Controller and contact
HD Direkt Hungary Kft.; registered office: 1087 Budapest, Baross tér 1., 3. emelet 14. Company registration: 01-09-931447. Privacy contact: Géza Balogh, legal counsel and privacy contact, geza.balogh@hddirekt.com; adatvedelem@hrdirekt.com. HDD Pro is a division of this company, not a separate controller.
This notice covers our new own website processes. The previous Hireify system, employment records and temporary staffing have separate notices. Publishing a new text does not create consent or extend an existing retention deadline.
Applying for a particular job
We receive and assess your chosen application, contact you, arrange interviews and coordinate placement for that vacancy. Data include your name, email, phone, optional city, CV and professional details, vacancy identifier, communications and factual recruitment notes. Name and contact information are needed to process the application. Optional fields and refusal of future talent-pool membership do not disqualify you.
Our web application requests a separate, unticked consent for the particular application under GDPR Article 6(1)(a). You may withdraw it; we then cannot continue selection based on that consent. This is separate from future opportunities. Application data may be used for this purpose until selection ends, at most 1 calendar year, or earlier withdrawal. This is our own upper limit, not a statutory CV-retention requirement. At closure, any further retention needs a separate necessity and legal-basis review; applying does not grant two-year general talent-pool permission.
Submission is confirmed only after a successful server response. Choosing a file, completing a form or opening an email is not confirmed submission or consent.
Optional future talent pool
With separate voluntary consent under GDPR Article 6(1)(a), we retain the supplied name, contact details, CV, professional background and job preferences to offer suitable future vacancies by email or telephone. Privacy expiry and consent-management messages may be delivered by email or SMS. This is not permission for newsletters or unrelated advertising.
A new affirmative decision lasts up to 2 calendar years from that decision, or until earlier withdrawal; we confirm the exact expiry. Pool statement: ats-recruitment-2026-11-05-v1. Old deadlines remain unchanged. Silence, opening a message, login or a new application does not renew consent. You can apply to a vacancy without joining. Sending a CV specifically to the talent pool without selecting a vacancy requires pool consent; downloading a local PDF does not.
CV builder, drafts and photographs
Our own career-site builder assembles the PDF in your browser. Download does not send it to HD Direkt, create a candidate account or require recruitment consent. Submit and download is a separate action sending your details and PDF to the chosen application or requested talent pool.
Saving a draft on this browser tab is optional. Without saving, edits remain only while the page runs. When enabled, sessionStorage retains a draft for at most 2 hours without the photograph or consent decisions. Turning saving off, deleting the draft or successful submission removes that stored copy. Browser session restoration can restore tab data: clear drafts and close the tab on shared computers. Downloaded copies on your device are under your control.
A photograph is optional, processed locally for the CV and included in the PDF only if you submit it; the builder does not perform facial recognition or unique biometric identification. Do not include health data, ethnicity, beliefs, union membership, identity-document copies or criminal-record certificates in a general CV. Necessary sensitive or criminal data require a job-specific legal basis and separate information, not blanket CV consent. Templates do not make hiring decisions.
Business enquiries and email
For an enquiry we use company and contact name, business email, optional phone, requirements and message to answer and discuss the request. For a company representative this rests on the parties’ legitimate interest in business communication, GDPR Article 6(1)(f); for an individual requesting a contract in their own name, necessary pre-contract steps rest on Article 6(1)(b). An enquiry is not conditional on marketing consent.
Pro email forms prepare a draft for you to check and send in your mail application. Attach the CV there. Sent email is stored in mail systems; opening the draft is neither delivery nor automatic ATS enrolment. The purpose, notice version and separate yes/no pool decision are included in the prepared email; receipt documents the actual sending time. Correspondence is handled while resolving the matter or maintaining the relevant relationship, with necessity reviewed at closure. A contract, invoice, actual legal dispute and an ordinary enquiry have different retention needs; accounting periods do not automatically apply to CVs.
Access and recipients
Authorised recruitment, HR and operational staff access only data needed for their work. The prospective employer or client for the application may receive relevant recruitment data as an independent controller; the specific recipient and placement circumstances are explained in the particular process. The talent pool is not public and consent does not authorise unlimited onward sale.
