Notice provided by: Asteria Search Korlátolt Felelősségű Társaság
Represented by: Iván Kolb and Frido Cornelis Diepeveen (authorised representatives)
Effective date: Budapest 19th August 2026
1.1
The processing of CVs:
Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to
the processing of your personal data based on the content of the present information. Your application can only be considered and forwarded by us if you give consent to the processing of the data included in your CV in relation to the vacant position, and to the transfer of such data by the Company. If we receive your CV from our client (a prospective employer) rather than directly from you, we will inform you of this.
The scope of the processed data: the personal data included in your CV, and if we received your CV from our contractual partner, your strengths and weaknesses, the reasons for the planned job change, the expectations related to the preferred employment relationship, your wage demand, furthermore, if you provide it to us, the circumstances of your previous job change, information on the actual employment relationship relevant from the aspect of the new employment relationship (e.g. termination period, possible non-compete clause) as well as personal data.
1.2
Undertaking job interviews:
Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to the processing of your personal data based on the content of the present information. Your application can only be considered and forwarded by us if you give consent to the processing of the data included in your CV in relation to the vacant position, and to the transfer of such data by the Company. If we receive your CV from our client (a prospective employer) rather than directly from you, we will inform you of this.
The scope of the processed data: the personal data included in your CV, and if we received your CV from our contractual partner, your strengths and weaknesses, the reasons for the planned job change, the expectations related to the preferred employment relationship, your wage demand, furthermore, if you provide it, the circumstances of your previous job change, information on the actual employment relevant from the aspect of the new employment relationship (e.g. termination period, possible non-compete clause) as well as personal data. In addition, the scope of the processed data includes interview notes, interviewer assessments, and candidate evaluation reports prepared in connection with the interview.
1.3
Transferring job opportunities to you:
Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to the processing of your personal data based on the content of the present information.
The scope of the processed data: the personal data included in your CV, and if you indicate such, your wage demand.
1.4
Processing of personal data of contractual contact persons:
Pursuant to Article 6 (1) f) of the GDPR the processing of personal data shall be lawful exclusively if and to the extent that the processing is necessary for enforcement of the legitimate interest of the controller or a third party.
If the Company and your employer concluded a contract, the Company processes the following personal data of yours: full name, position, contact information (phone number, e-mail address). Upon request, the Company will provide further information about the legitimate interest assessment balancing its interests against your rights and freedoms.
1.5
Maintaining registration regarding jobseekers:
Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to the processing of your personal data based on the content of the present information.
The scope of the processed data: the personal data included in your CV, your name, the name of your employer, your interest in potential positions, the reasons for the planned job change, wage demand, furthermore, if you provide it, the circumstances of your previous job change, information on the actual employment relationship relevant from the aspect of the new employment relationship (e.g. termination period, possible non-compete clause).
The Company acts as controller of your personal data as listed above. The Company has assessed that the appointment of a Data Protection Officer is not mandatory under Article 37 of the GDPR, given the scale and nature of its processing activities. Queries regarding this notice or the processing of your personal data can be directed to the contact named in Point 8 below.
3.1
In respect of Point 1.1,
the purpose of the data processing is to enable the Company to review your CV and contact you regarding the consideration and forwarding of your application, in order to fill the vacant position at our client, the prospective employer.
3.2
In respect of Point 1.2,
the purpose of the data processing is to enable us to conduct the job interview and forward the result to our client, the prospective employer.
3.3
In respect of Point 1.3,
the purpose of the data processing is to enable us to identify job opportunities matching your search criteria and to contact you accordingly.
3.4
In respect of Point 1.4,
the purpose of the data processing is to enable the Company to maintain contact with your employer and to perform its obligations under the contracts concluded with your employer.
3.5
In respect of Point 1.5,
the purpose of the data processing is to enable the Company to maintain an up-to-date register of jobseekers, so that it can provide services of sufficient quality to its clients. This data processing also allows the Company to inform you of a suitable job opportunity, should one arise.
3.6
In order to efficiently review and match candidates to job opportunities, we may use artificial intelligence (AI) tools to analyze the information provided in your CV. These AI tools help us identify candidates whose skills, experience, and qualifications align with the requirements of the positions we are filling. Please be assured that while AI assists in the initial screening process, all decisions concerning candidate assessments and recommendations are subject to human review by our team. No automated decisions are made based solely on AI analysis. Candidate data processed by these AI tools is not used to train any public or third-party AI models and remains subject to the Company’s contractual and technical safeguards. If the use of these AI tools meaningfully influences a decision concerning you, you may request further information about the logic involved and the significance and likely consequences of such processing by contacting the Company using the details set out in Point 8 below.
