, after you have taken the test, which consists of BrainsFirst’s conclusions relating to your general performance skills such as your gathering, processing, executing and adapting capabilities. Your selection shall not be exclusively or dominantly based on your ‘Personal Brain Profile’, all your skills, experience, studies and other information relating to you, provided to us during the selection process, shall be duly taken into consideration in a fair process. No automated decision shall be made on the basis of your profile created by BrainsFirst.
Recipients of the personal data
In the context of the data processing activities referred to in this privacy notice, personal data shall be shared with the following addressees, in relation to the below detailed services VERTIS has engaged in order to be able to operate its systems and pursue its business activities. Most of such addressees, if they provide services to VERTIS, act as data processors providing the guarantees to implement appropriate technical and organisational measures in line with the rules of GDPR, in order to ensure protection of your data.
| Data category | Addressee | Activity or role which serves as grounds for the data sharing |
| All data contained in e-mail correspondence, Skype for business or Teams application. | Microsoft Ireland Operations Limited. | Cloud based system for e-mail correspondence, Skype for business and Teams application. |
| All data related to your application, if you apply through a recruitment agency or headhunter. | Relevant recruitment agency or headhunter. | Introducing you as candidate to VERTIS. |
| Data used for reporting obligations, procedures or audits by authorities and by the statutory auditor, with special regard to legal criteria relating to your position. | Supervisory or other authorities. | Compliance with legal (eg. reporting) obligations, supervisory audits or administrative procedures. |
| Data contained in documents necessary for enforcement of legal claims. | Legal advisors, courts. | Enforcement of legal claims. |
| Your application data for the selection process and your data necessary for establishing the employment (or other) relationship, if you are selected for a position. | BambooHR LLC (335 South 560 West Lindon, UT, USA). | Registering into the HR platform used by VERTIS. |
Data transfer to third countries
Data transfer to third countries is carried out by VERTIS in the following events, in relation to the involvement of the following service providers. The chart below also provides you with information regarding the safeguards applied in relation to such data transfers.
| Service provider / other addressee | Third country to which data are transferred | Safeguards for ensuring proper protection for the data | When does it happen? |
| BambooHR LLC | USA | Standard Contractual Clauses | Registering your information into our HR platform |
Automated decision making, profiling
Automated decision making, including profiling, does not occur in the context of the data processing referred to in this Privacy Notice.
Your rights in relation to our data processing activity
As a data subject, you can exercise
- the right to access;
- the right to rectification;
- the right to erasure (right to be forgotten);
- the right to restrict the processing
- the right to object to the processing of your personal data,
subject to the conditions as set out by the GDPR.
In addition, where the legal basis of the data processing is the performance (or preparation) of a contract You are to become a party to, or Your consent, You shall also have the right to data portability.
a) Right to access
You as data subject shall have the right at any time to request information whether your personal data are processed, and if so, in what manner such data are processed by the data controller, including the purposes of the processing, recipients to whom the personal data have been or will be disclosed, the source of information from where the data controller obtained such data, the retention period of such data, any right that they may have concerning the processing, and where personal data are transferred to a third country or any international organisation, you as data subject shall have the right to be informed of the appropriate safeguards relating to the transfer. When exercising the right of access, the data subject shall also be entitled to request copies of such data. In the event the data subject makes the request by electronic means, and unless otherwise requested by the data subject, the information shall be provided in an electronic form. If the right of access exercised by the data subject would affect adversely the rights and freedoms, in particular the business secrets or intellectual properties of others, the data controller shall have the right to refuse the request of the data subject to the extent necessary and proportionate. For any further copies of the above information requested by the data subject, the data controller may charge a reasonable fee that is proportionate to the related administrative costs.
b) Right to rectification
The data controller shall rectify or supplement the personal data of the data subject based on any related request from the data subject. Where there is any doubt concerning any rectified data, the data controller may call upon the data subject to adequately verify, preferably by an official document, the rectified data for the data controller. If the data controller has disclosed the personal data affected by such right to any other persons (i.e. to another recipient e.g. the data processor), the data controller shall inform such persons of the rectification of such data without delay, provided that it is not impossible or does not require a disproportionate effort from the data controller. At the request of the data subject, the data controller shall inform the data subject of the identity of these recipients.
