Effective from: 28 October 2026
Pygmalios, s.r.o., registered office Jakubovo námestie 19, 811 09 Bratislava, Slovakia (“Pygmalios” or “the company”), issues this notice on the processing of personal data of candidates for employment and cooperation (“the Notice”).
The Notice explains clearly and transparently how and why we process the personal data of people who are interested in working or cooperating with us, for what purposes we use it, to whom we disclose it, how long we keep it and what rights the people concerned have.
It is intended to fulfil the information obligations of Pygmalios as a controller under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of personal data (“GDPR”).
We may update the Notice from time to time, in particular when the way we process personal data or the law changes. We will inform you of material changes in an appropriate way.
1. Who processes your personal data and how can you contact us?
The controller of your personal data is Pygmalios, s.r.o., identified at the beginning of this Notice.
If you have questions about the processing of your personal data or want to exercise your rights under GDPR, you can contact us:
- by e-mail: privacy@pygmalios.com
- in writing: at the registered office address given at the beginning of this Notice.
2. Whom does this Notice cover and where do we obtain personal data?
This Notice applies to people who apply for an employment contract, an agreement on work performed outside an employment relationship or other personal cooperation with Pygmalios, including potential contractors and self-employed persons. It also applies to people who contact us when no position is open, and to potential candidates whose contact details we obtain for possible future cooperation.
Where we consider cooperation with a legal entity, the Notice may apply to the natural persons whose personal data we process when assessing their expertise or suitability to perform the work personally. It does not apply to the data of the legal entity itself.
We obtain personal data mainly directly from you: from your CV, cover letter, your response to a job offer, our communication and job interviews. Where justified, we also obtain data from professional assignments completed during the selection.
We may also obtain data from professional profiles and job portals (mainly LinkedIn and occasionally Profesia) or from people who recommended you for cooperation. We do not carry out general checks of your private social media accounts. If we obtain your data from a source other than you, we will give you the information required by Art. 14 GDPR within one month of obtaining it at the latest; if we contact you before then, at the latest at our first communication.
Once an employment or similar contractual relationship begins, further processing of your data is covered by a separate notice on the processing of personal data for employees and contractors, which you will receive.
3. What personal data do we process, for what purposes and on what legal bases?
When selecting new staff or contractors we process personal data for the purposes listed below. Not every category of data or legal basis applies to every candidate; it depends on the nature of the particular selection and the intended contractual relationship.
Selecting candidates for employment or personal cooperation and running the selection process.
Personal data: Name and surname, contact details; information from your CV and accompanying communication; education, qualifications, professional skills and work experience; information from a relevant professional profile; information you give us in interviews, any notes and assessments related to the selection; results of any professional assignments; information on the position sought and the terms of cooperation.
Legal basis: Art. 6(1)(b) GDPR: taking steps at your request before entering into an employment or other contract to which you would be a party. Art. 6(1)(f) GDPR: our legitimate interest in finding and assessing suitable candidates, in particular when we approach you, or when the contract would be concluded with another person (for example a legal entity).
Keeping a limited database of potential candidates and contacting them occasionally about future job or project opportunities.
Personal data: Name, surname, e-mail address and a short description of your professional specialisation or focus.
Legal basis: Art. 6(1)(f) GDPR: our legitimate interest in keeping a reasonable overview of suitable professionals for future needs and contacting them occasionally, unless your rights and freedoms override this interest. We do not normally keep full CVs for this purpose.
Keeping your full CV for future selection processes beyond the current one, where applicable.
Personal data: The information in your CV and any accompanying materials; the record of your consent being given and withdrawn.
Legal basis: Art. 6(1)(a) GDPR: your separate, voluntary consent, only if we offer you this option and you give it. Not giving or withdrawing consent has no effect on how you are assessed in the current selection process.
Protecting the company’s rights and handling any objections, complaints and legal claims related to the selection process.
Personal data: Identification and contact details; relevant selection communication and documentation; information on how you were assessed and the decision; documents needed to establish, exercise or defend claims, always only to the extent necessary.
Legal basis: Art. 6(1)(f) GDPR: our legitimate interest in protecting the company’s rights and legal claims and in demonstrating a lawful and non-discriminatory selection process. Where special categories of data must be processed for legal claims in a particular case, Art. 9(2)(f) GDPR also applies.
We do not ask you for information unrelated to assessing your professional suitability. For candidates for employment we respect in particular the restrictions under Section 41 of the Slovak Labour Code. We do not ask for special categories of personal data (for example data on health, religion or political opinions) for the purposes of a normal selection.