Automated decision making does not take place.
4.1
In respect of Point 1.1,
the data processing takes place until the application process for the given post is closed. If your application is successful and you fill the vacant position, the Company processes the personal data for the above purposes for a maximum of one year following the placement. If you fill the vacant position but would like to remain in our registry, to avoid additional administrative steps in case of possible future job searches, and you give your consent to the processing of your personal data under Point 1.5, Point 4.5 defines the duration of that data processing. If your job application is not accepted, but you give further consent to the processing of your personal data under Point 1.3, Point 4.3 defines the duration of that data processing.
4.2
In respect of Point 1.2,
the data processing takes place until the application process for the given position is closed. If your application is successful and you fill the vacant position, the Company processes the personal data for the above purposes for a maximum of one year following the placement. If you fill the vacant position but would like to remain in our registry, to avoid additional administrative steps in case of possible future job searches, and you give your consent to the processing of your personal data under Point 1.5, Point 4.5 defines the duration of that data processing. If your job application is not accepted, but you give further consent to the processing of your personal data under Point 1.3, Point 4.3 defines the duration of that data processing.
4.3
In respect of Point 1.3,
the data processing takes place for a maximum period of 36 months from the date your consent is given, or until you withdraw your consent, whichever occurs earlier. Before the expiry of this period, the Company will contact you to ask whether you wish to renew your consent. If consent is not renewed, your personal data will be permanently deleted or anonymised.
4.4
In respect of Point 1.4,
we process your data for a maximum of one year after you cease to be the contact person.
4.5
In respect of Point 1.5,
the data processing takes place for a maximum period of 36 months from the date your consent is given, or until you withdraw your consent, whichever occurs earlier. Before the expiry of this period, the Company will contact you to ask whether you wish to renew your consent. If consent is not renewed, your personal data will be permanently deleted or anonymised.
Your personal data are stored at the Company's seat (1007 Budapest, Margitsziget Zielinski Szilárd sétány 1), and we store it on servers located at Budapest Internet Exchange H-1132 Budapest, Victor Hugo u. 18-22 and within Microsoft 365 cloud services operated by Microsoft Ireland Operations Limited.
The Company applies all technical safety measures that can be reasonably expected to store the data in a safe way, not accessible to third parties. The servers of the hosting service provider are protected by 24-hour personal security and are located on the Hungarian internet backbone network.
An IT description of the safety measures, the technical and organizational measures taken to ensure the safety of data follows below: The Company's IT system is protected by continuously maintained firewall, anti-virus and anti-spam measures. The Company protects its electronic devices through password-protected access controls.
We do not store the paper-based CVs.
At the Company Mr. Iván Kolb and Mr. Frido Cornelis Diepeveen (authorised representatives of the Company), the assigned employees of the Company, as well as TRAFFIT Sp. z o.o. (TRAFFIT Sp. z o.o., Kielecka 5/20, 81-303 Gdynia, Poland, represented by Martyna Jacko, Key Account & Payments Manager) as data processor, IMEX Global Kft. , seat: 2360 Gyál, Vecsési út 94, represented by: Eisenberger Mihály, Managing Director) as system administrator, and Websupport Magyarország Kft (Websupport Magyarország Kft, seat: 1132 Budapest,Victor Hugo utca 18-22, represented by Sara Maria Laurell, Managing Director), as hosting provider, and Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) as
cloud-based service provider.
The Company uses Microsoft 365, provided under contract with Microsoft Ireland Operations Limited, for cloud-based storage and hosting. Microsoft stores and processes Microsoft 365 customer data within the European Union/European Free Trade Association under Microsoft's EU Data Boundary programme. Limited residual transfers of data outside the EU/EFTA may still occur for specific purposes such as cybersecurity threat monitoring, abuse prevention and technical support. The Company does not use Microsoft 365 Copilot. Any such residual transfers are governed by Microsoft's Data Processing Addendum, which relies on the EU-U.S. Data Privacy Framework (Microsoft is certified under this framework) and, as a backstop, the European Commission's Standard Contractual Clauses. You may request further details of these safeguards, or a copy of the relevant documentation, by contacting the Company using the details set out in Point 8 below.
We transfer your personal data in respect of Points 1.1, 1.2, 1.3 to other companies as our clients, located within the European Economic Area, based on your consent.
