This policy explains how we collect, use and protect the personal data of candidates, temporary workers, clients, suppliers and other business contacts, referees, emergency contacts and dependants, website users, former employees and visitors to our premises. It does not cover Tessero's own staff or people applying for jobs at Tessero itself.
References to the GDPR include the EU General Data Protection Regulation (2016/679) and Czech Act No. 110/2019 Coll., on the Processing of Personal Data.
1. Who we are and how to contact us
The data controller is Tessero Czech Republic s.r.o. (for website users, and otherwise where it is the contracting party) or Tessero Professional Services Czech Republic s.r.o. (where it is the contracting party). Both are located at Panská 854/2, 110 00 Prague 1, Czech Republic ("Tessero", "we", "us").
You can contact our data protection team at czechia@tesserogroup.com or by post at the address above (marked "Data Protection Team").
Where Tessero entities jointly determine why and how personal data is processed, they act as joint controllers under Article 26 GDPR. You can exercise your rights against any of them using the contact details above.
2. Candidates
"Candidates" covers anyone we think may be interested in or benefit from our services, as well as applicants for roles we advertise, people who send us a speculative CV, and contractors, freelancers and supplier employees put forward for client roles. It includes people who want to become temporary workers.
Personal data we collect
- Identity and contact: Name, date of birth, gender, photograph, marital status, nationality, contact details, emergency contacts and next of kin, ID document copy
- Education and employment: Education, employment history, job title, skills and languages, referees, work permit status, availability, current and past pay and benefits, hours worked once placed, job preferences (including those inferred from your engagement with our emails and, if you have switched on marketing cookies, the pages you view on our website)
- Financial and identifiers: Bank details; birth number (rodné číslo) and tax and social security identifiers, only where necessary for payroll processing or for meeting tax or social security obligations; financial information where a financial background check is required
- Special category data (only where lawful): Health and disability information (for reasonable adjustments and occupational health); diversity data (only with your explicit consent); health or vaccination data where a role requires it; video recordings of interviews (with your consent)
- Criminal record data: Only where the law permits it and the role requires it (see section 7)
- Automatically collected: IP address, device information, activity and usage logs, website browsing data, engagement with our email communications, inferred location data
- From others: References; client feedback; information from job sites and LinkedIn; referrals from clients, suppliers, other candidates and our staff; RPO/MSP providers
Please do not include your birth number (rodné číslo), bank details or special category personal data in your CV. We do not need them to assess your suitability for a role. If any of them are necessary for a specific role, we will request them separately and tell you why we need them.
Why we use it and our legal bases
- Pre-recruitment: identifying people who may benefit from our services, storing their details and contacting them (we will email you to tell you we hold your data). Legal basis (GDPR): Legitimate interests (Art. 6(1)(f))
- Recruitment: assessing you against vacancies, sending your details to clients, online applications and job alerts, interviews (including recorded video interviews), customer support. Legal basis (GDPR): Legitimate interests; contract (Art. 6(1)(b)); consent for video recordings
- Payroll, invoicing and contractual obligations to clients. Legal basis (GDPR): Contract; legal obligation; legitimate interests
- Verification: references, qualifications, identity and right to work. Legal basis (GDPR): Legitimate interests; contract; legal obligation (Art. 6(1)(c))
- Criminal record checks where required by law for a role, or where justified by the nature of the role (see section 7). Legal basis (GDPR): Legal obligation where a law requires the check; legitimate interests (Art. 6(1)(f)) where the check is justified by the nature of the role and is proportionate (Section 316(4), Labour Code); or explicit consent where the law allows
- Skills and psychometric assessments, career development and coaching. Legal basis (GDPR): Legitimate interests
- Satisfaction surveys and market research (published only in anonymised form). Legal basis (GDPR): Legitimate interests
- Marketing our services by email and text. Legal basis (GDPR): Soft opt-in for similar services after you have engaged with us (Act No. 480/2004 Coll.); otherwise opt-in consent
- Website analytics and marketing cookies: measuring how our website is used, linking the pages you view to your candidate record, and measuring whether our marketing campaigns lead to enquiries or applications (see the Cookies section). Legal basis (GDPR): Consent (Art. 6(1)(a))
