INFORMATION ON THE PROCESSING OF PERSONAL DATA – CANDIDATES
G.I. Group EOOD and Wyser EOOD (hereinafter referred to as the “Controllers” or the "Companies"), part of the Gi Group Holding group (hereinafter referred to as the “Group”), wish to provide you with information on the processing of personal data provided by candidates of legal age.
1. PROCESSING ACTIVITIES PURPOSES AND LEGAL BASES
1.1. Your data shall be obtained in the following ways:
1. when registering in the personal area of the website (“MyGigroup”, “MyWyser”)
2. by e-mail
3. through our agents/recruitment consultants of Gi Group/Wyser
4. through external websites or social networks
1.2. Your data is processed for the purposes of registering in MyGigroup/MyWyser.
1.3. The legal basis applicable to the processing of your personal data for the purposes described in point 1.2 is the performance of a contract with the Controllers, pursuant to Article 6(1)(b) GDPR.
1.4. Your data will be processed if you apply for a specific vacancy notice and when submitting a spontaneous job application for the purpose of searching for and selecting candidates, and more precisely for the following purposes:
a. your employment as a temporary worker in our client company
b. your direct hiring in a third-party company
c. your direct hiring in one of the Companies
1.5. The legal basis applicable to the processing of your personal data for the purposes described in point 1.4 is to take steps at the request of the data subject prior to entering a contract, pursuant to Article 6(1)(b) GDPR.
1.6. Your data can be processed for all the research and selection of personnel, by sending you job offer(s) in line with your profile to guarantee you a job placement.
1.7. The legal basis applicable to the processing of your personal data for the purposes referred to in point 1.6 is your consent pursuant to art. 6 (1)(a) of the GDPR.
1.8. Your data may also be processed for the purposes of establishing, exercising or defending our rights in legal proceedings.
1.9. The legal basis for the processing of your personal data for the purposes described in point 1.8 are our legitimate interests under Article 6(1)(f) GDPR.
The legal basis for the processing of the special categories of your personal data (if any) for the same purposes is the establishment, exercise or protection of a right in legal proceedings pursuant to Article 9(2)(f) GDPR.
2. ADDITIONAL PROCESSING PURPOSES AND LEGAL BASES
2.1. Subject to your express consent (Article 6(1)(a) GDPR), your data may also be processed for the following additional purposes:
a. providing information and sending promotional messages on the services offered by the Companies or statistical research and research and/or market research, through traditional (by post and telephone calls via operator) and automated contact methods (e-mail, text message, multimedia message and instant messaging systems)
b. providing information and sending promotional messages on the services offered by other companies in the Group (such as training initiatives, career development, vocational training, support for transmission, search and recruitment and search for managers), and statistical surveys and surveys and/or market research, through traditional (by mail and telephone calls through an operator) and automated contact methods (e-mail, text message, multimedia message and instant messaging systems)
2.2. Nevertheless, consent to the processing of your personal data for the purposes described in point 2.1. above is given entirely at your discretion. Therefore, if you refuse to consent to the processing for the said purposes, your data will only be processed for the purposes described in point 1 above.
3. CATEGORIES OF DATA PROCESSED, DATA SOURCES AND PROCESSING OF SPECIAL CATEGORIES OF DATA
3.1. By way of example, the Companies will receive the following common categories of personal data: personal name, middle name (if any), surname, password, date of birth, PIN, ID card number, postal address, e-mail address and contact phone number, educational qualifications, service experience and any other additional information completed by you in your CV and/or provided during an interview at one of our branches.
3.2. Companies will receive the data in question from you and/or from websites operated by third parties or from social networks through which the Companies publish vacancies (on behalf of their clients or on their own account).
3.3. If you apply for an advertisement or apply for a job at your request, you will be given the opportunity to declare that you have a physical or mental disability and whether you fall into a “protected category” (if you have underwent an examination by a Concilium of experts – „НЕЛК“ or „ТЕЛК“ commission – and received certification from it) in the data collection forms contained on the website or during a telephone interview or interview conducted at one of our branches. This information forms part of the special categories of data pursuant to Article 9 GDPR and will be processed in accordance with the current legal framework. The data will also be used, with your consent, in specific “protected category” searches for roles specifically requested for the completion of the “disability quotas” assigned to employers by the Ministry of Labour and Social Policies and The Agency for People with Disabilities.
3.4. The legal basis for the processing of special categories of your data described in point 1.2 is your explicit consent in accordance with Article 9(2)(a) GDPR.
If you do not give your consent, it will not be possible to process the data of the “protected category” in which you fall.
3.5. Please do not include in your CV any special categories of personal data (personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic data or biometric data for the sole purpose of identifying an individual, or data on your health, sexual life or sexual orientation).
4. DATA RETENTION PERIOD
4.1. When processing data for the purposes of registration in the personal area of the website and for search and selection purposes as described in section 1 when submitting an application for work at the request of the applicant, the data will be entered into the company database and stored for a period of 30 months after its entry, or from the date of your most recent interaction with the website (access, updating data or uploading your CV) or agencies, except when you consent to an extended data retention period, when such consent is requested by you before the expiry of the initial storage period.
