Introduction
The Company ITAF respects the privacy of the data of individuals with whom it comes into contact. The company has adopted a special Privacy Policy on the processing of data of individuals whose data it comes into contact with or processes them. In this document, ITAF explains what personal data it collects and how it treats them in the process of selection and recruitment in accordance with GDPR (regulation (EU) 2016/679) and in accordance with the Serbian Law on Personal Data Protection (Official Gazette of RS 87/2018).
This policy applies to all kinds of job applications: e.g. spontaneous, job sites, via regular mail, via e-mail, etc.
Which personal data do we process?
Personal data includes the following information:
- name and surname, date and place of birth;
- academic and professional/professional qualifications contained in the curriculum vitae and cover letter: level of education, titles, data on skills, knowledge of foreign languages, training, list of previous employers;
- contact details: e-mail address, telephone number
This information can be delivered directly or via CV, motivational letter, online survey, tests, references, personal contact, etc.
When announcing a job vacancy, the Company does not determine the form of the CV, but the job candidate determines it, as a result of which the Company may obtain a larger amount of data than the one contained in paragraph 1 of this Article, at the will of the job candidate.
The legal basis and purpose of collecting the data listed above is the potential conclusion of an employment contract. All other data that we process, we process on the basis of your consent, which is considered to have been given by submitting a job application by filling out a questionnaire or sending another document containing your data.
What do we mean by processing?
We are applying the GDPR regulation:
“’processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.” (article 4, part 2 & 6 of GDPR)
What is the purpose of the data processing?
The collected personal data is exclusively used in the context of the selection and recruitment process. Without this information, the selection & recruitment process cannot be completed and, in other words, you cannot be considered for unfilled vacancies.
Your response to our vacancy or your submission of spontaneous application is valid as an active act whereby you explicitly and unambiguously give permission to process your data. You can withdraw this permission at any time by emailing your request to hr.office@itaf.eu.
How long are my data kept?
Personal data collected in this way are kept until the end of the job advertisement based on the potential conclusion of the contract, and with the consent of the candidate, which is considered to be given by filling out a questionnaire or submitting a resume, are stored for a period of one year. which will be completely deleted from the system.
What does ITAF undertake to protect my personal data?
The company takes special care that the information collected is secure and protected from loss, alteration, unauthorized access and any kind of misuse.
Only the HR-responsible(s) and the responsible of the team/departments have access to your personal data in the context of the performance of their duties within the selection and recruitment process. These persons are obliged to respect confidentiality and security of this data.
Data transfer and data export from the Republic of Serbia
The Company may transfer personal data to third parties under the conditions set out in this Article, and shall take all necessary and required measures to ensure that personal data are processed and provided in accordance with the law and other regulations.
The Company may engage a third party, in its capacity as a service provider and a personal data processor, to perform certain personal data processing activities on behalf of the Company (for example, an agency that will recruit candidates).
In these cases, only those data that are necessary for the purpose of the contracted processing may be provided, and the processors may not use them for other purposes. The conditions of data processing and responsibility for data protection are regulated in more detail by the contract between the Company and the processor.
Personal data are collected and stored in Serbia in accordance with the Law on Personal Data Protection.
The Company may, as part of international cooperation, report personal data from the Republic of Serbia, in accordance with the law and other regulations. The personal data we collect or receive about you may be transferred to and processed by recipients located inside or outside the European Economic Area (“EEA”). Having in mind the activity of the Company, as well as the fact that it is part of an international group of companies, your data can be taken to the Kingdom of Belgium, that is on the List of States where an appropriate level of protection is provided in relation to automatic processing of personal data. In the event that data is disclosed outside the European Economic Area, the Company will take appropriate measures, in accordance with applicable law, to ensure that your personal data remains protected. Such measures include the application of standard contractual obligations in order to protect data transfers outside the countries of the European Economic Area.
What rights do I have with regard to my personal data?
- Right of access to data: You have the right to be informed about the data we process, as well as the right to request access and a copy of the same.
- Right to revoke consent: The right of every data subject is to revoke consent. Revocation of consent does not affect the admissibility of processing carried out before the revocation of consent. Revocation of consent is valid only for situations in which data processing is performed on that of your documented consent. The revocation may be given in writing including the delivery of an email. Please note that if you revoke your consent to the processing of certain data, it may not be possible to conclude an employment contract with you.
- Right to correction and supplementation: You have the right to request correction, supplementation and updating if the data is incomplete or inaccurate.
- Right to erasure: You have the right to request the erasure of data after the expiration of the prescribed period, in case of non-existence / termination of purpose or in case of revocation of consent. Please note that in the event that you submit a request for deletion of data, we will not be able to consider you as a job candidate.
- Right to restrict processing: You have the right to request a restriction on processing if you believe that the data is incorrect, that the processing is illegal (and you object to the deletion of data), that the data is no longer needed for the purpose, and in cases where assessing whether the legal basis for processing outweighs your interests.
- Right to portability: You have the right to obtain personal data that you have previously provided to us and to request that we transfer it to another controller, in accordance with the Law.
- Right to object: If the processing is based on legitimate interests or is necessary for the purpose of performing activities in the public interest or enforcing the legal regulations of the Company, you have the right to file an objection, after which we will suspend further processing of such data for processing that prevails over your interests, rights or freedoms, or in the case when processing is necessary for the submission or realization of a legal claim or defence against it;
- Right to file a complaint: If you believe that your rights to personal data protection have been violated, you can file a complaint to
the Data Protection Authority: www.dataprotectionauthority.be (for Belgium)
the Commissioner for Information of Public Importance and Personal Data Protection: www.poverenik.rs (for Serbia)
Manner of exercising rights
The Company is obliged to provide the data subject with information on the procedure based on the request for exercising the stated rights without delay, and no later than within 30 days from the day of receipt of the request, whereby this deadline can be extended for another 60 days (if necessary, taking into account the complexity and number of requests). The Company is obliged to inform the data subject about the extension of the deadline and the reasons for that extension within 30 days from the day of receipt of the request.
If the Company does not act upon the request of the data subject, it is obliged to inform the person about the reasons for non-compliance without delay, and no later than within 30 days from the day of receipt of the request, as well as the right to file a complaint to the Commissioner, and lawsuit to the court.
The Company provides information on data collection and processing, information related to the exercise of rights free of charge. If the request of the data subject is obviously unfounded or excessive, and especially if the same request is frequently repeated, the Company may charge the necessary administrative costs of providing information, that is acting on the request (e.g. in the case of a request for a copy of the data) or refuses to act on the request.
In case of violation of the rights guaranteed to the individual by the positive regulations of the Republic of Serbia, as well as by this Privacy Policy, the individual will have the right to address the Data Protection Authority (for Belgium) or the Commissioner for Information of Public Importance and Personal Data Protection (for Serbia).
You can exercise your rights through the following contact address: hr.office@itaf.eu, and you can exercise the right to file a complaint:
- Data Protection Authority: www.dataprotectionauthority.be (for Belgium).
- Commissioner for Information of Public Importance and Personal Data Protection: www.poverenik.rs (for Serbia).
Questions regarding this privacy statement: send your request to hr.office@itaf.eu
The Company reserves the right to change this Policy, and you can find out about all changes on the same web address where you read this Policy.
