Notice on the processing of personal data

M Plus 

Recruitment (job applicants)

December 9^th, 2024

General

• This Notice on the processing of personal data (“Notice“) is issued by M Plus Croatia d.o.o., Ulica Vjekoslava Heinzela 62A, 10000 Zagreb, Hrvatska, OIB: 45680057371. 
• This Notice applies to all persons who apply to Us for an advertisement for a specific position or send Us open job applications

• For these purposes, the term "We" includes all companies associated with Us that are part of the M Plus BPTO business vertical. The controller of the processing of Your data will be the specific company (part of M Plus) to which you apply, while other companies of M Plus  may, depending on the circumstances, process your data exclusively for the purpose of Your employment as processors. 
• 
  
• This Notice is published on the above date and supersedes the version dated 21 August 2024.

Contact

• 
  
• The contact data of M Plus entities are following:

• 
  
• M Plus Croatia d.o.o. - dpo-mplus@dlaw.hr or by post at the address of the company's headquarters Ulica Vjekoslava Heinzela 62A, 10000 Zagreb, Croatia with the indication "PERSONAL DATA PROTECTION".
• 
  
• M Plus Smart Hub Romania SRL - dpo-mplus@dlaw.hr or by post at the address of the company's headquarters Splaiul Independenţei nr. 319, Sectorul 6, Cladire ob. 403A, Scara 1, Etaj 2 Dreapta, Bucuresti, Romania with the indication "PERSONAL DATA PROTECTION".
• 
  
• M+ Slovakia, s.r.o. - dpo-mplus@dlaw.hr or by post at the address of the company's headquarters Palisády 29A, Bratislava, Slovakia with the indication "PERSONAL DATA PROTECTION".
• 
  
• M PLUS SLOVENIJA d.o.o. – contact@mplusgroup.si or by post at the address M PLUS SLOVENIJA d.o.o., Branch office Koper, Pristaniška ulica 4, SI-6000 Koper
• 
  
• 
  
• 
  
• Some companies that are part of the M Plus group have their own privacy policy and are not covered by this Notice. For more information, please refer to the links below:

• M Plus Serbia d.o.o. - https://m-plus.talentlyft.com/   
• 
  
• M+ BH d.o.o. - https://mplusgroup.talentlyft.com/mplus-bih-career-page/privacy
• 
  
• M Plus BL d.o.o. - https://m-plus.talentlyft.com/mplus-bl/privacy  
• 
  
•  Mplus Germany (Invitel GmbH) and affiliated companies - https://invitel-unternehmensgruppe.softgarden.io/de/data-security?0
• 
  
• CMC Iletisim ve Cagri Merkezi Hizmetleri A.S. (Mplus Türkiye) - https://mplusgroup.eu/sites/default/files/legal-documents/internet-sitesi-genel-aydinlatma-metni_0.pdf

Personal data We process

• Personal data means any data relating to a natural person, based on which it is possible to directly or indirectly identify the individual. Direct identification means that it is clear from the data itself which individual it refers to. Indirectly identifiable means that it is possible to identify an individual based on more data available to Us.
• We process the personal data that you have given Us, that is, that we have collected for the purpose of employment, that is, the following data (the specific data set depends on the application method):

• Your basic information

Name, surname, address, date and place of birth;

• Your contact information

Residence and domicile (street and house number, place, postal code), mobile and/or telephone number; E-mail, URL profile on social media;

• Additional information relevant to the employment relationship

Education information (including name of educational institution, name of diploma, time of education, knowledge of foreign languages, using the computer, and driver's license);

Information on previous work experience (including names/company names of previous employers, the position you had and duration of employment);

Information on previous projects (including project name, project URL, project description and project duration)

• Your photograph (if you attached it).

Special categories of personal data

• We do not process personal data related to Your racial or ethnic origin, political views, religious or other beliefs, trade union membership, health or sexual life, data on criminal and misdemeanour proceedings, nor biometric data for the purpose of unique identification.

Purpose of processing

We process Your personal data for the following purposes:

• In order to carry out the recruitment procedure, i.e. the assessment and selection of candidates, as well as if we have your consent for this, for contacting you in case we are looking for candidates for a new position.
• For the purposes of fulfilling our obligations from the law or other regulations that oblige us to act in a certain way towards You as our job candidates;
• For other needs when we have a legitimate interest in it as Your potential employer.

Legal grounds for personal data processing

When processing Your personal data, we rely on one or more of the following grounds for personal data processing: 

• Our legitimate interest as a potential employer with regard to Your application or open job application (legitimate interest);

• Laws or other regulations that oblige us to act in a certain way towards You as our job candidate or respondent (law);

• Your consent if and when we have requested it for a specific activity (consent).