The Company engages S&K Human-Logistics Korlátolt Felelősségű Társaság (seat: 1161 Budapest, Szent Korona utca 16-18. 2. em. 12, represented by: Kiss Attila Zsolt, Managing Director), and Minik Emese (sole proprietor, seat: 2760 Nagykáta, Szondy utca 8.) as external recruitment consultants who act exclusively on the instructions of the Company and within the Company’s TRAFFIT recruitment platform. These persons do not determine the purposes 5or means of processing your personal data and do not use your personal data for their own business purposes. They act as data processors under Article 28 of the GDPR and are bound by data processing agreements covering confidentiality, data security and data protection.
In respect of Point 1.4 your data are not transferred to other companies.
a.)
right of access (Article 15 GDPR):
You are entitled to obtain from the Company confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the information contained herein.
Per your request, the Company provides a copy of the personal data undergoing processing. For any further copies you request, the Company may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, and unless you request otherwise, the information will be provided in a commonly used electronic form.
b.)
right to rectification (Article 16 GDPR):
You have the right to obtain from the Company without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
c.)
right to erasure (Article 17 GDPR):
You have the right to obtain from the Company the erasure of personal data concerning you without undue delay and the Company shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- You object to the processing and there are no overriding legitimate grounds for the processing;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject.
d.)
right to restriction of processing (Article 18 GDPR):
You have the right to obtain from the Company restriction of processing where one of the following applies:
- You contest the accuracy of the personal data, for a period enabling the Company to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- the Company no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims or
- You have objected to processing.
e.)
right to object (Article 21 GDPR):
You are entitled to object, on grounds relating to your particular situation, to the processing of your personal data based on Article 6 (1) f) at any time. Following such an objection, the Company will assess, on a case-by-case basis, whether it has compelling legitimate grounds for the processing which override your interests, rights and freedoms, or whether the processing is necessary for the establishment, exercise or defence of legal claims, and will inform you of the outcome of that assessment.
f.)
right to receive information on the above rights (Article 12 GDPR):
the Company provides you with information on action taken on your request as per clauses a)-e) above without undue delay and in any event within one month of receipt of your request. The information is provided in a concise, transparent, intelligible and easily accessible form. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Company informs you of any such extension within one month of receipt of the request, together with the reasons for the delay.
The information is given free of charge. Where your request is manifestly unfounded or excessive, in particular because of its repetitive character, the Company may either i) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or ii) refuse to act on the request. The Company bears the burden of demonstrating the manifestly unfounded or excessive character of the request.
g.)
right to lodge a complaint (Article 77 GDPR):
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR. The complaint can be filed with the National Data Protection and Freedom of Information Authority (NAIH) (address: 1055 Budapest, Falk Miksa utca 9-11; telephone: +36 1 391 1400; fax: +36 1 391 1410; www.naih.hu; ugyfelszolgalat@naih.hu).
h.)
right to judicial remedy (Article 79 GDPR):
You have the right to judicial remedy where you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR. Proceedings against the Company can be brought before the courts of the Member State where the Company has an establishment. Such proceedings may be brought before the courts of the Member State where you have your habitual residence.
i.)
right to data portability (Article 20 GDPR):
You have the right to receive personal data which are processed for the purposes defined in the above Points 3.1, 3.2, 3.3 and 3.5, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Company. Furthermore, you have the right to have the personal data transmitted directly from the Company to another data controller, where technically feasible.
j.)
right to withdraw consent:
you may withdraw your consent provided in respect of the above Points 1.1, 1.2, 1.3 and 1.5 at any time, in which case we do not further process your personal data.
You may request further information in connection with the processing of your personal data from Mr. Frido Cornelis Diepeveen, via mail (1007 Budapest, Danubius Grand Hotel Margitsziget) or email (frido.diepeveen@asteriasearch.com). Per your request, verbal information may also be given in which case, minutes have to be taken. If you request verbal information (e.g. via phone), you are required to prove your identity towards the Company. If you wish to exercise your rights above, you have to contact Mr. Frido Cornelis Diepeveen.
By ticking the corresponding box(es) for each purpose when submitting your application or registration through the Company’s online systems, you confirm that you have understood the present information and that you give your consent, separately for each of the following purposes, to the data processing as defined herein: (i) Point 1.1 (processing of your CV); (ii) Point 1.2 (undertaking job interviews); (iii) Point 1.3 (transferring job opportunities to you); and (iv) Point 1.5 (maintaining your registration as a jobseeker).
Depending on the context in which you submit your details – applying to a specific vacancy, or registering generally – you will be asked to consent only to the purposes that are relevant to that context.
Effective date: Budapest, 19th August 2026
Notice provided by: Asteria Search Korlátolt Felelősségű Társaság
Represented by: Iván Kolb and Frido Cornelis Diepeveen (authorised representatives)
Effective date: Budapest 19th August 2026
