The Information on processing of personal data

Information on the processing of personal data of job seekers by the company by GoHealth, s. r. o.

General information

• The company GoHealth, s. r. o., with its registered office at Nivy Tower, Mlynské Nivy 5, 821 09 Bratislava, Slovak Republic, Id. No.: 48 108 308, registered with the Commercial Register of the District Court Bratislava I, Section: Sro, File No.: 103319/B (“Controller”) processes personal data of natural persons who have addressed the Controller or who have otherwise expressed an interest in becoming its employee, or cooperate with it in another form (e.g. as an entrepreneur - a natural person, or a representative of a business company supplying services for the Controller), or who have been approached by the Controller offering the opportunity to become its employee, or cooperate with it in another form (i.e. applicants for employment or cooperation with the Controller) (“Data subjects”).
• The controller in terms of the applicable legal regulation stated in point 3. below is the company GoHealth, s. r. o., with its registered office at Nivy Tower, Mlynské Nivy 5, 821 09 Bratislava, Slovak Republic, Id. No.: 48 108 308, registered with the Commercial Register of the District Court Bratislava I, Section: Sro, File No.: 103319/B.
• The Controller processes personal data in compliance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”), the Slovak Act No. 18/2018 Coll. on Personal Data Protection and on the Amendment and Supplement to Certain Acts, as amended (hereinafter the “Act on Personal Data Protection”), as well as other applicable legal regulation.
• Contact details of the Controller are as follows: telephone no.: 0907774990; email: pkrauspe2@gohealth.com
• The Controller processes personal data of Data subjects to the following extent: name, surname, title, correspondence address, e-mail address, telephone contact and other personal data, which the Data subject has stated in his or her CV, or otherwise provided to the Controller in applying for a job or other cooperation, as well as in in the selection process.
• The purpose of the processing of personal data of the Data subjects is:
  • the evaluation of abilities, skills and personal qualities of the job seeker (i.e. the Data subject) and the performance of a selection process for a designated job or other position; and
  • re-addressing the unsuccessful job seeker (i.e. the Data subject) with a job offer of the Controller or an offer for mutual cooperation and performance of a selection process for a new job or other position designated by the Controller.
• The legal basis for the processing of the personal data of Data subjects by the Controller is:
  • compliance with legal obligations under Act no. 311/2001 Coll. the Labor Code, as amended, or other applicable legislation;
  • performance of pre-contractual measures at the request of the Data subject prior to entering into an employment or other contract due to the fact that during the selection process, an offer for the conclusion of an employment or other contract may be submitted by the Controller; and
  • a written consent of the Data subjects to the processing of personal data.
• Personal data of the Data subjects are transferred by the Controller to third countries¹ by providing them to the following recipient: the company GoHealth US, with its registered office at 214 West Huron St., Chicago, Illinois, which participates in the selection process of Data subjects through its representatives. The transfer of personal data takes place while ensuring adequate safeguards in the form of standard contractual clauses on the protection of personal data approved by the European Commission concluded with this company established in a third country outside the EU.

  ¹ A third country means a country which is not a Member State of the European Union or a Contracting Party to the Agreement on the European Economic Area.

• Personal data are provided and made available only to natural persons - authorized employees of the Controller for the purposes of their recording, storage and use in the selection process.

  Personal data is also provided to the company GoHealth US, with its registered office at 214 West Huron St., Chicago, Illinois, which has the status of a processor in relation to the Controller and data processing, for the purposes of commenting on the suitability of the Data subject (i.e. candidate) for the relevant job or other position and use of the personal data within the selection process and the selection of a qualified candidate.

  Personal data will not be published or otherwise provided to third parties, except in the cases mentioned in the previous part of this point and in cases where this obligation is imposed by law, directly enforceable legally binding act of the European Union or international agreement by which the Slovak Republic is bound.

• Provision of personal data by the Data subjects is a legal obligation as well as a requirement necessary for the conclusion of the contract and their non-provision would prevent the conclusion of an employment or other contract with the Data subject.
• The Controller processes personal data of the Data subjects by automated means - CVs and other documents provided to the Controller by Data subjects are sent by e-mail, via the contact form on the Controller's website or by other electronic means.
• The Controller obtains personal data concerning Data subjects directly from Data subjects. The Controller may also obtain personal data from publicly available sources (e.g. relevant registers, information published by the Data subject on the internet, etc.).
• The Controller processes and stores personal data of:
  • Data subjects, in particular jobseekers, who have been successful in the selection process, only for a limited period of time, while the personal data is deleted when it is no longer needed for the purpose of the processing referred to above. This means that the personal data of Data subjects is stored by the Controller during the selection process and destroyed immediately after the end of the selection process; and
  • Data subjects, in particular jobseekers, who have not been successful in the selection process, only for a limited period of time, i.e. for the duration of the selection process. In case a written consent has been given by a Data subject to the Controller, personal data is further stored for the duration of such consent (typically, for a period of 1 year from the date of its granting).

