Information Note on the Processing of Personal Data in the Recruitment Process

1. General information

1.1 The confidentiality and security of your personal data represents one of the main concerns of CON-A S.R.L, company with its headquarters in Șelimbăr, Mihai Viteazu St., no. 2B, Sibiu county, that is registered in the National Trade Register Office as J32/586/1991, CUI 792555 (named in the following sections ‘CON-A’, ‘The company’, ‘The employer’, ‘us’ or other similar expressions). Before sending us any personal data, we strongly encourage you to read this section, because it gives you information about the way in which we process your personal data when you apply for a job in our company.

1.2 In some cases, in order to accomplish the goals mentioned in this document, our company can process the personal data that we have received from you, belonging to other natural people (for instance, your family members), without having a way in which we can make sure these people are informed about the processing. For this reason, before revealing these data to us, it is your responsibility to let them know about the personal data processing, as shown in this section, and obtain, if necessary, their consent about their personal data processing to meet the law requirements.

1.3 According to the General Data Protection Regulation – GDPR [1], ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

[1] No. 679 REGULATION from April 27th, regarding the protection of natural people as far as the personal data processing is concerned, as well as the data circulation and the abrogation of the 95/46/CE Directive (General Data Protection Regulation – GDPR).


2. Targeted people

2.1 The targeted people are potential employees that apply for a job in our company directly, at our headquarters or at our regional offices, through specialized companies or online through our website


3. Personal Data that are Being Processed

3.1 The personal data collected in the job application process may be: contact information and general identification data (first name, last name, sex, date and place of birth, series and number of your Identity Card, marital status, citizenship, mailing address, home address, e-mail address, phone number, fax number, signature), personal data included in your CV, details/proof of your education, vocational training, experience and qualifications, diplomas, certifications, information about your driving license, recommendation letters, medical information regarding occupational medicine issues required at the moment of the job application (disabilities, work restrictions), information regarding the social assistance status, criminal record (only if the data processing is necessary, in conformity with the law), data obtained from the interview/test/exam you are taking part in, data that our company generates internally about you, as well as other data that you can directly provide to us about the purpose of the processing.

3.2 As far as the source of the personal data is concerned, most data are directly  provided to us by you  (in person, at our headquarters or at our regional offices in the case of interviews or online, through the `Careers` page of our website), but some data can be obtained from third-party companies, for instance, recruitment agencies, your previous employers – in conformity with the Labour Code, eJobs, LinkedIn and other sources publicly available.


4. The Purpose of the Data Processing and its Legal Ground

4.1 With the purpose of recruitment of potential employees, in order to evaluate their qualifications, to communicate them matters related to the recruitment process, to carry out the precontractual measures necessary for the conclusion of the employment contract (if the recruitment process was successful), or to fulfill our legal interest regarding the purpose of the data processing, we use personal data contained by the CVs, diplomas and the documents we receive from you, with the purpose of recruiting.

4.2 In this case, the data processing will be based on your agreement, on the fact that we’re carrying out the procedures before finalizing the employment contract, on fulfilling a legal obligation of our company, on our legitimate interest related to the purpose of the data processing, on protecting the interests of the individual or the interests of another natural person, or on the protection of our company in an administrative, judiciary or arbitrary manner.


5. Revealing Personal Data

5.1 We do not disclose the data to third-party companies, however, in order to achieve the previously mentioned goals, our company, if necessary, can reveal personal data to the following:

a) Service providers, contributors, legally authorized individuals and our employees or business partners (for instance, our IT providers and the services providers that manage our website, recruitment agencies, external consultants, accountants, auditors);

b) In certain situations, according to the law, it can be necessary to reveal your personal data to judicial or administrative authorities in order to establish, exercise or defense of our legal rights in judiciary, arbitrary or administrative manners;

c) Your personal data can be revealed to other companies in Romania, for instance, in the case of a reorganization, merger, dividing the company, acquisition of another company, association with another company, sales, transfer, liquidation, bankruptcy, assignment of receivables or to other companies in the CON-A Group, with internal administrative, auditing, recruitment purposes, etc. Your personal data are not transferred to another country or international organization. Such transfers, if needed, will be carried out in compliance with the GDPR law and the secondary laws on personal data protection.


6. The Length of the Processing Period

6.1 Your personal data are stocked to be processed during the period of time that is necessary in order to fulfill the goals previously mentioned and/or during the period required by the legislation and ultimately in order to meet certain legal obligations of our company, or for our company’s policy, or for documenting and exercising the right to defend our company in an administrative, judiciary or arbitrary manner, or to fulfill the legal archiving obligations.

6.2 If the job application is successful, your personal data will become part of the file necessary to finalize the individual labor contract and will be processed by us in conformity with the Information Note on our Employees’ Personal Data Processing (information note that will be presented to you in the case of a successful job application).

6.3 If (i) the job application did not succeed, or (ii) there is no opening in our company for the job you are applying to, but we received your personal data for a potential recruitment (speculative job application) we will delete your personal data regarding the job application within 180 calendar days starting with the day when the application failed, or with the date when we received the data from you (in the case of a speculative job application),  exception being the case in which we need these documents in order to defend our company regarding the job application in a judiciary, administrative or arbitrary manner. However, to defend our company regarding the job application in a judiciary, administrative or arbitrary manner, we will store the following data for three years: your name, your contact information and the job you have applied for.

6.4 In the case in which the job application for one of our company’s jobs has failed or there is no job opening in our company for the job you have applied for, but (i) you agree on having your personal data kept in our database for prospective recruiting campaigns, or (ii) you agree on having your data transferred to other companies, members of the CON-A Group, so that they can assess whether you are fit for one of their job openings, we will ask for your consent with this purpose through forms that are available at our headquarters or in our regional offices or on our web page


7. Your rights

7.1 As a data subject GDPR offers you rights such as a) The right to be informed transparently; b) The right of access; c) The right to rectification; d) The right to erasure (`right to be forgotten`); e) The right to restriction of processing; f) The right to data portability; g) The right to not be subject to a decision based solely on automated processing, including profiling.

7.2 We do not make any decisions regarding you based solely on automated processing.

7.3 In the case in which one of the previously mentioned personal data processing is based on your consent, you have the right to withdraw your consent at any time, through a written request, sent at the address written in section 7.5 from down below. However, this does not affect the legal ground on which the previous data processing was made.

7.4 If providing personal data is a legal or contractual obligation or an obligation necessary to finalize a contract, refusing to provide personal data may lead to the impossibility of finalizing the contract or the inability of our company to fulfill the processing goals (for instance, we cannot process your job application).

7.5 If you would like to exercise any of your rights or if you have questions regarding the current briefing note about the processing of your personal data, you can contact us through a written request addressed to our Data Protection Specialist at the following address: Șelimbăr, Mihai Viteazu St, 2B, Sibiu County, e-mail: dataprotection@con-a; fax:  0269/560306.

7.6 If you would like to submit an official complaint regarding the processing of your personal data, you can contact us at the previously written address. What is more, you have the legal right to write a complaint to the National Supervisory Authority for Personal Data Processing. More information regarding this procedure can be found on the website of the National Supervisory Authority For Personal Data Processing.


8. Changes in the Current Information Note

8.1 The date when the current Information Note was last revised is written down below. If necessary, at any given time in the future, to provide information about our data protection measures or the law changes, we will adequately update and change this section.


Version: 01/25.05.2018