Privacy Policy & Legal Notices

PRIVACY NOTICE FOR JOB APPLICANTS

Effective as of 1 of July 2024

As part of any recruitment process, Huvepharma EOOD collects and processes personal data relating to job applicants. Please read this privacy notice carefully to learn why and how we process your personal information.

Who is responsible for data processing?

With respect to the applicable EU Data Protection law (Regulation (EU) 2016/679,  or GDPR), the company responsible for processing your personal data as a data controller is: Huvepharma EOOD, having its seat and registered address at 3a, Nikolay Haytov Str., 1113 Sofia, Bulgaria, website https://huvepharma.com/ ("Huvepharma", "we", "us").

It has appointed a Data Protection Officer (DPO), whom you can reach at [email protected], if questions with data processing arise.

Leading principles in data processing

Huvepharma values privacy and considers data protection seriously. It abides by all applicable legal restrictions on data protection, it does not share personal data without permission, it guarantees data and information is stored in a secure manner and provides for transparency, communication, and appropriate conditions for data subjects to exercise their rights. Huvepharma bases all processing activities on the main data protection principles - lawfulness, fairness, transparency, specific and explicit purposes, data minimization, data accuracy, storage period minimization and control, security of data, and accountability.

Personal data we collect

In the context of the evaluating your job candidacy, we may collect and further process the following personal data:

• Identification data - name, citizenship, date and place of birth, gender, photo
• Contact details - e-mail address, phone number
• Details about your education, professional experience, foreign language proficiency, skills and any certifications or other professional qualifications you have
• Specific data collected in the recruitment process: interviewer's notes and your test and questionnaire results
• Other information that you have voluntarily included in your CV, cover letter or otherwise have shared during interviews (such as current or desired salary, professional memberships, general interests, hobbies, etc.)

Why we collect your personal data

• To perform a preliminary selection, review, and evaluation of all applicants with respect to job vacancy suitability
• To communicate with you during the recruitment process
• To manage the recruitment procedure and to make hiring decisions
• To prepare a proposal for concluding an employment contract with Huvepharma, in case you are assessed as a suitable candidate for the relevant position
• To consider you for future job openings if you have explicitly consented

What is the legal basis for data processing?

We process your personal data in the recruitment process based on a pre-contractual relationship, i.e., steps on your part prior to entering an employment contract with Huvepharma EOOD. We may also rely on Huvepharma legitimate interest to find and recruit appropriate and skilled candidates for the company's open positions.

In some cases, we may need to process data to respond to legal claims and defend Huvepharma legal rights.

Based on your consent, we may keep your data to contact you for further job opportunities within the organization or future job openings which match your skills and/or professional expertise.

You can withdraw your consent at any time by sending an email to [email protected], which does not affect the lawfulness of processing before consent withdrawal.

Whom we may share personal data with                                                                                                           

Considering regulatory requirements, we may share your personal data with: 

• Companies that support our IT infrastructure, providers of hosting services or cloud-based software services. These third parties process personal data on behalf of Huvepharma, and based on a written agreement, which provides for appropriate organizational and technical measures for personal data protection
• HR companies/talent recruitment agencies, when we decide to involve these in staffing for particular job openings
• Responsible state, local and other authorities, with respect to Huvepharma legal obligations

How long we retain your data

In case your job candidacy is unsuccessful, we will retain your personal data for a period of 6 (six) months upon completion of the recruitment procedure. 

The internal documents created by Huvepharma in the recruitment procedure for a specific role that may contain your personal data will be stored for a period of 3 (three) years upon completion of the respective procedure to defend our legal interests under the applicable national anti-discrimination law.

Based on your explicit consent, we will keep your personal data for consideration for future employment opportunities for a period of 1 (one) year upon completion of the recruitment procedure. After his period, your data will be erased from our records.

Security measures

Huvepharma EOOD is applying all necessary physical, organizational and technical measures to protect your personal data from unauthorized access, usage, disclosure, or loss. Measures include minimizing categories and volume of processed data with respect to specific purposes, ensuring data restoration of access and availability in cases of technical or physical incidents, ongoing employees' training and confidentiality engagement, additional data protection agreements with processors, and maintaining a certified integrated management system with respect to Quality and Information Security standards - ISO 27001:2022. 27701:2019 and ISO 9001:2015.

Currently, all personal data that Huvepharma collects is processed in Bulgaria and the European Economic Area (EEA) and is not transferred to recipients in third countries.

Huvepharma does not apply automated decision-making in the recruitment processes.

How do we collect personal data and do you have an obligation to provide it to us

We usually collect most of the personal data processed in the recruitment process directly from you. We may also collect personal data about you from third parties, such as current or former employers and points of reference if you have provided us with your consent to contact these parties.

The provision of personal data is voluntary but necessary in the recruitment process. You are not obliged under applicable legislation to provide us with your personal data. However, if you don’t provide it, we may not be able to proceed with your job candidacy.

What are your rights

As a data subject and in the context of the recruitment procedure, you have and can exercise the following rights:

• to access your personal data, as well as to receive a copy of it
• to correct or complete any incorrect/incomplete personal data
• to delete/erase personal data, processed with no legal basis ("right to be forgotten")
• to restrict processing of personal data, in case of a legal dispute with Huvepharma or for the purposes of defending legal claims
• to object to data processing in cases your data is processed based on a legitimate interest of the company
• to data portability in a structured, commonly used, and machine-readable format, when data is processed based on a contractual obligation or consent
• not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects for you or significantly affects you
• to lodge a complaint with the Commission for Personal Data Protection of Bulgaria (CPDP) in cases you think your privacy rights are violated by Huvepharma EOOD

More information on how you can lodge a complaint with CPDP can be found at www.cpdp.bg.

In compliance with the Bulgarian Personal data protection act, you can exercise your privacy rights by submitting a written request to Huvepharma's postal address (available at the beginning of this notice) or to the following email - [email protected]. You can also submit it by the order provided for in the Electronic document and electronic trust services act.

Requests for exercising rights are submitted personally or using a power of attorney. You can expect a response within one (1) month of receiving the request, and within two (2) additional months, if this is required by the complexity of the request or the total number of requests received.