Technical services are Cloudflare, Inc. (web delivery and security), Supabase (database, private CV files and server processing), Google Workspace/Gmail (business email), and APPON LINE Kft. / SimpleSMS (number, SMS content and delivery information). Each receives the data needed for its service. Supabase’s published DPA dated 1 August 2026 identifies Supabase Pte. Ltd.; the exact contracting entity and terms depend on the company subscription and can be requested from our privacy contact. Hireify and Elementor documents describe the previous system. Legally required official requests are handled within their necessary scope.
Location and international transfers
Our ATS’s current primary database region is eu-central-2, Zurich, Switzerland, outside the EEA and covered by a European Commission adequacy decision. A database region does not mean every network, support, email or subprocessor operation stays in that region or the EU. International Cloudflare, Supabase and Google services can involve other countries, including the United States and subprocessor locations. Their published DPAs include EU standard contractual clauses (2021/914 SCC). An adequacy decision applies only within its actual scope; Article 46 safeguards depend on the applicable contract and transfer. Contact us for the recipient, country and a copy of the safeguards relevant to your data. Applying does not ask you to waive international-transfer protections.
Cookies, storage and external content
Our new own main site and Pro do not use Google Analytics, Google Tag Manager or Meta Pixel. Fonts are served locally. Delivery and abuse protection can generate IP addresses, times, requested paths, error codes and technical client information at the hosting provider. Necessary security processing rests on the legitimate interest in secure operation; technical logs are not a two-year recruitment profile.
On the career site, remembering advertising attribution for 30 days is optional and starts only after permission in Privacy settings. The choice itself is retained for 180 days to respect refusal; you may change it and remove attribution storage there. CV draft saving is a separate choice. A requested theme preference may be remembered; otherwise the system colour mode works without a saved choice. Decorative intro animations do not store a viewing identifier.
A Google map loads only after Load map. Google then receives IP and technical data and may access its own storage. Maps are optional; disabling removes the embed but cannot undo earlier processing. Text locations and an external map link remain available. Following a social or external link opens that provider’s own service and privacy notice.
Evidence and end of retention
The ATS records the affirmative decision’s time, purpose, channel, notice version, expiry and event identifier. Unticked defaults, silence and a published update are not consent. Withdrawal or expiry stops use for the affected consent purpose and starts an erasure review; this is not a claim of completed instantaneous deletion from every system. Completion is confirmed only after verification.
A minimal consent record or evidence for an actual legal claim may need separate restricted retention. Its basis, necessary data and duration must be assessed for that specific purpose, not used as a blanket reason to keep every CV indefinitely. Restoring a backup does not reactivate withdrawn permission.
Your rights and withdrawal
After a successful online application, a personal management link appears on screen: save it. The original email address and a security check let you withdraw permission for that application. Separate talent-pool permission is managed through the personal link in its confirmation or reminder. Opening a link alone records no decision. If a link is lost or expired, contact the privacy email address to withdraw without giving a reason or creating an account.
Contact our privacy contact, including by replying to a message, for access and a copy, correction, erasure, restriction and, where applicable, portability. Withdraw consent freely, without giving reasons, without affecting earlier lawful processing. You may object to legitimate-interest processing for reasons relating to your situation and to direct marketing at any time.
We request only proportionate identification when justified, not routinely an identity-document copy. Requests normally require a response within one month; an extension must be explained within that period. Necessary request and response evidence is documented. Any refusal or partial response must explain the grounds and remedies.
You can complain directly to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9–11.; postal address 1363 Budapest, Pf. 9.; https://naih.hu. See its current contact page for filing methods. Judicial remedies and compensation under the GDPR are also available; contacting us first is not mandatory.
Sources and human assessment
Form and CV data come from you; communication and selection records arise during recruitment. Referrals, job boards or other sources require separate source, category and legal-basis information by the first contact/disclosure or applicable Article 14 deadline. A publicly available CV does not itself grant talent-pool consent. The public CV builder does not make hiring or rejection decisions; recruitment is assessed by staff. Introducing new profiling or AI processing requires its own assessment and prior information.
Version and earlier documents
Version hdd-web-2026-11-05-v1, 5 November 2026. Earlier published notices remain in the archive; they do not replace the current own ATS pool statement. Employment, payroll and temporary staffing require the applicable separate employer notices.
Provider terms
Earlier notices and employer documents