Providing the data needed to assess your application or prepare a contract is voluntary, but without it we may not be able to assess your suitability, continue the selection or prepare the contract. Providing data for the database of future candidates, or consenting to the storage of your full CV, is not a condition for taking part in the selection.
Where we process personal data under Art. 6(1)(f) GDPR, you have the right to object on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds that override your rights and freedoms, or a need for the data to establish, exercise or defend legal claims.
4. To whom do we disclose your personal data?
Only people involved in the selection process have access to your data, in particular members of management, responsible staff and interviewers, always to the extent needed to assess your suitability.
Depending on the circumstances, we may disclose personal data in particular to these categories of external recipients:
- providers of job and professional portals and of communication services through which the work communication or candidate sourcing takes place;
- providers of IT, cloud and software services, mainly for running e-mail, storing documents and securing information systems;
- providers of legal and other professional advisory services, where necessary to protect the company’s rights or to handle the matter;
- competent public authorities, in particular courts or other bodies, where disclosure is required by law or necessary in connection with proceedings.
Some recipients process data on our behalf as processors under Art. 28 GDPR; others act as separate controllers. Their role depends on the actual nature of the service. We will provide the current list of the specific processors involved in processing your data on request, through the contact details in this Notice.
5. Do we transfer your personal data to third countries?
When we use some IT, cloud, communication and professional services, your personal data may be transferred to countries outside the European Economic Area (EEA) or made available to recipients in those countries.
Where such a transfer takes place, we follow Chapter V GDPR. A transfer may rely on a European Commission adequacy decision or on appropriate safeguards, in particular standard contractual clauses approved by the European Commission, supplemented by further measures where needed.
We will provide information on specific transfers and the safeguards used, including how to obtain a copy of them, on request.
6. How long do we keep your personal data?
We keep personal data only as long as needed to carry out the relevant selection process. After it ends we delete the data, or limit further storage to what is necessary where this is needed to protect legal claims.
In the database of potential candidates we keep only limited contact and professional data, for as long as it is reasonably current and needed for a possible job or project approach. If we keep your full CV for future selection processes based on your separate consent, the retention period will be stated when we ask for the consent; after you withdraw it, we delete the data for this purpose unless another legal reason to keep it exists.
If you become our employee or contractor, the data needed to establish and manage that relationship will be processed under the separate notice for employees and contractors. When the relevant periods expire, we delete or anonymise the data.
7. How do we protect personal data?
We take appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, misuse, damage or unauthorised disclosure.
These measures include in particular access rights limited to what is needed, protection of user accounts, secure electronic communication and data storage, internal confidentiality rules and other security procedures that take the risks of the processing into account.
8. Do we use automated decision-making, including profiling?
When selecting candidates we do not take decisions based solely on automated processing of personal data, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
9. What rights do you have and how can you exercise them?
Under GDPR you have the following rights in relation to the processing of your personal data:
- Right of access: to obtain confirmation of whether we process your personal data, information about the processing and a copy of the data.
- Right to rectification: to ask us to correct inaccurate personal data or complete incomplete data.
- Right to erasure: under the conditions set by GDPR, to ask for your personal data to be erased, in particular where it is no longer needed for the purpose for which it was collected.
- Right to restriction of processing: in the cases set by GDPR, to ask us to restrict the processing of your personal data.
- Right to data portability: under the conditions set by GDPR, to receive the personal data you provided to us in a structured, commonly used and machine-readable format, or to ask for it to be transmitted to another controller.
- Right to object: to object to processing of your personal data based on our legitimate interest, on grounds relating to your particular situation.
- Right to withdraw consent: where we process data based on your consent, you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal.
- Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, with the exceptions set by GDPR.
Your rights are not absolute; whether they apply depends on the specific circumstances and legal conditions.
You can exercise your rights by e-mail at privacy@pygmalios.com or in writing at the Pygmalios registered office. We will respond without undue delay, as a rule within one month of receiving the request; in justified cases this period may be extended by a further two months, and we will let you know. Handling a request is normally free of charge. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.
10. Right to lodge a complaint with the supervisory authority
If you believe that we are breaching GDPR or other data protection rules when processing your personal data, you have the right to lodge a complaint, or a request to start data protection proceedings, with the competent supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Galvaniho Business Centrum II
Galvaniho 7/B
821 04 Bratislava
Website: dataprotection.gov.sk