1. General

1.1. This is the General Privacy Policy (hereinafter referred to as ”Privacy Policy”) that is issued by SMART FLEX d.o.o., Zagreb, Radnička cesta 39, Croatian PIN (”OIB”): 48625549392, a company registered in the Temporary Work Agencies Registry under no. 10/05 based on the decision of the Ministry of Economy, Labour and Entrepreneurship, Class: 102-02/05-05/01, Ref. No. 526-08-05-2 (hereinafter referred to as ”Company“, “We” or ”Us“). In this respect, the Company has the position of the controller of your personal data.

1.2. This Privacy Policy governs the protection of your personal data, as well as your privacy if you are searching for a job and if you are in our CV database (hereinafter referred to as “you”), including the case when you visit our Facebook page and apply for a job through it. This Privacy Policy applies to natural persons only, i.e. their personal data.

1.3. Special Employee Privacy Policy shall apply to you after you are employed by us.

1.4. This version of the Privacy Notice applies from 24 April 2020 and replaces the version from 29 April 2019.

1.5. If you have any questions or requests regarding the handling or protection of your personal data, please contact us on the following address osobni.podaci@smartflex.hr.

2. What personal data do we process?

2.1. We process your personal data you provided to us as well as personal data we collected during the recruitment process, i.e. the following data:

2.1.1. Your identification data

Name, last name, sex, date of birth, residence / habitual residence (street and house number, place, postal code);

Telephone number, email address;

2.1.2. Additional information relevant to the employment relationship

Profession, work experience (previous employer name/company name, duration of employment);

Your interests (the information you provide in the application form/CV);

Results of psychological testing if you participated in psychological assessment and testing.

3. For what purposes do we process your personal data?

3.1. We process your personal data for the following purposes:

• In order to determine whether you are interested in finding a job, i.e. in changing your current job and to include you in our CV database. For those purposes we can process your publicly available personal data (e.g. on the Croatian Employment Service portal or on other portals) as well as data you provided to us (e.g. in open application, application for advertised job positions and similar). In that case, the basis for processing your personal data is our legitimate interest (existence of our mutual interest in your employment) as a temporary employment agency.
• In order to undertake actions necessary for selecting and recruiting new employees and assigning them to our clients (e.g. for selecting the candidates for interviews, for organizing the interview, psychological and other testing and for the presentation of potential candidates to our clients – companies to which you are going to be assigned to). In that case, the basis for processing your personal data is our legitimate interest as a temporary employment agency.
• In order to send you our newsletter, if you gave us your consent for sending the newsletter when applying for our CV database. In that case, the basis for processing your personal data is your consent.
• In order to fulfil our legal obligations. In that case, the basis for processing your personal data is fulfilment of our legal obligations.

• In order to protect our legitimate interests (e.g. when it is necessary to enforce security measures). In that case, the basis for processing your personal data is our legitimate interest.

3.2. Additionally, in order to stay in contact with you regarding a specific job you rejected, or you were not offered after the selection procedure, in case we consider you to be a suitable candidate for other jobs at our clients, we will inform you about it and continue processing your data as described herein. In that case, the basis for processing your personal data is our legitimate interest as a temporary employment agency (existence of our mutual interest in your employment). If you disagree with further processing, you can always contact us according to Section 9 of the Privacy Policy and request termination of processing.

4. Who has the access to your personal data?

4.1. We consider your personal data confidential and protect it as such in accordance with applicable legal regulations and best practices.

4.2. Third parties have the right to access and process your personal data, only in the situations listed below:

• Our clients (employers to which you will be assigned to in case of employment) have the access to your personal data if you are a candidate who meets their requirements. Therefore, if you have applied for an advertised job position, after which we contacted you for the selection process, acquainted you with the employer’s identity and you have met the required criteria during the process, we share your personal data with the client who ordered the ad.
• Third persons – service providers who provide us services necessary for our operational business, e.g. accounting services, postal services, archives etc. In that case, they process your personal data exclusively in accordance with our instructions.
• Third service providers who process your personal data in accordance with their legal authority whose services we use to fulfil our legal obligations or when we have a legitimate interest. In that case, they process your personal data on the basis and in accordance with their legal authority, e.g. various consultants, auditors and similar.
• Competent authorities during supervision of our business and conduct. In that case, they process your personal data in accordance with their legal authority.

