CANDIDATE PRIVACY NOTICE

INTRODUCTION

DEFINITIONS 

Candidate means any individual who applies for employment or another role with CEA.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, as defined under the GDPR and applicable Cyprus data protection legislation.

Personal data means any information relating to an identified or identifiable individual.

Processing means any operation or set of operations performed on Personal Data, by automated means or otherwise, including collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Special Categories of Personal Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification purposes, data concerning health, or data concerning a person’s sex life or sexual orientation. This category may also include information relating to criminal convictions and offences where permitted by applicable law.

INTERPRETATION 

1. A reference to a particular law is a reference to it as it is in force for the time being taking account of any amendment, extension, or re-enactment, and includes any subordinate legislation for the time being in force made under it.
2. Unless the context otherwise requires, a reference to one gender shall include a reference to the other gender.
3. Unless the context otherwise requires, words in the singular shall include the plural and, in the plural, shall include the singular.

WHO WE ARE

During the recruitment process, we may collect and process the following categories of personal data:

• Name, surname and contact details, including postal address, telephone number and email address.
• Information about your qualifications, skills and professional experience, including your CV, educational background and professional certifications.
• Nationality and other information relevant to your right to work where required.
• Cover letters, application forms and supporting documents submitted by you.
• Details of referees and references provided by you.
• Information obtained from referees or professional references, where applicable.
• Communications exchanged with you during the recruitment process.
• Information obtained from publicly available professional sources, such as LinkedIn, where relevant to the recruitment process and permitted by law.

We may collect the following information after the shortlisting stage, and before making a final decision to recruit:

• Information about your previous academic and/or employment history, including your salary.
• Information regarding your academic and professional qualifications.
• Criminal record information or background checks, where permitted or required by applicable law and relevant to the role.
• A record of your progress through any hiring process that we may conduct.
• Information concerning your application and our assessment of it.
• Any other information you voluntarily provide throughout the process, including online, through interviews, or other forms of assessment.

PROCESSING OF PERSONAL DATA

We process your Personal Data in accordance with the GDPR and applicable Cyprus data protection legislation. The legal bases on which we rely for processing your Personal Data during the recruitment process are set out below.

1. For the performance of a contract (Article 6 (1)(b))

We process Personal Data where necessary to take steps at your request prior to entering into an employment or other engagement agreement with CEA. This includes assessing your application, communicating with you during the recruitment process and determining your suitability for the role.

2. For the purposes of the legitimate interests pursued by us or by a third party (Article 6 (1)(f))

We may process your Personal Data where it is necessary for our legitimate interests, provided that such interests are not overridden by your rights and freedoms. Examples include:

• assessing your suitability for the role;
• verifying information provided during the recruitment process;
• maintaining the security and integrity of our systems and recruitment processes;
• protecting CEA against fraud, misconduct, security risks or other unlawful activities; and
• establishing, exercising or defending legal claims.

3. Due to your consent (Article 6 (1)(a))

In limited circumstances, we may rely on your consent to process your Personal Data. For example, we may ask for your consent to retain your application details for future employment opportunities beyond the standard retention period.

You may withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of any processing carried out before consent was withdrawn.

4. For compliance with a legal obligation (Article 6(1)(c))

We may process Personal Data where necessary to comply with legal or regulatory obligations applicable to CEA, including employment, tax, immigration and anti-discrimination requirements.

AUTOMATED DECISION-MAKING

CEA does not make recruitment decisions based solely on automated processing. All recruitment decisions involve meaningful human review.

HOW WE WILL USE THE INFORMATION WE COLLECT ABOUT YOU   

We use the Personal Data collected during the recruitment process to:

• assess your qualifications, skills and suitability for the role;
• communicate with you regarding your application;
• conduct interviews, assessments and reference checks where applicable;
• maintain records relating to recruitment activities;
• comply with legal and regulatory obligations; and
• protect our legitimate business interests.

The provision of your Personal Data is necessary for us to assess your application and, where applicable, to enter into an employment or engagement agreement with you.

DATA SHARING 

Your Personal Data may be shared internally on a need-to-know basis with employees involved in the recruitment process, including HR personnel, hiring managers, interviewers and relevant IT personnel where access is necessary for system administration and security purposes.

We may share your Personal Data with carefully selected service providers who support our recruitment and business operations. Such providers are required to process Personal Data only on our documented instructions and in accordance with applicable data protection laws. Where appropriate and permitted by law, we may contact referees, former employers, educational institutions or professional bodies to verify information provided during the recruitment process.

We do not currently transfer your Personal Data outside the European Economic Area (‘EEA’). Should such a transfer become necessary, we will ensure that appropriate safeguards are implemented in accordance with the GDPR.

DATA SECURITY 

CEA takes the security of Personal Data seriously and has implemented appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Any third parties processing Personal Data on our behalf are subject to appropriate confidentiality and data protection obligations.

We also have procedures in place to deal with any suspected Personal Data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so. 

DATA RETENTION 

If your application for employment is successful, your Personal Data collected during the recruitment process will be transferred to your personnel file and retained during your employment. If your application is unsuccessful, we will retain your Personal Data for up to six (6) months following the completion of the relevant recruitment process, unless a longer retention period is required or permitted by law. At the end of that period, we will securely delete or anonymise your Personal Data unless we are required to retain it for legal or regulatory purposes.

Where we wish to retain your application details for future employment opportunities beyond six (6) months, we will seek your consent before doing so.

We may retain Personal Data for a longer period where required to comply with legal obligations, resolve disputes or establish, exercise or defend legal claims.

YOUR DATA PROTECTION RIGHTS

Under the GDPR, you have the following rights in relation to your Personal Data, subject to any limitations provided by applicable law:

• Right of access (Article 15) – to obtain confirmation of whether we process your Personal Data and to receive a copy of such data.
• Right to rectification (Article 16) – to request correction of inaccurate or incomplete Personal Data.
• Right to erasure (Article 17) – to request deletion of your Personal Data in certain circumstances. This right is subject to certain legal exceptions, including where processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
• Right to restriction of processing (Article 18) – to request restriction of processing in certain circumstances.
• Right to data portability (Article 20) – to receive certain Personal Data in a structured, commonly used and machine-readable format.
• Right to object (Article 21) – to object to the processing of your Personal Data where such processing is based on our legitimate interests, unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where the processing is necessary for the establishment, exercise or defence of legal claims.
• Right to withdraw your consent – you reserve the right to withdraw your consent at any time. However, the withdrawal of the consent does not affect the lawfulness of the processing based on consent before its withdrawal.
• Right not to be subject to decisions based solely on automated processing (Article 22) – where such decisions produce legal or similarly significant effects.

HOW TO COMPLAIN?

CHANGES IN THIS PRIVACY NOTICE 

CONTACT US

If you have any questions regarding this Privacy Notice or the processing of your Personal Data, please contact:

C.E.A. CIRCULAR ECONOMY ALLIANCE LTD

Email: [email protected]

¹Automated decision making (or ADM) is the making of decisions by technological means, such as an algorithm or computer (without any human involvement).