HR Innovate is committed to protecting our clients’ and candidates’ privacy and handling our clients’ and candidates personal data in an open and transparent manner. The personal data that we collect and process depends on the service requested and agreed in each case.
In this privacy notice we explain what information we collect about our clients and candidates, what we use that information for and who we give that information to. It also sets out our clients’ and candidates rights in relation to the information collected and processed.
Who we are
KHR Innovate Limited (hereinafter referred to as the “company”) is a company registered in Cyprus under license number 284 and having its registered office located at 21 Andrea Dimitriou, 1st floor, 1066, Nicosia, Cyprus licensed by the Cyprus Ministry of Labor.
Who this privacy notice is directed to
This privacy notice is directed to natural persons (hereinafter referred to as our “clients”) who are either past, current or potential clients or candidates, or are authorized representatives/agents of past, current or potential clients or candidates, or are beneficial owners in legal entities who are past, current or potential clients or candidates.
What personal data we process and where we collect it from
We collect and process different types of personal data which we receive from our clients in person or via their online submission in the context of our business relationship.
We may also collect and process personal data which we lawfully obtain not only from our clients and their representatives but also from other third parties e.g. other service providers, or online screening tools such as LinkedIn.
Recruit CRM (hereinafter referred to as our “CRM”) provides the company with the facility to link the data you provide to the company, with other publicly available information about you that you have published on the Internet – this may include sources such as LinkedIn and other social media profiles.
Our CRM technology allows the company to search various databases – some publicly available and others not, which may include your personal data (including your CV or Resumé), to find possible candidates to fill the company’s job vacancies. When the company finds you in this way we will obtain your personal data from these sources.
The company may receive your personal data from a third party who recommends you as a candidate for a specific job opening or for our business more generally.
The personal data which we may collect includes:
Name, address, contact details (telephone, email), identification data (such as passport, driver’s license or ID), birth date, place of birth (city and country), marital status, employment status (employed/self-employed), curriculum vitae, authentication data (e.g. signature).
We collect and process some or all of the following types of information from you:
Information that you provide when you apply for a role. This includes information provided through an online job site, via email, in person at interviews and/or by any other method.
In particular, the company processes personal details such as name, email address, address, date of birth, qualifications, experience, information relating to your employment history, skills and experience that you provide to the company.
If you contact the company – we may keep a record of that correspondence.
A record of your progress through any hiring process that we may conduct.
Details of your visits to the company’s website including, but not limited to, traffic data, location data, weblogs and other communication data, the site that referred you to the company’s website and the resources that you access.
Automated decision making/profiling
We may use our CRM technology to select appropriate candidates for the company to consider based on criteria expressly identified by us and our Clients, or typical in relation to the role for which you have applied. The process of finding suitable candidates is automatic, however, any engagement made to fill the job opening will be decided by the company’s staff and our Clients.
Why we process data and on what legal basis
Lawful basis for processing
We rely on legitimate interest as the lawful basis on which the company collects and uses your personal data. Our legitimate interests are the recruitment of staff for Client’s business and visa versa.
Where you apply for a job opening through any functionality, we rely on your consent, which is freely given by you during the application process.
We use information held about you in the following ways:
To consider your application in respect of a role for which you have applied.
To consider your application in respect of other roles.
To communicate with you in respect of the recruitment process.
To enhance any information that we receive from you with information obtained from third party data providers.
To find appropriate candidates to fill Client job openings.
In order to proceed with a business relationship our clients must provide their personal data to us which are necessary for the required commencement and execution of a business relationship.
Failure to provide us with personal data prevents us from commencing or continuing a business relationship with the clients.
We process our clients’ personal data in accordance with the GDPR and the local data protection law for one or more of the following reasons:
For compliance with a legal obligation
We are obligated under law, such as Data Protection Legislation, to which we are subject to, to collect and process the personal data of our clients for due diligence purposes.
There are also various supervisory authorities whose laws and regulations we are subject to e.g. the Cyprus Ministry of Labor which impose on us obligations and requirements to collect and process personal data for due diligence purposes.
From the specific consent of the client
When the client has provided specific consent for processing (other than for the reason set out hereinabove) then the lawfulness of such processing is based on that consent. The client has the right to revoke consent at any time. However, any processing of personal data prior to the receipt of the revocation will not be affected.
For the purposes of safeguarding legitimate interests
We process personal data so as to safeguard the legitimate interests pursued by us or by a third party. A legitimate interest is when we have a business or commercial reason to use our clients’ information.
Who receives the personal data
In the course of the performance of our business relationship our clients’ personal data may be provided to various departments within our Company.
Furthermore, the following third parties may also be the recipients of the personal data under the certain circumstances such as supervisory and other regulatory and public authorities, whereby a statutory obligation exists.
How long we keep personal information for
We will keep our clients’ personal data for as long as we have a legitimate interest.
Once our business relationship has ended, we will hold your personal data on our systems for the longest of the following periods: (i) any retention period that is required by law or professional standards; (ii) as directed by our own internal retention policies or practices, the length of which may vary depending on the nature of the information that is held.
Our clients’ data protection rights
Our clients have the following rights in terms of the personal data we hold about them:
To receive access to their personal data.
To request correction of the personal data.
To request erasure of their personal information. Where there is a good reason for the personal information to be kept, we may refuse the erasure of the personal data. Good reasons can include legal/statutory reasons for non-erasure, legitimate interests for non-erasure.
To object to processing of their personal data. If our clients lodge an objection, we will no longer process their personal data unless we can demonstrate compelling legitimate grounds for the processing which override their interests, rights and freedoms.
To request the restriction of processing of their personal data.
To request to receive a copy of their personal data.
To withdraw the consent given to us with regard to the processing of their personal data at any time. Note that any withdrawal of consent shall not affect the lawfulness of processing based on consent before it was withdrawn or revoked.
How to raise a complaint
To exercise any of the above rights, or for any questions or complaints about our use of personal data, please contact our Data Protection Officer at 21 Andrea Dimitriou, 1st floor, 1066, Nicosia, Cyprus email email@example.com
Complaints may also be submitted the Office of the Commissioner for Personal Data Protection. More information can be found at http://www.dataprotection.gov.cy