This policy explains how we collect, use and protect the personal data of candidates, temporary workers, clients, suppliers and other business contacts, referees, emergency contacts and dependants, website users, staff alumni and visitors to our premises. It does not cover Tessero's own staff or people applying for jobs at Tessero itself.
References to the GDPR include the EU General Data Protection Regulation (2016/679) and Romanian Law No. 190/2018 on measures implementing the GDPR.
1. Who we are and how to contact us
The data controller is Tessero RO SRL (for website users, and otherwise where it is the contracting party) or Tessero Professional Services RO SRL (where it is the contracting party). Both are located at Premium Plaza, Strada Dr. Iacob Felix 63-69, 7th floor, 011033 Bucharest, Romania ("Tessero", "we", "us").
You can contact our data protection team at romania@tesserogroup.com or by post at the address above (marked "Data Protection Team").
Where Tessero entities jointly determine why and how personal data is processed, they act as joint controllers under Article 26 GDPR. You can exercise your rights against any of them using the contact details above.
2. Candidates
"Candidates" covers anyone we think may be interested in or benefit from our services, as well as applicants for roles we advertise, people who send us a speculative CV, and contractors, freelancers and supplier employees put forward for client roles. It includes people who want to become temporary workers.
Personal data we collect
- Identity and contact: Name, date of birth, gender, photograph, marital status, nationality, contact details, emergency contacts and next of kin, ID document copy
- Education and employment: Education, employment history, job title, skills and languages, referees, work permit status, availability, current and past pay and benefits, hours worked once placed, job interests (including those inferred from your engagement with our emails and, if you have switched on marketing cookies, the pages you view on our website)
- Financial and identifiers: Bank details; personal numeric code (CNP) and tax and social security identifiers, only once we need them for payroll, tax or social security; financial information where a financial background check is needed
- Special category data (only where lawful): Health and disability information (for adjustments and occupational health); diversity data (only with your explicit consent); health or vaccination data where a role requires it; video recordings of interviews (with consent)
- Criminal record data: Only where the law permits it and the role requires it (see section 7)
- Automatically collected: IP address, device, log and usage data, browsing data, email engagement, inferred location
- From others: References; client feedback; information from job sites and LinkedIn; referrals from clients, suppliers, other candidates and our staff; RPO/MSP providers
Please do not include your personal numeric code (CNP), bank details or special category data in your CV. We do not need them to consider you for a role, and if a role requires any of them we will ask separately and explain why.
Why we use it and our legal bases
- Pre-recruitment: identifying people who may benefit from our services, storing their details and contacting them (we will email you to tell you we hold your data). Legal basis (GDPR): Legitimate interests (Art. 6(1)(f))
- Recruitment: assessing you against vacancies, sending your details to clients, online applications and job alerts, interviews (including recorded video interviews), customer support. Legal basis (GDPR): Legitimate interests; contract (Art. 6(1)(b)); consent for video recordings
- Payroll, invoicing and contractual obligations to clients. Legal basis (GDPR): Contract; legal obligation; legitimate interests
- Verification: references, qualifications, identity and right to work. Legal basis (GDPR): Legitimate interests; contract; legal obligation (Art. 6(1)(c))
- Criminal record checks where required for a role. Legal basis (GDPR): Legal obligation, or explicit consent where the law allows
- Skills and psychometric assessments, career development and coaching. Legal basis (GDPR): Legitimate interests
- Satisfaction surveys and market research (published only in anonymised form). Legal basis (GDPR): Legitimate interests
- Marketing our services by email and text. Legal basis (GDPR): Soft opt-in for similar services after you have engaged with us (Law No. 506/2004); otherwise opt-in consent
- Website analytics and marketing cookies: measuring how our website is used, linking the pages you view to your candidate record, and measuring whether our marketing campaigns lead to enquiries or applications (see the Cookies section). Legal basis (GDPR): Consent (Art. 6(1)(a))
- Equal opportunities monitoring (anonymised) and sharing diversity data with clients. Legal basis (GDPR): Explicit consent
- Health data for reasonable adjustments, occupational health and role-specific health requirements. Legal basis (GDPR): Employment and social protection law (Art. 9(2)(b)); explicit consent where the law requires it
- Legal obligations: tax, employment law (e.g. working hours), right to work, court orders and regulators. Legal basis (GDPR): Legal obligation
- Legal claims and co-operating with law enforcement. Legal basis (GDPR): Legitimate interests; Art. 9(2)(f) for special category data
Profiling and automated decisions
If you switch on marketing cookies and we can recognise you as an existing candidate or contact (for example, because you clicked a link in one of our emails), we record which pages of our website you view and link this to your record in our recruitment system, so that we can suggest relevant roles and follow up with you. We rely on your consent for this. We may use search, filtering and ranking tools to help our consultants find suitable candidates, relying on our legitimate interests. A consultant always reviews the outcome and makes the decision. We do not make decisions about you based solely on automated processing (Art. 22 GDPR).
