Candidate Privacy Notice
For candidates, members of our talent network and professionals we contact directly about a specific role. This is the information required by Articles 13 and 14 GDPR.
Last updated:
Who processes your data
The controller is Smart Data Technologies EOOD, UIC (EIK) 204660397, registered office: bl. 39, entr. A, fl. 3, apt. 10, Samokovo estate, 2000 Samokov, Bulgaria (“HuntConsult”).
Contact for any personal-data question: privacy@huntconsult.space. We have not appointed a data protection officer.
Who this notice covers
- Candidates who write to us or apply for a role, and members of our talent network who gave us their details themselves (Art. 13 GDPR).
- Professionals we contact directly because their experience looks right for a specific role. In this case we did not obtain your data from you (Art. 14 GDPR).
- Clients’ own candidates, when a client asks us for an independent assessment.
Where we get the data
- from you: in a conversation, by email or through the website form;
- from publicly available professional sources: professional profiles you have made public, company websites, publications, industry events and registers;
- from people who recommend you;
- from a client, when they ask us to assess your candidacy.
When we did not get the data from you, we tell you at our first contact with you, or, if we do not contact you, within one month at the latest (Art. 14(3) GDPR). We tell you where the data came from and how to ask us to stop.
What data we process
- identification and contact data: name, email, phone, city;
- professional data: current and past positions, employers, education, skills, languages, certifications;
- information from our conversations: motivation, pay expectations, notice period, willingness to relocate;
- interview notes and assessments and, with your consent, references from people you name.
We do not seek or process special categories of data (about health, ethnic origin, religion, political opinions and so on). Please do not send them to us.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Contacting you directly about a specific role | Legitimate interest (Art. 6(1)(f) GDPR): our and our clients’ interest in finding the right person, and your interest in hearing about career opportunities. We use only professional data, contact you discreetly and stop at your first objection. |
| Talent network: keeping your profile and contacting you about suitable roles | Consent (Art. 6(1)(a)), which you can withdraw at any time. |
| Applying for a specific role after you have expressed interest | Steps taken at your request prior to entering into a contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)). |
| Introducing your profile to a client | Your explicit consent for that specific role (Art. 6(1)(a)). Without it, we send your profile to no one. |
| References from third parties | Your consent (Art. 6(1)(a)), only from people you name. |
| Complying with legal obligations, including under the Employment Promotion Act | Legal obligation (Art. 6(1)(c)). |
| A do-not-contact list, if you asked us not to contact you | Legitimate interest in honouring your request (Art. 6(1)(f)). We keep only a one-way coded form (a hash) of your contact details. |
| Defending legal claims | Legitimate interest (Art. 6(1)(f)). |
Providing your data is voluntary. Without it, however, we cannot offer you a role.
Who receives the data
- Clients: only with your explicit consent and only for the role you agreed to. The client becomes a separate controller of the data it receives.
- Processors under a contract under Art. 28 GDPR: hosting (Hetzner Online GmbH, Germany) and email (Google Workspace, Google Ireland Limited, Ireland).
- Public authorities, when the law requires it.
If the role is with a client outside the EEA and you agree to be introduced, we will tell you in advance. Data is transferred only under an adequacy decision (for example, for the United Kingdom) or with appropriate safeguards such as standard contractual clauses.
How long we keep the data
We don’t set a fixed period. We keep your data until you withdraw your consent, object or ask us to delete it, whichever comes first:
- Talent network: until you withdraw your consent.
- Professionals we contacted directly: until you object or ask us to delete your data. If you tell us you don’t want to be contacted, we stop at once.
- Candidates in a process for a specific role: on the same terms. Where a law requires us to keep a record of the process, we keep only that record, for the period the law sets.
- Do-not-contact list: if you ask us not to contact you again, we keep only a one-way coded form (a hash) of your contact details. It cannot be turned back into them, and it lets us make sure we never approach you again by mistake.
When you ask us to delete your data, we delete it from all our systems, not only from a list, and we let you know when it is done.
Your rights
- Access (Art. 15 GDPR): to confirm whether we process data about you and to receive a copy.
- Rectification (Art. 16): to correct inaccurate or incomplete data.
- Erasure (Art. 17): to delete your data when we no longer have grounds to keep it.
- Restriction (Art. 18): to pause processing, for example while we check whether the data is accurate.
- Objection (Art. 21): to object to processing based on legitimate interest. If you object to being contacted, we stop at once.
- Portability (Art. 20): to receive the data you gave us in a structured, machine-readable format, where we process it on the basis of consent or a contract.
- Withdrawing consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before the withdrawal.
How to exercise them: through the request form or at privacy@huntconsult.space. We reply within one month. If you ask us not to contact you again, we stop at once.
Automated decisions
Decisions about whether to call you, introduce you or move you forward in a process are made by people. We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR.
No fees for candidates
We never charge candidates. Employment intermediaries are not allowed to charge job seekers.
Right to complain
If you believe we process your data unlawfully, you have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, www.cpdp.bg, kzld@cpdp.bg. We would appreciate the chance to resolve the matter first, so please feel free to contact us at privacy@huntconsult.space.