Privacy Notice

1. Data Controller details

The Data Controller is not required to designate a Data Protection Officer (DPO) under Article 37 of the General Data Protection Regulation (GDPR), therefore no separate DPO has been appointed. For data protection questions, please contact the Data Controller directly using the contact details above.

2. Definitions and legal background

This notice has been prepared taking into account the provisions of the following legislation:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR);
• Act CXII of 2011 on the right to informational self-determination and freedom of information (Information Act);
• Act I of 2012 on the Labour Code;
• Government Decree 118/2001 (VI. 30.) on the registration and operating conditions of temporary work agency and private employment agency activities.

Personal data: any information relating to an identified or identifiable natural person.

Data subject: the natural person whose personal data is processed by the Data Controller (e.g. job seeker, visitor filling out a contact form).

Data processing: any operation performed on personal data (collection, recording, storage, use, deletion, etc.).

3. Data processing principles

The Data Controller applies the following principles when processing personal data:

• Lawfulness, fairness and transparency: data processing is always lawful and transparent to the data subject.
• Purpose limitation: data is collected only for specified, explicit and legitimate purposes.
• Data minimisation: we process only data that is strictly necessary for the purpose.
• Accuracy: the data processed is accurate and, where necessary, kept up to date.
• Storage limitation: data is stored only for the time necessary for the purpose.
• Integrity and confidentiality: data security is ensured through appropriate technical and organisational measures.

4. Data processing activities

4.1. Contact form

Data processed	Name, e-mail address, company name (optional), message content, IP address, time of submission
Purpose of processing	To respond substantively to enquiries, inform the User, establish contact
Legal basis	GDPR Article 6(1)(b) — pre-contractual measures; and (f) — legitimate interest of the Data Controller
Storage period	Up to 2 years after the matter is closed, or earlier deletion at the data subject's request
Recipients	Employees of the Data Controller; if necessary, the Hosting Provider (technical operation)

4.2. Job application

Data processed	Name, e-mail address, phone number, CV content (qualifications, professional experience, skills), cover letter, position applied for; the time of consent and the version of this Privacy Notice in effect at that time (to prove consent)
Purpose of processing	Processing the application, evaluating the candidate, contact during the selection process, connecting with the client employer
Legal basis	GDPR Article 6(1)(a) — voluntary consent of the data subject; (b) — pre-contractual measures
Storage period	Up to 3 years after the position is filled or the application is withdrawn — with separate consent of the data subject, kept longer for future positions
Recipients	Employees of the Data Controller; with the explicit consent of the data subject, the client employer

Important: the candidate's data is forwarded to the client employer only with the data subject's explicit consent. The data subject may withdraw this consent at any time.

4.3. Application for career counselling

Data processed	Name, e-mail address, phone number, the selected situation category, the chosen format (in person or online), the text of the enquiry, IP address, time of submission
Purpose of processing	Processing the application, getting in touch, agreeing the time and the content of the consultation, providing the service
Legal basis	Article 6(1)(b) GDPR — steps taken at the request of the data subject prior to entering into a contract, and performance of the contract
Retention period	No more than 2 years after the consultation has taken place or the enquiry has been closed, or earlier deletion at the data subject's request
Recipients	Employees of the Controller; where necessary the Hosting Provider (technical operation)

No CV is required to apply. If the consultation goes ahead, we request the CV separately by e-mail and use it solely to prepare for the consultation; the retention period above applies to it as well.

4.4. Compliance with accounting obligations (for business partners)

Data processed	Billing name, address, tax number, contact person details
Purpose of processing	Compliance with accounting and tax legislation
Legal basis	GDPR Article 6(1)(c) — legal obligation (Act C of 2000 on Accounting)
Storage period	8 years from the issue of the document

4.5. Technical logging of website traffic

Data processed	IP address, browser type and version, operating system, time of visit, pages viewed
Purpose of processing	Ensuring secure and undisturbed operation of the Website, error diagnosis, prevention of misuse
Legal basis	GDPR Article 6(1)(f) — legitimate interest of the Data Controller
Storage period	Maximum 30 days

5. Data processors

The Data Controller uses data processors to perform certain tasks. Data processors do not make independent decisions and act only on the instructions of the Data Controller.

5.1. Hosting provider

5.2. Bot protection service (Google reCAPTCHA)

To protect the contact form from automated abuse, we use the Google reCAPTCHA v3 service. Google analyses the visitor's IP address and browsing patterns to filter out bots.

Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
Privacy notice: policies.google.com/privacy

5.3. Web Analytics (Google Analytics 4)

To anonymously measure website traffic and user behaviour, we use Google Analytics 4. This service is activated only if the visitor consents to analytics cookies via the cookie banner. Google processes the visitor's IP address in anonymised form (last octet stripped).

Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
Tracking ID: G-2RJMMRJR9H
Privacy policy: policies.google.com/privacy
Data transfer: Google primarily processes data within the European Economic Area, but some operations may transfer data to the USA under the EU-US Data Privacy Framework.

