Privacy Notice

1. Data Controller details

The Data Controller is not required to designate a Data Protection Officer (DPO) under Article 37 of the General Data Protection Regulation (GDPR), therefore no separate DPO has been appointed. For data protection questions, please contact the Data Controller directly using the contact details above.

2. Definitions and legal background

This notice has been prepared taking into account the provisions of the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR);
• Act CXII of 2011 on the right to informational self-determination and freedom of information (Information Act);
• Act I of 2012 on the Labour Code;
• Government Decree 118/2001 (VI. 30.) on the registration and operating conditions of temporary work agency and private employment agency activities.

Personal data: any information relating to an identified or identifiable natural person.

Data subject: the natural person whose personal data is processed by the Data Controller (e.g. job seeker, visitor filling out a contact form).

Data processing: any operation performed on personal data (collection, recording, storage, use, deletion, etc.).

3. Data processing principles

The Data Controller applies the following principles when processing personal data:

• Lawfulness, fairness and transparency: data processing is always lawful and transparent to the data subject.
• Purpose limitation: data is collected only for specified, explicit and legitimate purposes.
• Data minimisation: we process only data that is strictly necessary for the purpose.
• Accuracy: the data processed is accurate and, where necessary, kept up to date.
• Storage limitation: data is stored only for the time necessary for the purpose.
• Integrity and confidentiality: data security is ensured through appropriate technical and organisational measures.

4. Data processing activities

4.1. Contact form

Data processed	Name, e-mail address, company name (optional), message content, IP address, time of submission
Purpose of processing	To respond substantively to enquiries, inform the User, establish contact
Legal basis	GDPR Article 6(1)(b) — pre-contractual measures; and (f) — legitimate interest of the Data Controller
Storage period	Up to 2 years after the matter is closed, or earlier deletion at the data subject's request
Recipients	Employees of the Data Controller; if necessary, the Hosting Provider (technical operation)

4.2. Job application

Data processed	Name, e-mail address, phone number, CV content (qualifications, professional experience, skills), cover letter, position applied for
Purpose of processing	Processing the application, evaluating the candidate, contact during the selection process, connecting with the client employer
Legal basis	GDPR Article 6(1)(a) — voluntary consent of the data subject; (b) — pre-contractual measures
Storage period	Up to 3 years after the position is filled or the application is withdrawn — with separate consent of the data subject, kept longer for future positions
Recipients	Employees of the Data Controller; with the explicit consent of the data subject, the client employer

Important: the candidate's data is forwarded to the client employer only with the data subject's explicit consent. The data subject may withdraw this consent at any time.

4.3. Compliance with accounting obligations (for business partners)

Data processed	Billing name, address, tax number, contact person details
Purpose of processing	Compliance with accounting and tax legislation
Legal basis	GDPR Article 6(1)(c) — legal obligation (Act C of 2000 on Accounting)
Storage period	8 years from the issue of the document

4.4. Technical logging of website traffic

Data processed	IP address, browser type and version, operating system, time of visit, pages viewed
Purpose of processing	Ensuring secure and undisturbed operation of the Website, error diagnosis, prevention of misuse
Legal basis	GDPR Article 6(1)(f) — legitimate interest of the Data Controller
Storage period	Maximum 30 days

5. Data processors

The Data Controller uses data processors to perform certain tasks. Data processors do not make independent decisions and act only on the instructions of the Data Controller.

5.1. Hosting provider

5.2. Bot protection service (Google reCAPTCHA)

To protect the contact form from automated abuse, we use the Google reCAPTCHA v3 service. Google analyses the visitor's IP address and browsing patterns to filter out bots.

Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
Privacy notice: policies.google.com/privacy

5.3. Web Analytics (Google Analytics 4)

To anonymously measure website traffic and user behaviour, we use Google Analytics 4. This service is activated only if the visitor consents to analytics cookies via the cookie banner. Google processes the visitor's IP address in anonymised form (last octet stripped).

Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
Tracking ID: G-2RJMMRJR9H
Privacy policy: policies.google.com/privacy
Data transfer: Google primarily processes data within the European Economic Area, but some operations may transfer data to the USA under the EU-US Data Privacy Framework.

6. Use of cookies

The Website may place small data files (cookies) on visitors' devices to ensure proper operation and improve user experience. Analytics cookies are placed only with the visitor's explicit consent.

Cookie type	Purpose	Lifetime	Legal basis
Session cookies	Necessary for basic website functionality (e.g. preserving form state)	Until browser is closed	Legitimate interest
reCAPTCHA cookies (Google)	Bot protection on application and contact forms	Maximum 6 months	Legitimate interest
cookie_consent_v1	Stores your cookie preferences (analytics on/off)	12 months	Legitimate interest
_ga, _ga_2RJMMRJR9H (Google Analytics)	Anonymous traffic measurement and behaviour analysis	Up to 2 years (13 months since last visit)	Consent

Necessary cookies are based on legitimate interest (GDPR Art. 6(1)(f)) and do not require separate consent. Analytics cookies (Google Analytics) are placed only after the visitor explicitly consents via the cookie banner (GDPR Art. 6(1)(a)). Consent may be withdrawn at any time using the "Cookies" button at the bottom of the page.

7. Rights of the data subject

Under the GDPR, the data subject has the following rights:

• Right to information — You may request information at any time about what data we process about you, for what purpose and for how long.
• Right of access — You may request a copy of your personal data being processed.
• Right to rectification — Inaccurate data will be corrected upon request.
• Right to erasure ("right to be forgotten") — In certain cases, you may request the deletion of your data (e.g. when processing is no longer necessary or when you withdraw consent).
• Right to restriction — Under certain conditions, we will restrict the use of your data.
• Right to data portability — You may request that your own data be transferred to you or another controller in a machine-readable format.
• Right to object — You may object to processing based on the legitimate interests of the Data Controller.
• Right to withdraw consent — You may withdraw your consent at any time free of charge, without affecting the lawfulness of processing prior to withdrawal.

To exercise your rights, please contact the Data Controller at info@job-center.hu. The Data Controller will respond to enquiries within 30 days at the latest.

8. Data security measures

To ensure the security of personal data, the Data Controller applies the following technical and organisational measures:

• Encrypted (HTTPS) connection between the Website and visitors;
• Access control: only authorised employees have access to personal data;
• Regular security backups;
• Firewall and antivirus protection;
• Strong passwords and two-factor authentication for critical systems;
• Regular data protection training for our employees;
• Compliance with notification and information obligations under Articles 33-34 of the GDPR in case of data breach.

9. Legal remedies

If you believe that your data is being processed unlawfully, or if you have not received a satisfactory response to your enquiry regarding data processing, you may choose from the following options:

• Direct contact: please first contact the Data Controller at info@job-center.hu.
• Supervisory authority:

  Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
  Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
  Postal address: 1363 Budapest, Pf. 9., Hungary
  Phone: +36 1 391 1400
  E-mail: ugyfelszolgalat@naih.hu
  Website: naih.hu

• Court: You may also seek legal remedy before the court competent for your place of residence or stay. The proceedings are governed by the Information Act and the Code of Civil Procedure.

10. Changes

The Data Controller reserves the right to unilaterally modify this Privacy Notice. The Data Controller will give notice of changes on the Website at least 8 days before they take effect. Changes take effect upon publication on the Website.

Earlier versions are available from the Data Controller upon request.

This Privacy Notice takes effect on 29 April 2026.