3. Other people we deal with
- Temporary workers employed or engaged directly by us (in addition to candidate data): Personal data: Staff number, personal numeric code (CNP), tax and social security identifiers; workplace; leave; travel; residence and work permits; performance, bonuses and promotions; grievances and disciplinary matters; sickness absence (health data). Purposes: Running the employment relationship: payroll and invoicing, terms of work, performance and feedback, absence management, and meeting statutory duties. Legal basis (GDPR): Contract; legal obligation; legitimate interests. Health data: where required or permitted by employment law
- Clients and their employees: Personal data: Name, job title and contact details; engagement with our website and emails; information you give us; call recordings (with consent); ID documents where verification is required. Purposes: Providing our services; managing the relationship; B2B marketing; surveys and market research; candidate references; identity verification; investigations. Legal basis (GDPR): Legitimate interests; consent (recordings, cookies, marketing where required); legal obligation
- Suppliers and other business contacts: Personal data: Name, job title and contact details; business bank details; identification number; information you or others give us. Purposes: Managing the relationship and payments; statutory checks; identity verification; investigations; legal claims. Legal basis (GDPR): Contract; legal obligation; legitimate interests
- Referees, emergency contacts and dependants: Personal data: Name, contact details; references; limited data needed for employee benefits. Purposes: Obtaining references; contacting you in an emergency; administering employee benefits; marketing to referees only with opt-in consent. Legal basis (GDPR): Legitimate interests; employment law obligations; consent (marketing)
- Website users: Personal data: Name and contact details (if provided); IP address, device, log, usage and location data; preferences. Purposes: Providing services you sign up for (e.g. newsletters); security and fraud prevention; improving and personalising our website. Legal basis (GDPR): Legitimate interests; contract; consent (non-essential cookies and marketing); legal obligation
- Staff alumni: Personal data: Name, contact details; employment history with us. Purposes: Running our alumni network; newsletters, events and vacancies. Legal basis (GDPR): Legitimate interests; consent (marketing)
- Visitors to our premises: Personal data: Name, email, job title, purpose of visit; CCTV images where installed; guest Wi-Fi device data. Purposes: Visitor management; security of our premises; guest Wi-Fi. Legal basis (GDPR): Legitimate interests
4. General points
Sources. We collect data from you directly. We also collect it from your organisation; our candidates, temporary workers and staff; referees; clients; job sites and professional networks; RPO/MSP providers; background check, pension and benefits providers; tax authorities; and automatically through our website and emails.
Required data. Some data is required by law (e.g. tax and social security identifiers for payroll) or by contract. If you do not provide it, we may be unable to work with you.
Legitimate interests. We rely on our interests in running and developing our recruitment business: matching candidates with roles, maintaining relationships, providing relevant services, keeping our premises and systems secure, and handling claims. You can object at any time (see section 6).
Consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing carried out before you withdraw it.
5. Who we share your data with, transfers and retention
- Tessero group companies, where a role in another market may suit you or they support our operations
- Candidates: prospective employers, managed service and recruitment process outsourcing providers acting for them, and clients' auditors where contractually required
- Temporary workers: the client you work for and, in limited cases, occupational health professionals
- Service providers acting for us under a written data processing agreement: IT, cloud and document storage, marketing technology, background and reference check providers, and assessment tools
- Professional advisers and auditors, and tax and other authorities where required by law
- A buyer or prospective buyer, in the event of a merger or acquisition
We do not sell your personal data.
International transfers. Most of your data is processed within the European Economic Area. Where it is transferred outside the EEA, for example to our offices in the United Kingdom or the United States, we rely on an adequacy decision (such as the one covering the United Kingdom), the EU-US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguard that applies.
How long we keep your data
- Candidates: Up to two years from collection or our last meaningful contact with you. Meaningful contact means a positive action by you, such as submitting a CV, discussing roles with us or clicking through from our emails; simply opening an email does not count. If you ask us not to keep your data, we delete it unless we must keep it for legal reasons
- Criminal record data: Only for as long as needed to complete the check for the role, and then deleted
- Temporary workers: For the employment relationship and afterwards for as long as required by Romanian law (e.g. tax, social security and payroll records) or needed for references or potential claims
- Clients, suppliers and business contacts: While we provide or receive services, or market relevant services to you. Deleted if you tell us you are not interested, unless we must keep it for legal reasons
- Website data (IP address and operating data): 365 days
- All other data: As long as needed for the purpose for which it was collected, unless a longer period is required by law or for legal claims
6. Your rights
You have the right to:
- access your data;
- have it corrected;
- have it erased;
- restrict processing;
- data portability;
- withdraw consent at any time; and
- not be subject to a decision based solely on automated processing.
Your right to object. You can object at any time to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds or need the data for legal claims. If you object to direct marketing, we will always stop.
To exercise your rights, contact romania@tesserogroup.com. We will respond within one month and may need to verify your identity. Access is free unless a request is manifestly unfounded or excessive. You can unsubscribe from job alerts and marketing via the link in any marketing email.
You can complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, anspdcp@dataprotection.ro, www.dataprotection.ro. You can also bring proceedings before the competent Romanian court.
7. Romania-specific practices
- CNP. We process your personal numeric code only where the law requires it (for example for your employment record, tax and social security) or where Law No. 190/2018 otherwise allows it, with the additional safeguards that law requires.
- Criminal records. We ask for a criminal record certificate (cazier judiciar) only where the law requires one for the role, or with your explicit consent where the law allows.
8. Cookies
Our website uses cookies and similar technologies. Strictly necessary cookies are always on. Analytics and marketing cookies are set only if you switch them on, and you can reject them as easily as accept them. You can change your choice at any time through the Cookie Preferences link on every page. The Cookies section of our group privacy page, Privacy at Tessero, explains each cookie we use, what it is for, who sets it and how long it lasts.
9. Security, third-party sites and changes
We use appropriate technical and organisational measures to protect your data, including procedures for handling suspected data breaches. Please tell us immediately if you suspect misuse, and keep us informed if your personal data changes.
We are not responsible for third-party websites or services linked from ours.
We may update this policy and will publish changes on this page.