4.2. When processing data for purposes related to the establishment, exercise or protection of a legal right as described in point 1, the data are entered into a historical record and kept for the duration of the litigation, until the time limits for appeal actions are exhausted.
4.3. When processing data for the additional purposes described in point 2, the data will be entered into the company database and stored for the period specified in point 4.1 or until you withdraw your consent.
4.4. Upon expiry of the storage periods above, the data will be destroyed or converted to an anonymous format.
5. NATURE OF THE PROVISION OF DATA AND CONSEQUENCES OF THE REFUSAL TO PROVIDE
5.1. The provision of the data marked with an asterisk in the registration form for MyGigroup/MyWyser is necessary to enable the Companies to complete your registration as described in point 1. If you refuse to provide the requested data, the Companies will not be able to complete your registration on the website.
5.2. The provision of the data marked with an asterisk in the data collection form contained on the website or at the request of the agencies is necessary to enable the Companies to carry out the search and selection process described in point 1. If you refuse to provide the requested data, the Companies will not be able to consider your application.
5.3. The provision of the data described in point 2 is optional. If you refuse to provide the data or do not give your consent, this will have no impact on your registration on the website and will not prevent the Companies from performing the search and selection process.
6. RECIPIENTS OF THE DATA
6.1. Your data may only be processed by employees of departments of the Companies who are authorized to do so to fulfil the above-mentioned purposes. The staff in question have received appropriate operating instructions in relation to the tasks they will perform.
6.2. The Companies may forward your personal data to the following parties to fulfil the objectives described in point 1 above:
1. Clients companies or clients organizations
2. Ministry of Labour, labour agencies and labour inspections
3. Public authorities in relation to active employment policies or measures
4. Legal advisors
6.3. In addition, your personal data may be processed by external parties, explicitly designated for data processors who perform for the Companies:
1. website management and maintenance services
2. management and maintenance services of the candidate database
3. data archiving services
4. messaging services
5. services related to market research
6.4. The updated list of recipients can be obtained from our registered office or by sending a letter by e-mail to bg.privacy@gigroup.com.
6.5. Personal data provided by applicants will not be disclosed.
7. TRANSMISSION OF DATA OUTSIDE THE EEA
Your personal data are processed by the Companies inside the European Economic Area (EEA) and are not disclosed. If necessary, for technical or operational reasons, the Companies might transfer your Personal Data to countries outside the EEA, for which there are adequacy decisions of the European Commission or based on the appropriate safeguards (e.g., Standard Contractual Clauses), or specific derogations provided by Regulation.
8. RIGHTS OF THE DATA SUBJECTS
8.1. Data subjects are granted the rights set forth in Articles 15 to 22 of the GDPR, where applicable.
8.2. In particular, data subjects may request the Controllers:
1. to access and receive a copy of their personal data, and other supplementary information
2. to have inaccurate personal data rectified, or completed if it is incomplete
3. in certain circumstances, to have personal data erased
4. in certain circumstances, to request the restriction or suppression of their personal data
5. to object to the processing of the data necessary for the legitimate pursuit of the interests of the controllers or for direct marketing.
8.3. If the conditions for the transmission of the data pursuant to Article 20 GDPR are fulfilled, data subjects shall also have the right to obtain the data provided to the Controllers in a structured general use format read by an automatic device and, where technically feasible, to transmit the data to another controller without hindrance.
8.4. These rights may be exercised in writing to the address Sofia 1527, 88 Aleksandar Dondukov-Korsakov Blvd, fl.3, office 2, or by e-mail sent to the following address: bg.privacy@gigroup.com.
8.5. Data Subjects shall have the right to bring claims before the relevant supervisory authority (for Bulgaria this is the Personal Data Protection Commission).
9. WITHDRAWAL OF CONSENT
9.1. Data Subjects shall have the right to withdraw the consents given at any time by writing to the address Sofia 1527, 88 Aleksandar Dondukov-Korsakov Blvd, fl.3, office 2, or by e-mail sent to the address bg.privacy@gigroup.com.
9.2. The withdrawal of consent shall not affect the legitimate nature of the processing based on the consent given by you prior to the withdrawal.
10. JOINT CONTROLLERSHIP AGREEMENT
The Companies have entered into an agreement to assume joint controllership of the processing of data, pursuant to Article 26 of the GDPR, under which a number of measures will be jointly established, in particular regarding:
1. Purposes and means of processing Personal Data;
2. Procedures for providing timely feedback to data subjects' requests when exercising their rights;
3. Security measures appropriate to the processing of Personal Data and procedures for handling data breaches;
4. Content of privacy notices.
11. CONTACT DETAILS OF THE JOINT CONTROLLERS
The Joint Controllers are G.I. Group EOOD and Wyser EOOD, represented by their legal representatives, address: Sofia 1527, 88 Aleksandar Dondukov-Korsakov Blvd, fl.3, office 2, e-mail: bg.privacy@gigroup.com.
12. CONTACT DETAILS OF THE DATA PROTECTION OFFICER (DPO)
Contact with the Data Protection Officer [DPO] can be made by e-mail: dpo@gigroup.com and at the address: Piazza IV Novembre n. 5, 20124 Milan.