About this notice

Tessero is a specialist recruitment group operating across six European markets: Sweden, Denmark, Luxembourg, Czechia, Hungary and Romania. We are part of the Meraki family. This notice explains what personal data we hold about you, why we hold it, who we share it with and what rights you have. It applies to candidates, client contacts, supplier contacts and visitors to tesserogroup.com.

Your personal data is processed in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679) (the GDPR) together with the national data protection laws of each country in which we operate.

Who is the data controller

The Tessero entity operating in the market you deal with is the data controller for your personal data, meaning it decides how and why your data is processed. The controlling entity for each market is:

• Sweden: Tessero Sweden AB, Sveavägen 50, 111 34 Stockholm. sweden@tesserogroup.com

• Denmark: Tessero Denmark A/S, Kongens Nytorv 8, 1050 Copenhagen. denmark@tesserogroup.com

• Luxembourg: Tessero Luxembourg S.à r.l. and Tessero Travail Temporaire Luxembourg, 65 Avenue de la Gare, L-1611 Luxembourg. luxembourg@tesserogroup.com

• Czechia: Tessero Czech Republic s.r.o. and Tessero Professional Services Czech Republic s.r.o., Panská 854/2, Praha 1, 110 00. czechia@tesserogroup.com

• Hungary: Tessero Hungary Kft. and Tessero Professional Services Hungary Kft., Akadémia u. 6., Academia Offices, 1st floor, 1054 Budapest. hungary@tesserogroup.com

• Romania: Tessero RO SRL and Tessero Professional Services RO SRL, Premium Plaza, Strada Dr. Iacob Felix 63-69, 7th floor, 011033 Bucharest. romania@tesserogroup.com

These entities were previously named under the Hays brand. The change of name does not change who controls your data or how it is handled, and records created before the change are held by the same entity under its new name.

Company registration details for each entity are available on request.

The personal data we hold

Personal data means information about a living individual who can be identified from that data, on its own or together with other information we hold. The personal data we hold about you may include your name, contact details, address and location, date of birth, nationality and right to work documentation, education and qualifications, work history and CV, professional profiles such as LinkedIn, references, salary and rate expectations, bank details and tax or social security identifiers where we pay you, emergency contact details, the role or roles you have applied for and how you came to us, interview notes and the results of any assessment or test, and technical data from your use of our website such as IP address, browser and device type and pages visited.

Special category data

Some data needs extra protection under Articles 9 and 10 of the GDPR. Where a role or a client process requires it, we may ask for health or medical information, for example to arrange reasonable adjustments, and for criminal record information where that is lawful and relevant to the role. We ask for your explicit consent before we collect this data or share it with a named third party, and you can withdraw that consent at any time. Declining may mean we cannot put you forward for a particular role, but it does not affect anything else we do for you.

Please do not send us more than we need

We do not ask for, and we would rather you did not include in a CV or a form, your national identity number, such as a Swedish personnummer, a Danish CPR-nummer or a Romanian CNP. These are treated as sensitive or restricted under national law and we do not need them to consider you for a role. The same goes for your bank details, and for special category data such as health, ethnicity, religion, trade union membership or sexual orientation. If a role genuinely requires any of it, we will ask you for it separately and explain why.

Where we get your data

Most often you give it to us directly, by sending us your CV, applying for a role, or speaking to one of our consultants. Where you did not give it to us directly, we are likely to have sourced it from LinkedIn or another professional network, a job board or CV database, information you have made public on a social media platform, your employer or a client, or a referral from someone who knows your work.

Why we process your data, and our lawful basis

We process your personal data to provide work finding services and to support any resulting application, engagement, placement or selection process. In practice that means assessing your suitability for roles we are engaged to fill, contacting you about those roles, introducing you to prospective employers, taking up references, verifying qualifications and right to work, and arranging payment where you carry out work through us.

Our main lawful basis is our legitimate interests, under Article 6(1)(f) of the GDPR. Our legitimate interest is the operation of a recruitment business: finding people who may be suitable for the roles our clients ask us to fill, keeping in touch with them about relevant opportunities, and introducing them to those clients. We have weighed that interest against your rights and freedoms and consider this processing to be within the reasonable expectations of someone who is seeking work or is open to hearing about it, and not to override those rights. You can ask us for a copy of that assessment.

We also rely on the performance of a contract where we have placed you or are engaging you directly, on compliance with a legal obligation for matters such as right to work checks, tax and statutory record keeping, and on your explicit consent for special category data and for any marketing where consent is required.