5. Visitors to our Facebook page; job applications through the Facebook page

5.1. If you are a Facebook user who has visited our Facebook page, Facebook Ireland Ltd (4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland) and the Company are in the position of a joint controller of your personal data.

5.2.  Facebook processes the personal data of its visitors in accordance with its privacy policy (available at: facebook.com/privacy/explanation). We have influence on the relevant processing only by the means of selecting Facebook user groups (e.g. by age, gender or similar) which are interesting to us from the business aspect.

5.3. We are responsible for all our posts and messages sent through Facebook. Facebook was not included in this process nor consulted before any post / message. Facebook does not necessarily share our positions, visions and the like, which are shown through our posts / messages.

5.4. Information on Facebook users is obtained by us exclusively on a statistic, anonymous basis. If you have left a comment, a question or similar, on our Facebook page, we will not store nor process these data separately.

5.5. If you have applied for a job application through our Facebook page, we process your application and the personal data contained therein in the same manner as the applications received by other means of communication. You can find more information in this Privacy Policy, particularly Sections 2 and 3.

6. Is my personal data transferred to third countries?

No, your personal data remain within the European Union.

7. How do we protect your personal data?

Protecting your personal data is very important to us. Some of the protection measures we undertake are the following:

• Implementation of the database pseudonymization whenever possible.
• Using secure methods while exchanging your personal data to prevent unauthorized access.
• Applying modern methods of protecting and controlling the access to data resources that contain the personal data.
• Continuous monitoring of all resources (physical locations where your data are stored) used to process your personal data.

8. How long do we keep your personal data?

8.1. Data for which data retention period is prescribed by law, will be kept during that period and will be deleted in additional period of one year.

8.2. Personal data we process based on legitimate interest are kept for a period of two years since our last contact (i.e. your registration, sending resume, participating an interview for selection process, etc.).

8.3. Personal data we process based on your consent we keep as long as we have your consent. In case of withdrawal, we delete them as soon as possible, within a reasonable time. If the consent was given for a specified period, after the expiration of that period we delete them as soon as possible, within a reasonable time.

9. Your rights

 9.1. In case you choose to exercise one or more of the below mentioned rights, the Company has the right to verify your identity, for the purpose of the protection of your personal data. Following each of your requests, we will respond as soon as possible, and no later than one month from receiving a complete request.

9.2. You exercise your rights free of charge. However, if you frequently file requests (e.g. from your last request has passed less than 6 months) or excessively file requests (e.g. you ask for all your personal data in writing) or request access or transfer of your personal data, we have the right to ask you to settle our costs before carrying out such action.

9.3. You can exercise your rights (1) by submitting your request to the address osobni.podaci@smartflex.hr, (2) please enter ”Data subject request’ as the subject of the message, (3) explain in the message which right you want to exercise and (4) deliver information which enables your identification (your name and last name, date of birth, Croatian PIN (”OIB”)). Upon receipt of the message, we will send you a confirmation of the orderly receipt of your application. You can also submit your request by post on the address Smart Flex d.o.o., Heinzelova 62a, 10 000 Zagreb.

9.4. Access to your personal data

You have the right to ask for a confirmation that we process your personal data as well as access to your personal data we process.

9.5. Rectification of inaccurate personal data

You have the right to request the rectification of your incorrect personal data and the right to have incomplete personal data completed.

9.6. Data portability

You have the right to receive and request the transfer of your personal data we process based on your consent.

9.7. An objection about the processing or handling of your personal data

You have the right to object to the processing of your personal data as well as to our general manner of handling your personal data.

9.8. Right to withdraw the consent and to be forgotten

You have the right to withdraw your consent on processing of personal data (if you gave us the consent for the purpose of sending you our newsletter) as well as to ask for permanent erasure of your personal data we processed based on your consent. Consent withdrawal does not affect processing conducted based on the consent prior to the withdrawal.

9.9. Right to complain to the Croatian Personal Data Protection Agency

At any time, you have the right to complaint to the competent body for the protection of personal data – Croatian Personal Data Protection Agency, in relation with processing and protection of your personal data.

Issuer: SMART FLEX d.o.o.

Published on: 24 April 2020

In force as of: 24 April 2020