- Equal opportunities monitoring and evaluation (based on anonymised data) and sharing diversity data with clients. Legal basis (GDPR): Explicit consent
- Health data for reasonable adjustments, occupational health and role-specific health requirements. Legal basis (GDPR): Employment and social protection law (Art. 9(2)(b)); explicit consent where the law requires it
- Legal obligations: tax, employment law (e.g. working hours), right to work, court orders and regulators. Legal basis (GDPR): Legal obligation
- Legal claims and co-operating with law enforcement. Legal basis (GDPR): Legitimate interests; Art. 9(2)(f) for special category data
Profiling and automated decisions
If you switch on marketing cookies and we can recognise you as an existing candidate or contact (for example, because you clicked a link in one of our emails), we record which pages of our website you view and link this to your record in our recruitment system, so that we can suggest relevant roles and follow up with you. We rely on your consent for this. We may use search, filtering and ranking tools to help our consultants find suitable candidates, relying on our legitimate interests. The results of these tools are always reviewed by one of our consultants, who makes the final decision. We do not make decisions about you based solely on automated processing (Art. 22 GDPR).
3. Other people we deal with
- Temporary workers employed or engaged directly by us (in addition to the personal data we process about them as candidates). Personal data: Staff number, birth number (rodné číslo), tax and social security identifiers; workplace; leave; travel; residence and work permits; performance, bonuses and promotions; grievances and disciplinary matters; sickness absence (health data). Purposes: Running the employment relationship: payroll and invoicing, terms of work, performance and feedback, absence management, and meeting statutory duties. Legal basis (GDPR): Contract; legal obligation; legitimate interests. Health data: where required or permitted by employment law
- Clients and their employees. Personal data: Name, job title and contact details; engagement with our website and emails; information you give us; call recordings (with consent); ID documents where verification is required. Purposes: Providing our services; managing the relationship; B2B marketing; surveys and market research; candidate references; identity verification; investigations. Legal basis (GDPR): Legitimate interests; consent (recordings, cookies, marketing where required); legal obligation
- Suppliers and other business contacts. Personal data: Name, job title and contact details; business bank details; identification number; information you or others give us. Purposes: Managing the relationship and payments; statutory checks; identity verification; investigations; legal claims. Legal basis (GDPR): Contract; legal obligation; legitimate interests
- Referees, emergency contacts and dependants. Personal data: Name, contact details; references; limited data needed for employee benefits. Purposes: Obtaining references; contacting you in an emergency; administering employee benefits; marketing to referees only with opt-in consent. Legal basis (GDPR): Legitimate interests; employment law obligations; consent (marketing)
- Website users. Personal data: Name and contact details (if provided); IP address, device, log, usage and location data; preferences. Purposes: Providing services you sign up for (e.g. newsletters); security and fraud prevention; improving and personalising our website. Legal basis (GDPR): Legitimate interests; contract; consent (non-essential cookies and marketing); legal obligation
- Former employees. Personal data: Name, contact details; employment history with us. Purposes: Managing our database of former employees; sending newsletters, event invitations and information about job opportunities. Legal basis (GDPR): Legitimate interests; consent (marketing)
- Visitors to our premises. Personal data: Name, email, job title, purpose of visit; CCTV images where installed; guest Wi-Fi device data. Purposes: Visitor management; security of our premises; guest Wi-Fi. Legal basis (GDPR): Legitimate interests
4. General points
Sources. We collect data from you directly. We also collect it from your organisation; our candidates, temporary workers and staff; referees; clients; job sites and professional networks; RPO/MSP providers; background check, pension and employee benefits providers; tax authorities; and automatically through our website and email communications.
Required data. Some data is required by law (e.g. tax and social security identifiers for payroll) or by contract. If you do not provide it, we may be unable to work with you.
Legitimate interests. We rely on our interests in running and developing our recruitment business: matching candidates with roles, maintaining relationships, providing relevant services, keeping our premises and systems secure, and handling claims. You can object at any time (see section 6).
Consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdraw it.
5. Who we share your data with, transfers and retention
- Tessero group companies, where a role in another market may suit you or they support our operations
- Candidates: prospective employers, managed service and recruitment process outsourcing providers acting for them, and clients' auditors where contractually required
- Temporary workers: the client you work for and, in limited cases, occupational health professionals
- Service providers acting for us under a written data processing agreement: IT, cloud and document storage, marketing technology, background and reference check providers, and assessment tools
- Professional advisers and auditors, and tax and other authorities where required by law
- A buyer or prospective buyer, in the event of a merger or acquisition
We do not sell your personal data.
International transfers. Most of your data is processed within the European Economic Area. Where it is transferred outside the EEA, for example to our offices in the United Kingdom or the United States, we rely on an adequacy decision (such as the one covering the United Kingdom), the EU-US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguard that applies.
How long we keep your data
- Candidates: Up to two years from collection or our last meaningful contact with you. Meaningful contact means a positive action by you, such as submitting a CV, discussing roles with us or clicking through from our emails; simply opening an email does not count. If you ask us not to keep your data, we delete it unless we must keep it for legal reasons
- Criminal record data: Only for as long as needed to complete the check for the role, and then deleted
- Temporary workers: For the employment relationship and afterwards for as long as required by Czech law (e.g. tax, social security and payroll records) or needed for references or potential legal claims
- Clients, suppliers and business contacts: While we provide or receive services, or market relevant services to you. Deleted if you tell us you are not interested, unless we must keep it for legal reasons
- Website data (IP address and operating data): 365 days
- All other data: As long as needed for the purpose for which it was collected, unless a longer period is required by law or for legal claims
6. Your rights
You have the right to:
- access your data;
- have it corrected;
- have it erased;
- restrict processing;
- data portability;
- withdraw consent at any time; and
- not be subject to a decision based solely on automated processing.
Your right to object. You can object at any time to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds or need the data for legal claims. If you object to direct marketing, we will always stop processing your data for that purpose.
To exercise your rights, contact czechia@tesserogroup.com. We will respond to your request within one month and may need to verify your identity in order to deal with it. We provide access to your personal data free of charge unless a request is manifestly unfounded or excessive. You can unsubscribe from job alerts and marketing via the link in any marketing email.
You can complain to the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, posta@uoou.gov.cz, www.uoou.gov.cz. You can also bring proceedings before the competent Czech court.
7. Czechia-specific practices
- Information we ask for. As an employment agency, we only ask for information that Czech employment law allows. We do not ask about your nationality or ethnic origin, political views, trade union membership, religion, sexual orientation, family or property circumstances, and we ask about your health only where a law requires it for the role, and about your criminal record only in the circumstances described below.
- Criminal records. We ask for an extract from the Criminal Records (výpis z evidence Rejstříku trestů) only where a law requires it for the role, or where there is a legitimate reason arising from the nature of the role (for example, roles involving access to cash, valuables, sensitive data or vulnerable people) and the requirement is proportionate and reasonable, as permitted by Section 316(4) of the Labour Code (Act No. 262/2006 Coll.). Before asking, we assess and record why the check is needed for that role, and we tell you the reason. We use the extract only to assess your suitability for that role and do not keep it longer than set out in section 5.
8. Cookies
Our website uses cookies and similar technologies. Strictly necessary cookies are always on. Analytics and marketing cookies are set only if you switch them on, and you can reject them as easily as accept them. You can change your choice at any time through the Cookie Preferences link on every page. The Cookies section of our group privacy page, Privacy at Tessero, explains each cookie we use, what it is for, who sets it and how long it lasts.
9. Security, third-party sites and changes
We use appropriate technical and organisational measures to protect your personal data, including procedures for handling suspected personal data breaches. Please tell us immediately if you suspect any unauthorised use or misuse of your personal data, and keep us informed if your personal data changes.
We are not responsible for third-party websites or services linked from ours.
We may amend and supplement this policy from time to time and will notify you of any changes by publishing them on this page.