Rights of Data subjects

• Under the GDPR, as well as under the Act on Personal Data Protection, the Data subject has the following rights:
  • The right to request from the Controller access to personal data concerning the Data subject;
    • The Data subject has the right to obtain a confirmation from the Controller as to whether personal data concerning him or her are being processed. In the event that the Controller processes such personal data, the Data subject has the right to obtain access to such personal data and information on (a) the purpose of the personal data processing, (b) the category of personal data processed, (c) the recipients or category of recipients to whom the personal data have been or will be provided, (d) the retention period of the personal data; (e) the right to request from the Controller the rectification of personal data concerning the Data subject, their deletion or restriction of their processing, or the right to object to the processing of personal data, (f) the right to lodge a motion to initiate proceedings pursuant to § 100 of the Act on Personal Data Protection, (g) sources of personal data, if personal data were not obtained from the Data subject and (h) the existence of automated individual decision-making, including profiling pursuant to Article 22 GDPR (1) and (4); and (i) the appropriate safeguards established under Article 46 of GDPR, if the Controller transfers personal data to a third country or an international organization.
    • The Controller is obliged to provide the Data subject free of charge with his or her personal data that are being processed, confirmation of personal data processing and information on personal data processing to the extent defined in Part B: point 1 (i) above
  • Right to rectification of personal data;
    • The Data subject has the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning the Data subject. With respect to the purpose of processing personal data, the Data subject also has the right to have incomplete personal data concerning the Data subject completed, including by means of providing a supplementary statement.
    • The Controller is obliged to rectify and/ or supplement incorrect and/ or outdated personal data that are the subject of processing by the Controller, on the basis of a request from the Data subject. At the same time, the Controller is obliged to inform all recipients to whom the Controller provides personal data of the Data subject about these changes, if this does not prove impossible or does not require disproportionate effort.
  • Right to erasure (‘right to be forgotten’);
    • The Data subject has the right to obtain from the Controller without undue delay the erasure of personal data which are processed that concern the Data subject.
    • The Controller is obliged to erase the personal data of the Data subject in the following cases: (a) personal data are no longer necessary in relation to the purposes for which the Controller collected or otherwise processed them; (b) Data subject has withdrawn his or her consent to the processing of his personal data (if applicable) and there is no other legal ground for the processing of the personal data; (c) the Data subject has exercised his or her right to object to the processing of his or her personal data and at the same time there are no overriding legitimate grounds for the processing of his or her personal data; (d) personal data are being processed unlawfully; (e) the reason for the deletion is the fulfilment of an obligation under the GDPR, the Act on Personal Data Protection, a special regulation or an international agreement by which the Slovak Republic is bound.
    • The Data subject's right to erasure of personal data and the Controller's obligation to delete personal data do not apply in cases where the processing of personal data is necessary for: (a) the exercise of the right to freedom of expression or the right to information; (b) the fulfilment of an obligation under the GDPR, the Act on Personal Data Protection, a special regulation or an international agreement by which the Slovak Republic is bound or for the fulfilment of a task carried out in the public interest or in the exercise of public power entrusted to the Controller; (c) for reasons of public interest in the field of public health (d) for archiving purposes, for scientific purposes, for historical research purposes or for statistical purposes, or if it is probable that the Data subject's right to erasure will make it impossible or seriously more difficult to achieve the objectives of such processing; or (v) asserting of a legal claim.
    • The Controller is obliged to inform all recipients to whom the Controller has provided the personal data of the Data subject, of the erasure of personal data of the Data subject, if this does not prove impossible or does not require disproportionate effort.
    • The Controller is obliged to inform the Data subject about the recipients in cases where the Data subject so requests.
  • Right to restriction of processing of personal data;
    • The Data subject has the right to obtain from the Controller the restriction of processing of personal data if any of the following applies: (a) the Data subject contests the accuracy of the personal data for a period enabling the Controller to verify the accuracy of the personal data; (ii) the processing of personal data is unlawful and the Data subject opposes the erasure of the personal data and request the restriction of their use instead; and (iii) personal data are no longer needed for the purposes of the processing, but the Data subject requires them to establish, exercise or defend his legal claims.
    • The Controller is obliged to restrict the processing of personal data of the Data subject in the cases listed in Part B: point 1, subparagraph (iv) above. At the same time, the Controller is obliged to inform all recipients about the restriction of the processing of personal data of the Data subject, if this does not prove impossible or does not require disproportionate effort.
    • The Controller is obliged to inform the Data subject about the recipients in cases where the Data subject so requests.
  • Right to object the processing of personal data;
    • The Data subject has the right to object to the processing of personal data if this processing concerns the Data subject and if the processing is necessary for: (a) fulfilling a task performed in the public interest or in the exercise of public power entrusted to the Controller; or (b) the purpose of the legitimate interests of the Controller or a third party; or (c) for the purpose of direct marketing, including profiling, to the extent that it relates to direct marketing.
  • Right to data portability;
    • The Data subject has the right to receive his or her personal data which concerns the Data subject and which the Data subject has provided to the Controller in a structured, commonly used and machine-readable format and to transmit this data to another controller, if the following conditions are cumulatively met: if (a) it is technically possible; (b) the personal data of the Data subject is processed on the legal basis of the Data subject's consent or performance of the contract; and (c) the processing of personal data is carried out by automated means.
  • Right to lodge a motion to initiate proceedings on personal data protection with the Office for Personal Data Protection of the Slovak Republic (the “Office”);
    • The Data subject has the right to lodge a motion for personal data protection proceedings with the Office, the purpose of which is to determine whether the Data subject's rights have been violated during the processing of his or her personal data or whether the GDPR or a special regulation in the field of personal data protection has been breached.
    • A model application to initiate proceedings on personal data protection is published on the Office's website.
  • Right to withdraw consent to the processing of personal data;
    • Given that the Controller processes the personal data of certain Data subjects (namely unsuccessful jobseekers) for the purpose defined in Part A: point 6 (ii) above also on the legal basis of the written consent of the Data subject, these Data subjects (unsuccessful job seekers) have the right to withdraw the consent already granted to the processing of personal data, by email to pkrauspe2@gohealth.com or in writing to the address of the Controller's registered office.
  • Automated individual decision-making, including profiling;
    • The Controller does not perform automated individual decision-making, including profiling. In the event that such processing takes place, the Controller shall provide the Data subject with information on the procedure used, as well as on the meaning and expected consequences of such processing of personal data for the Data subject.
    • In any event, the Data subject has the right not to be subject to a decision which is based exclusively on the automated processing of personal data, including profiling, and which has legal effects affecting or similarly significantly influencing the Data subject. The Data subject does not have this right if the decision is (a) necessary for the conclusion of a contract or the performance of a contract between the Data subject and the Controller; (b) carried out on the basis of a special regulation or an international agreement by which the Slovak Republic is bound, and in which appropriate measures guaranteeing the protection of the rights and legitimate interests of the Data subjects are also laid down; or (c) based on the express consent of the Data subject.

