This policy explains how we collect, use and protect the personal data of candidates, temporary workers, clients, suppliers and other business contacts, referees, emergency contacts and dependants, website users, staff alumni and visitors to our premises. It does not cover Tessero's own staff or people applying for jobs at Tessero itself.
References to the GDPR include the EU General Data Protection Regulation (2016/679) and Hungarian Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Infotv.).
1. Who we are and how to contact us
The data controller is Tessero Hungary Kft. (for website users, and otherwise where it is the contracting party) or Tessero Professional Services Hungary Kft. (where it is the contracting party). Both are located at Akadémia u. 6., Academia Offices, 1st floor, 1054 Budapest, Hungary ("Tessero", "we", "us").
You can contact our data protection team at hungary@tesserogroup.com or by post at the address above (marked "Data Protection Team").
Where Tessero entities jointly determine why and how personal data is processed, they act as joint controllers under Article 26 GDPR. You can exercise your rights against any of them using the contact details above.
2. Candidates
"Candidates" covers anyone we think may be interested in or benefit from our services, as well as applicants for roles we advertise, people who send us a speculative CV, and contractors, freelancers and supplier employees put forward for client roles. It includes people who want to become temporary workers.
Personal data we collect
- Identity and contact: Name, date of birth, gender, photograph, marital status, nationality, contact details, emergency contacts and next of kin, ID document copy
- Education and employment: Education, employment history, job title, skills and languages, referees, work permit status, availability, current and past pay and benefits, hours worked once placed, job interests (including those inferred from your engagement with our emails and, if you have switched on marketing cookies, the pages you view on our website)
- Financial and identifiers: Bank details; personal identification number, tax identification number or social security (TAJ) number and tax and social security identifiers, only once we need them for payroll, tax or social security; financial information where a financial background check is needed
- Special category data (only where lawful): Health and disability information (for adjustments and occupational health); diversity data (only with your explicit consent); health or vaccination data where a role requires it; video recordings of interviews (with consent)
- Criminal record data: Only where the law permits it and the role requires it (see section 7)
- Automatically collected: IP address, device, log and usage data, browsing data, email engagement, inferred location
- From others: References; client feedback; information from job sites and LinkedIn; referrals from clients, suppliers, other candidates and our staff; RPO/MSP providers
Please do not include your personal identification number, tax identification number or social security (TAJ) number, bank details or special category data in your CV. We do not need them to consider you for a role, and if a role requires any of them we will ask separately and explain why.
Why we use it and our legal bases
- Pre-recruitment: identifying people who may benefit from our services, storing their details and contacting them (we will email you to tell you we hold your data)
Legal basis (GDPR): Legitimate interests (Art. 6(1)(f)); for keeping your CV for future roles, consent (see section 7)
- Recruitment: assessing you against vacancies, sending your details to clients, online applications and job alerts, interviews (including recorded video interviews), customer support
Legal basis (GDPR): Legitimate interests; contract (Art. 6(1)(b)); consent for video recordings
- Payroll, invoicing and contractual obligations to clients
Legal basis (GDPR): Contract; legal obligation; legitimate interests
- Verification: references, qualifications, identity and right to work
Legal basis (GDPR): Legitimate interests; contract; legal obligation (Art. 6(1)(c))
- Criminal record checks where required for a role
Legal basis (GDPR): Legal obligation, or explicit consent where the law allows
- Skills and psychometric assessments, career development and coaching
Legal basis (GDPR): Legitimate interests
- Satisfaction surveys and market research (published only in anonymised form)
Legal basis (GDPR): Legitimate interests
- Marketing our services by email and text
Legal basis (GDPR): Prior consent (Hungarian Advertising Act, Act XLVIII of 2008)
- Website analytics and marketing cookies: measuring how our website is used, linking the pages you view to your candidate record, and measuring whether our marketing campaigns lead to enquiries or applications (see the Cookies section)
Legal basis (GDPR): Consent (Art. 6(1)(a))
- Equal opportunities monitoring (anonymised) and sharing diversity data with clients
Legal basis (GDPR): Explicit consent
- Health data for reasonable adjustments, occupational health and role-specific health requirements
Legal basis (GDPR): Employment and social protection law (Art. 9(2)(b)); explicit consent where the law requires it
- Legal obligations: tax, employment law (e.g. working hours), right to work, court orders and regulators
Legal basis (GDPR): Legal obligation
- Legal claims and co-operating with law enforcement
Legal basis (GDPR): Legitimate interests; Art. 9(2)(f) for special category data
Profiling and automated decisions
If you switch on marketing cookies and we can recognise you as an existing candidate or contact (for example, because you clicked a link in one of our emails), we record which pages of our website you view and link this to your record in our recruitment system, so that we can suggest relevant roles and follow up with you. We rely on your consent for this. We may use search, filtering and ranking tools to help our consultants find suitable candidates, relying on our legitimate interests. A consultant always reviews the outcome and makes the decision. We do not make decisions about you based solely on automated processing (Art. 22 GDPR).