c) Right to erasure (“right to be forgotten”)
Where You as data subject request the erasure of any or all of your personal data, the data controller shall have the obligation to erase those without undue delay, if:
- the data controller does not need the affected personal data in relation for the purposes for which they were collected or otherwise processed;
- processing was based on your consent, however, you have withdrawn your consent, and there is no other legal ground for the processing;
- processing was based on the legitimate interest of the data controller or a third party, however, You have objected to the processing, and there are no overriding legitimate grounds for the processing, except for objection to data processing for direct marketing purposes;
- the personal data have been unlawfully processed by the data controller, or
- the personal data have to be erased for compliance with a legal obligation.
If the data controller has disclosed the personal data affected by such right to any other persons (i.e. to another recipient e.g. the data processor), the data controller shall inform such persons of the rectification of such data without delay, provided that it is not impossible or does not require a disproportionate effort from the data controller. At the request of the data subject, the data controller shall inform the data subject of the identity of these recipients. The data controller shall not always be required to erase the personal data, in particular where e.g. the data processing is necessary for the establishment, exercise or defence of legal claims.
d) Right to restriction of processing
You as data subject may request restriction of processing in relation to your personal data where one of the following applies:
- the accuracy of the personal data is contested by the data subject, in this case restriction of processing shall be applied for a period enabling the data controller to verify the accuracy of the personal data;
- the processing is unlawful, but the data subject opposes the erasure of the data, and requests the restriction of their use instead;
- the data controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise and defence of legal claims; or
- the data subject has objected to the processing, in this case restriction of processing shall be applied until it is verified whether the legitimate grounds of the data controller override those of the data subject.
Restriction of processing means that such personal data shall not be processed by the data controller or shall, with the exception of storage, only be processed with the data subject’s consent, or in the absence of such consent the data controller may also process these data for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a member state of it. The data subject shall be informed by the data controller before the restriction of processing is lifted. If the data controller has disclosed the personal data affected by such right to any other persons (i.e. to another recipient e.g. the data processor), the data controller shall inform such persons of the rectification of such data without delay, provided that it is not impossible or does not require a disproportionate effort from the data controller. At the request of the data subject, the data controller shall inform the data subject of the identity of these recipients.
e) Right to object
Where processing of data concerning You as data subject is based on the legitimate interest of the data controller or a third party, You as data subject shall have the right to object to processing of data. The data controller shall not be obliged to accept such objection, unless the data controller demonstrates
- compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User, or
- that the data processing is related to the submission, enforcement or protection of the data controller’s legal claims.
f) The right to data portability
Right to data portability generally means that the data subject shall have the right to receive the personal data concerning him/her, which he/she provided to the data controller based on consent or on a contract, and are processed by the data controller by automated means (e.g. in a computer system), in a structured, commonly used and machine-readable format, and have the right to transmit those data to another controller, or the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
In addition to the above, as a data subject, you have the right to lodge a complaint with a supervisory authority, in particular in the member state of the EU of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. For a list of the data protection supervisory authorities, see https://edpb.europa.eu/about-edpb/about-edpb/members_en. You may also enforce your rights in court pursuant to the provisions of the GDPR and the Hungarian Civil Code or other legislation applicable to you.
Additionally, according to Art. 25 of the Hungarian Act CXII of 2011 on the right to informational self-determination and freedom of information, the close relative of the deceased data subject or the person authorized by the deceased data subject might exercise data subject rights as determined by that Act within 5 years from the date of the death.
How we handle your requests or questions in relation to our data processing activities
We shall provide information on the action taken on your questions or requests submitted to us relating to the processing of your personal data or to the exercise of your rights as data subject, without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests we receive. We shall inform You of any such extension within one month of receipt of the request, together with the reasons for the delay. If You make the request by electronic means, we shall also provide you our answer by electronic means where possible, unless otherwise requested by You. Should it be the case that we do not take action on your request, we shall inform You on that without delay and at the latest within one month of receipt of the request, explaining you the reasons for not taking action and on the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.