Rights and obligations of the Controller in exercising the rights of the Data subject

• The Controller shall provide the Data subject with the information referred to in Part B: point 1 above concerning the processing of the Data subject’s personal data, in a concise, transparent, comprehensible, clearly worded and easily accessible form. The Controller is obliged to provide the information according to the previous sentence in paper form or in electronic form, usually in the same form in which the application was submitted. If requested by the Data subject, the Controller may also provide information orally.
• The Controller shall provide cooperation to the Data subject in exercising his or her rights under Part B: point 1 above.
• The Controller shall provide the Data subject with information on the measures taken on the basis of his or her application by which the Data subject exercises rights defined in Part B: point 1. above within one month of receipt of the application. The Controller may, in justified cases with regard to the complexity and number of applications, extend this period by another two months, even repeatedly. The Controller is obliged to inform the Data subject of any such extension within one month from the delivery of the application, together with the reasons for the extension. If the Data subject has submitted the application in electronic form, the Controller will provide the information in electronic form. The Controller will provide the information in electronic form, unless the Data subject has otherwise requested the provision of the information.
• If the Controller fails to take measures on the basis of an application by which the Data subject exercises his rights as defined in Part B: point 1 above, the Controller is obliged to inform the person concerned within one month of receipt of the Data subject’s application of the reasons for failure to act and of the possibility to lodge an application with the Office under Part B: point 1 (sub) (vii) above and para. § 100 of the Act on Personal Data Protection.
• Notifications and measures taken by the Controller on the basis of an application by which the Data subject exercises his or her rights defined in Part B: point 1. above shall be provided free of charge. If the request of the Data subject is manifestly unfounded or disproportionate, in particular due to its recurring nature, the Controller may:
  • request a reasonable fee taking into account the administrative costs of providing the information or a reasonable fee taking into account the administrative costs of carrying out the requested measure; or
  • refuse to act upon request.
• The Controller may request the provision of additional information necessary to confirm the identity of the Data subject if it has reasonable doubts about the identity of the natural person requesting the exercise of the Data subject's rights as defined in Part B: point 1 above.