We also rely on our legitimate interests to establish, exercise or defend legal claims, including any claim arising from a recruitment process, such as a discrimination claim. This means we may need to keep a limited record of an application after it has closed.

Your right to object

Because we rely on legitimate interests, you have the right to object at any time to our processing of your personal data. If you object, we will stop processing your data unless we can show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend a legal claim. If you object to direct marketing we will stop without exception. To object, email the address for your market listed above, or contact us through tesserogroup.com. There is no cost and you do not need to give a reason.

Sharing your information

To provide work finding services we may share your personal data with prospective employers and any managed service or recruitment process outsourcing provider acting on their behalf, organisations approached for a professional or academic reference, bodies contacted to verify training, qualifications, certifications or professional memberships, government or regulatory bodies for the purpose of verifying your right to work, any third party company through which you are contracting or propose to contract, other Tessero group entities where a role in another market may suit you, and our professional advisers and administrative and technology service providers, who act on our instructions under a written data processing agreement meeting the requirements of Article 28 of the GDPR.

We may also disclose your personal data where we are permitted or required by law to do so, to comply with a legal obligation, court order or lawful request from a governmental or regulatory authority, to investigate or prevent crime, or to bring or defend legal proceedings. We do not sell your personal data.

International transfers

Your personal data is processed within the European Economic Area. Where a transfer outside the EEA is necessary, for example because a client or a technology provider operates elsewhere, we make sure an appropriate safeguard is in place, such as an adequacy decision or the European Commission Standard Contractual Clauses. You can ask us for details of the safeguard that applies.

How long we keep your information

We keep your personal data for as long as we are providing, or may reasonably provide, work finding services to you. We review candidate records at least once a year and delete or anonymise data that is no longer relevant, taking account of how recently we were in contact, whether you are still active in the market we recruit in, and whether you have asked us to keep your details on file. Where we have placed you with a client, or are otherwise under a legal or regulatory obligation, we keep the minimum data required for as long as the law requires. You can ask us to delete your data at any time.

If you are applying in Hungary

If you are applying for a role in Hungary, we keep your CV on file for future roles only where you have given us your consent, in line with guidance from the Hungarian data protection authority. You can withdraw that consent at any time and we will delete your details. Without that consent we keep your data only for as long as the process you applied to is running, and for any period we are required to keep it in order to deal with a legal claim.

Keeping your data secure

We store your data on secure systems with access limited to those who need it, protected by encryption in transit and at rest and by access controls and monitoring. No transmission over the internet is completely secure, so any data you send us online is sent at your own risk. If you think your data may have been compromised, contact us straight away using the address for your market.

Cookies and website analytics

Our website uses cookies. Strictly necessary cookies make the site work and are always on. Analytics and performance cookies help us understand how the site is used, and functionality cookies remember your preferences. Non essential cookies are set only where you agree to them. You can change your choice at any time through the cookie settings on the site or through your browser.

Automated decision making

We do not make decisions about you by automated means alone. Where technology helps us search or rank candidate records, a consultant reviews the outcome and decides. If you would like us to explain how a decision about you was reached, ask us. You can also ask for a person to review any decision that affects you, and you can contest it.

Your rights

Under the GDPR you have the right to be informed, the right of access to the data we hold about you, the right to have inaccurate data corrected, the right to erasure, the right to restrict processing, the right to data portability, the right to object as set out above, the right to withdraw consent at any time where we rely on it, and the right to be told about a personal data breach that affects you. To exercise any of these rights, contact the address for your market. We will respond within one month, and if a request is complex we will tell you and may take up to two further months.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to your national supervisory authority:

• Sweden: Integritetsskyddsmyndigheten (IMY), imy.se

• Denmark: Datatilsynet, datatilsynet.dk

• Luxembourg: Commission Nationale pour la Protection des Données (CNPD), cnpd.public.lu

• Czechia: Úřad pro ochranu osobních údajů (ÚOOÚ), uoou.gov.cz

• Hungary: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), naih.hu

• Romania: Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), dataprotection.ro

Changes to this notice

We review this notice regularly and may update it. The current version is always published at tesserogroup.com, and where a change materially affects you we will tell you.

Contact us

For any question about this notice, to exercise your rights, or to ask for a copy of your data, email the address for your market listed above or use the contact page at tesserogroup.com.