5.4. Advertising and conversion tracking (Google Ads)

To measure the effectiveness of our online advertising campaigns and to display personalised remarketing ads, we use the Google Ads service. This service is activated only if the visitor consents to marketing cookies via the cookie banner. Without consent, Google Consent Mode v2 ensures that no personally identifiable data or cookies are stored — only anonymous, aggregated signals are transmitted for statistical modelling.

Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland).
Conversion ID: AW-1040073557
Privacy policy: policies.google.com/privacy
Data transfer: Google primarily processes data within the European Economic Area, but some operations may transfer data to the USA under the EU-US Data Privacy Framework.

5.5. Content delivery network (jsDelivr)

Some display libraries of the Website (animations, scrolling) are loaded from the public jsDelivr content delivery network (CDN). When the files are downloaded, the visitor's browser connects directly to jsDelivr's servers, so jsDelivr — and the CDN partners involved in delivery — technically receive the visitor's IP address, browser data and the referring page address. No cookies are set, and the data is not used by us to identify the visitor.

Provider: jsDelivr (www.jsdelivr.com)
Legal basis: legitimate interest (fast and secure operation of the Website)
Privacy policy: jsdelivr.com/terms/privacy-policy
Data transfer: the CDN servers are located worldwide, including outside the European Union.

6. Use of cookies

The Website may place small data files (cookies) on visitors' devices to ensure proper operation and improve user experience. Analytics and marketing cookies are placed only with the visitor's explicit consent.

Cookie type	Purpose	Lifetime	Legal basis
Session cookies	Necessary for basic website functionality (e.g. preserving form state)	Until browser is closed	Legitimate interest
reCAPTCHA cookies (Google)	Bot protection on application and contact forms	Maximum 6 months	Legitimate interest
cookie_consent_v1	Stores your cookie preferences (analytics/marketing on/off)	12 months	Legitimate interest
_ga, _ga_2RJMMRJR9H (Google Analytics)	Anonymous traffic measurement and behaviour analysis	Up to 2 years (13 months since last visit)	Consent (analytics)
_gcl_au, _gcl_aw, _gcl_dc (Google Ads)	Conversion tracking and remarketing	Up to 90 days	Consent (marketing)

Necessary cookies are based on legitimate interest (GDPR Art. 6(1)(f)) and do not require separate consent. Analytics cookies (Google Analytics) and marketing cookies (Google Ads) are placed only after the visitor explicitly consents via the cookie banner (GDPR Art. 6(1)(a)). Consent may be withdrawn at any time using the "Cookies" button at the bottom of the page.

7. Rights of the data subject

Under the GDPR, the data subject has the following rights:

• Right to information — You may request information at any time about what data we process about you, for what purpose and for how long.
• Right of access — You may request a copy of your personal data being processed.
• Right to rectification — Inaccurate data will be corrected upon request.
• Right to erasure ("right to be forgotten") — In certain cases, you may request the deletion of your data (e.g. when processing is no longer necessary or when you withdraw consent).
• Right to restriction — Under certain conditions, we will restrict the use of your data.
• Right to data portability — You may request that your own data be transferred to you or another controller in a machine-readable format.
• Right to object — You may object to processing based on the legitimate interests of the Data Controller.
• Right to withdraw consent — You may withdraw your consent at any time free of charge, without affecting the lawfulness of processing prior to withdrawal.

To exercise your rights, please contact the Data Controller at info@job-center.hu. The Data Controller will respond to enquiries within 30 days at the latest.

8. Data security measures

To ensure the security of personal data, the Data Controller applies the following technical and organisational measures:

• Encrypted (HTTPS) connection between the Website and visitors;
• Access control: only authorised employees have access to personal data;
• Regular security backups;
• Firewall and antivirus protection;
• Strong passwords and two-factor authentication for critical systems;
• Regular data protection training for our employees;
• Compliance with notification and information obligations under Articles 33-34 of the GDPR in case of data breach.

9. Legal remedies

If you believe that your data is being processed unlawfully, or if you have not received a satisfactory response to your enquiry regarding data processing, you may choose from the following options:

• Direct contact: please first contact the Data Controller at info@job-center.hu.
• Supervisory authority:

  Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
  Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
  Postal address: 1363 Budapest, Pf. 9., Hungary
  Phone: +36 1 391 1400
  E-mail: ugyfelszolgalat@naih.hu
  Website: naih.hu

• Court: You may also seek legal remedy before the court competent for your place of residence or stay. The proceedings are governed by the Information Act and the Code of Civil Procedure.

10. Changes

The Data Controller reserves the right to unilaterally modify this Privacy Notice. The Data Controller will give notice of changes on the Website at least 8 days before they take effect. Changes take effect upon publication on the Website.

Earlier versions are available from the Data Controller upon request.

This amended Privacy Notice takes effect on 13 November 2026. The previous version was in effect from 29 April 2026. Main change: the content delivery network (section 5.5) and the recording of consent were added.