Access to Your personal data

Third parties may process Your personal data in the following cases:  

• External service providers who provide us with services and products necessary for our selection and recruitment process. They act as our processors and process Your personal data in accordance with Our instructions. We regularly check our service providers to make sure that your rights are properly respected;

• Competent authorities that process personal data in accordance with their legal powers, which we are obliged to provide to them for the purpose of Your employment. In this case, they act as a separate data controller and we have no influence on their actions.

In addition to third parties, Your personal data may be processed by companies that are part of the M Plus group, either as our processors when they process your personal data in accordance with our instructions, for the purposes of your employment.

Profiling and automated decision making

• We do not conduct profiling or automated decision-making for employment purposes. 

Transfer of personal data to third countries

• Your personal data are only exceptionally transferred to third countries (outside the EU/EEA), when they are processed by Our affiliated companies in those countries for the purposes of Your employment.

• We ensure that all transfers of Your personal data comply with applicable data protection laws and that we have appropriate safeguards in place to ensure the protection of Your data. For example, we enter into contracts with our affiliates that include standard contract clauses approved by the European Commission (available on the European Commission website). 

Protection of personal data

We consider Your personal data a business secret and protect them as such in accordance with applicable laws and best practices. Some of the protection measures we implement are as follows:  

• Implementing database pseudonymization whenever possible;

• Minimization in the handling of personal data (in a particular process we only handle the necessary set of data);

• Confidentiality in the handling of personal data that we require both internally and externally;

• The application of modern methods of protection and control of access to data resources containing personal data;

• Continuous monitoring of all resources used to process personal data

Data retention period

For personal data for which there is a statutory retention period (for example in accordance with accounting regulations), We retain Your personal data during that mandatory period. We delete them after the expiration of the mandatory period, in an additional period of one year.  

For personal data for which there is no legally defined mandatory retention period, we proceed as follows:

• We store personal data that we process on the basis of Your consent for the duration of the consent and delete it after the expiration of the consent. In the case of withdrawal of consent, we delete them as soon as possible;

• Personal data that we process based on our legitimate interest, we store as long as our legitimate interest exists - we delete them within a period of one year from the termination of our legitimate interest. In case of a job application, if you have not been selected for the job and have not given a consent for a future processing, Your application and related data will be deleted after the end of recruitment process.

Your rights

• In the event that You choose to exercise one or more of Your rights listed below, We have the right to verify Your identity for the purpose of protecting Your personal information.
• 
  
• You exercise Your rights without incurring costs. However, if you frequently (for example, if less than 6 months have passed since Your last request) or excessively (for example, requesting all Your personal information to be delivered in writing) request access to or the transfer of Your personal information, We have the right to ask You to cover Our costs before carrying out such an action.

• You exercise your rights by sending your request to the appropriate email address stated in point 2 or by filling out the data subject form available here. In the message itself, you should indicate which right you want to exercise or what the subject of your request is. Upon receipt of the message, we will send you an acknowledgment of the receipt of your request.
• 
  
• If you have applied for a position through mplusgroup.talentlyft.com, you may exercise some of the rights described below yourself by accessing the Candidate Portal.

• Access to Your personal data:
• You have the right to ask Us to confirm whether We process Your personal data, as well as access Your personal data that We process.

• Correction of incorrect personal data:
• You have the right to request the correction of Your inaccurate personal data, as well as the right to supplement Your personal data.

• Transferability of personal data:
• You have the right to take over and request the transfer of Your personal data.

• Objection to the processing or handling of Your personal data:
• You have the right to object to the processing of Your personal data as well as to object to Our way of handling Your personal data in general.
• 
  
• The right to limited processing of personal data:
• If You dispute the accuracy of Your personal data, or in other situations provided for by the General Regulation on the Protection of Personal Data, You have the right to ask Us to limit the processing of Your personal data until such a situation is resolved.
• 
  
• Deletion of personal data (right to be forgotten):
• If You withdraw Your consent to the processing of Your personal data or when Our legal basis for processing Your personal data ends, or in other cases provided for by the General Regulation on the Protection of Personal Data, You have the right to ask Us to delete Your personal data.

• The right to withdraw consent:
• You have the right to withdraw Your consent for further processing of personal data at any time. The withdrawal of consent does not affect processing performed on the basis of consent prior to its withdrawal.

• The right to complain to the Personal Data Protection Agency:
• At any time, you have the right to complain to the competent authority for personal data protection in your country, regarding the processing and protection of your personal data. A list of the EU national data protection authorities is available at the following link.
•  
•  

Final remarks

• This Notice serves exclusively so that You, as Our job candidates, are properly informed about the processing of your personal data.
• 
  
• We may unilaterally amend this Notice at any time to bring it into line with our current practice. Every change will be properly published and available to You.

*******