3. Other people we deal with
- Temporary workers employed or engaged directly by us (in addition to candidate data)
Personal data: Staff number, personal identification number, tax identification number or social security (TAJ) number, tax and social security identifiers; workplace; leave; travel; residence and work permits; performance, bonuses and promotions; grievances and disciplinary matters; sickness absence (health data)
Purposes: Running the employment relationship: payroll and invoicing, terms of work, performance and feedback, absence management, and meeting statutory duties
Legal basis (GDPR): Contract; legal obligation; legitimate interests. Health data: where required or permitted by employment law
- Clients and their employees
Personal data: Name, job title and contact details; engagement with our website and emails; information you give us; call recordings (with consent); ID documents where verification is required
Purposes: Providing our services; managing the relationship; B2B marketing; surveys and market research; candidate references; identity verification; investigations
Legal basis (GDPR): Legitimate interests; consent (recordings, cookies, marketing where required); legal obligation
- Suppliers and other business contacts
Personal data: Name, job title and contact details; business bank details; identification number; information you or others give us
Purposes: Managing the relationship and payments; statutory checks; identity verification; investigations; legal claims
Legal basis (GDPR): Contract; legal obligation; legitimate interests
- Referees, emergency contacts and dependants
Personal data: Name, contact details; references; limited data needed for employee benefits
Purposes: Obtaining references; contacting you in an emergency; administering employee benefits; marketing to referees only with opt-in consent
Legal basis (GDPR): Legitimate interests; employment law obligations; consent (marketing)
- Website users
Personal data: Name and contact details (if provided); IP address, device, log, usage and location data; preferences
Purposes: Providing services you sign up for (e.g. newsletters); security and fraud prevention; improving and personalising our website
Legal basis (GDPR): Legitimate interests; contract; consent (non-essential cookies and marketing); legal obligation
- Staff alumni
Personal data: Name, contact details; employment history with us
Purposes: Running our alumni network; newsletters, events and vacancies
Legal basis (GDPR): Legitimate interests; consent (marketing)
- Visitors to our premises
Personal data: Name, email, job title, purpose of visit; CCTV images where installed; guest Wi-Fi device data
Purposes: Visitor management; security of our premises; guest Wi-Fi
Legal basis (GDPR): Legitimate interests
4. General points
Sources. We collect data from you directly. We also collect it from your organisation; our candidates, temporary workers and staff; referees; clients; job sites and professional networks; RPO/MSP providers; background check, pension and benefits providers; tax authorities; and automatically through our website and emails.
Required data. Some data is required by law (e.g. tax and social security identifiers for payroll) or by contract. If you do not provide it, we may be unable to work with you.
Legitimate interests. We rely on our interests in running and developing our recruitment business: matching candidates with roles, maintaining relationships, providing relevant services, keeping our premises and systems secure, and handling claims. You can object at any time (see section 6).
Consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdraw it.
5. Who we share your data with, transfers and retention
- Tessero group companies, where a role in another market may suit you or they support our operations
- Candidates: prospective employers, managed service and recruitment process outsourcing providers acting for them, and clients' auditors where contractually required
- Temporary workers: the client you work for and, in limited cases, occupational health professionals
- Service providers acting for us under a written data processing agreement: IT, cloud and document storage, marketing technology, background and reference check providers, and assessment tools
- Professional advisers and auditors, and tax and other authorities where required by law
- A buyer or prospective buyer, in the event of a merger or acquisition
We do not sell your personal data.
International transfers. Most of your data is processed within the European Economic Area. Where it is transferred outside the EEA, for example to our offices in the United Kingdom or the United States, we rely on an adequacy decision (such as the one covering the United Kingdom), the EU-US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguard that applies.
How long we keep your data
- Candidates: If you apply for a role, for as long as that recruitment process is running and then for three years in case of a legal claim. We keep your CV for future roles only with your consent, for up to two years or until you withdraw it (see section 7)
- Criminal record data: Only for as long as needed to complete the check for the role, and then deleted
- Temporary workers: For the employment relationship and afterwards for as long as required by Hungarian law (e.g. tax, social security and payroll records) or needed for references or potential claims
- Clients, suppliers and business contacts: While we provide or receive services, or market relevant services to you. Deleted if you tell us you are not interested, unless we must keep it for legal reasons
- Website data (IP address and operating data): 365 days
- All other data: As long as needed for the purpose for which it was collected, unless a longer period is required by law or for legal claims
6. Your rights
You have the right to:
- access your data;
- have it corrected;
- have it erased;
- restrict processing;
- data portability;
- withdraw consent at any time; and
- not be subject to a decision based solely on automated processing.
Your right to object. You can object at any time to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds or need the data for legal claims. If you object to direct marketing, we will always stop.
To exercise your rights, contact hungary@tesserogroup.com. We will respond within one month and may need to verify your identity. Access is free unless a request is manifestly unfounded or excessive. You can unsubscribe from job alerts and marketing via the link in any marketing email.
You can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), Falk Miksa utca 9-11, 1055 Budapest (postal address: 1363 Budapest, Pf. 9.), ugyfelszolgalat@naih.hu, www.naih.hu. You can also bring proceedings before the regional court (törvényszék) for your place of residence or stay.
7. Hungary-specific practices
- Keeping your CV for future roles. In line with guidance from the NAIH, we keep your CV in our database for future roles only if you consent. You can withdraw that consent at any time and we will delete your details. Without consent, we use your data only for the recruitment process you applied for.
- Information we ask for. In line with section 10 of the Hungarian Labour Code (Act I of 2012), we only ask for statements and data that are necessary to assess your suitability for a role.
- Criminal records. We ask for a certificate of good conduct (erkölcsi bizonyítvány) only where a law permits it for the role.
- Marketing. We send you marketing about our services only with your prior consent, which you can withdraw at any time.
8. Cookies
Our website uses cookies and similar technologies. Strictly necessary cookies are always on. Analytics and marketing cookies are set only if you switch them on, and you can reject them as easily as accept them. You can change your choice at any time through the Cookie Preferences link on every page. The Cookies section of our group privacy page, Privacy at Tessero, explains each cookie we use, what it is for, who sets it and how long it lasts.
9. Security, third-party sites and changes
We use appropriate technical and organisational measures to protect your data, including procedures for handling suspected data breaches. Please tell us immediately if you suspect misuse, and keep us informed if your personal data changes.
We are not responsible for third-party websites or services linked from ours.
We may update this policy and will publish changes on this page.