Privacy notice for Job Applicants

1. Introduction

OPINIQ LTD (the “Company”, “we”, “us” or “our”) is committed to protecting and respecting your privacy. This Privacy Notice (“Privacy Notice”) explains how we collect and process your personal data in connection with our recruitment activities. It applies where: (a) you submit an application for a role with us (whether as an employee or as an individual contractor/service provider), including via the application form on the relevant vacancy page of opiniq.com, through LinkedIn or other online job portals and recruitment websites (in Cyprus or abroad), by email (including in response to a vacancy we advertise on another website), or through recruitment agencies; and/or (b) we proactively approach you about potential opportunities (for example, via LinkedIn or other professional networks, or after finding your CV in a job portal’s CV database). In all cases, we will make this Privacy Notice available to you and will process your personal data in accordance with it as part of the recruitment process.

This Privacy Notice sets out what personal data we hold about you, how we collect it, how we use it, and with whom we share it. We provide this information to you in line with the EU General Data Protection Regulation (“GDPR”) and applicable Cyprus data protection law, including the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data Law of 2018 (Law 125(I)/2018), as amended.

This Privacy Notice covers the recruitment stage only. If you accept an offer of employment or engagement, we will provide you with our Staff Members Privacy Notice before any further processing begins. That notice covers all personal data we process from the point you accept an offer onwards — including any identity, right-to-work and work-permit data that we need to onboard you and, for relocating employees, to obtain the necessary permits.

Please read this Privacy Notice carefully, along with any other similar notices we may provide when collecting or processing your personal data.

2. WHO COLLECTS YOUR DATA

OPINIQ LTD is the data controller for the personal data processed in connection with recruitment. Our details are as follows:
Company Name: OPINIQ LTD
Reg. No.: HE 450203
Reg. Address: 3 Krinou Street, The Oval Business Centre, 10th floor, Offices 1001–1002, Agios Athanasios, 4103 Limassol, Cyprus
Telephone: +357 95 996 660
Email: hr@opiniq.com

We have not currently appointed a Data Protection Officer (DPO). You may direct any questions or concerns regarding your personal data or this Privacy Notice to us at hr@opiniq.com.

3. WHAT DATA WE COLLECT, WHY, AND HOW LONG WE KEEP IT

The tables below summarise the data we collect and hold, how and why we do so, how we use it, with whom we share it, and for how long we keep it.

We share personal data only where necessary, with the recipients described in the tables below (such as external lawyers, professional advisers, our email and collaboration tools). We apply appropriate technical and organisational measures, such as encryption in transit and at rest where appropriate, access controls and data minimisation. Our service providers that act on our behalf are bound by data processing agreements (GDPR Art. 28) and by confidentiality obligations. We also disclose personal data where the law requires it.

We seek to ensure that our data collection and processing is always proportionate. We will notify you of material changes to the data we collect or the purposes for which we process it.

Where we rely on our legitimate interests, we have assessed that they are not overridden by your interests, rights and freedoms. You can ask us for information about this assessment by emailing hr@opiniq.com.

Special-Category Personal Data

We do not request, and do not wish to receive, special-category personal data (such as data revealing your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic or biometric data, or data concerning your sex life or sexual orientation) as part of the recruitment process. Please do not include such data in your CV, application, or correspondence with us. If you send us such data, we will not use it to assess your application and we will delete it, or ask you to send us a version of your CV without it. If you need an adjustment to take part in the recruitment process (for example, for an interview or assessment), please tell us at hr@opiniq.com which adjustment you need – you do not need to tell us about any underlying health condition. We use this information only to arrange the adjustment, in line with our obligations under employment and equal-treatment law (GDPR Art. 9(2)(b)), and delete it together with your application. We do not ask for information about criminal convictions at the recruitment stage.

3.1. Recruitment and Applicant Records

Data we collect	Recruitment and applicant records: name, contact details (email, phone and, if we communicate that way, your messaging-app username or number), current location (city, country) (if provided); CV/resume and, if you choose to provide one, a cover letter; employment and education history, qualifications, language skills; portfolio/links you provide (e.g., LinkedIn); interview notes, assessment/test results (if applicable); correspondence with you; if you apply through LinkedIn or another job portal: your CV, profile information and answers to screening questions that you choose to share with us through it; offer/negotiation details (if applicable).
How we collect	From you (the application form on opiniq.com, email, messaging apps, interviews, assessments); through our vacancy adverts on LinkedIn and other online job portals, in Cyprus or abroad (the portal holds your account, profile and CV under its own terms and privacy policy, and makes your application available to us, for example in our employer account on the portal, from where we may download it into our own systems); where we advertise a vacancy on another website (for example, a professional association’s website): directly from you, through opiniq.com or by email as the advert directs; that website does not pass your data to us; from recruitment partners and agencies (where applicable); from CV databases of job portals in which you have chosen to make your CV visible to employers, where we search them for a specific vacancy; from publicly available professional sources you share and professional networking profiles relevant to the role (e.g., LinkedIn), where appropriate. We do not review your private social media accounts.
Who has access	Hiring managers and interviewers (including individual contractors engaged by us, some of whom are located outside the EEA – see Section 7); HR / recruitment staff; IT/security (systems operation and incident handling); legal and privacy function (incident and breach assessment).
Purposes	Manage recruitment and assess your suitability; communicate with you and run selection steps; make and administer an offer (where applicable); keep records of the recruitment process and, for a limited period after the outcome, be able to deal with any complaint or legal claim.
Legal basis	Steps you ask us to take before entering into a contract (Art. 6(1)(b) GDPR), when you apply for a vacancy: reviewing your application and assessing your suitability for the role; arranging and conducting interviews and assessments; making an offer (where applicable). Our legitimate interests (Art. 6(1)(f) GDPR): approaching you about a role before you have applied (including where we find your CV in a job portal’s CV database), or reviewing details about you that we receive from a recruitment agency (once you tell us that you wish to be considered, the basis above applies); keeping a note of a request not to be contacted again; dealing with complaints and establishing, exercising or defending legal claims, including keeping your application file for six (6) months after the outcome (see “Retention” below).
Recipients	Our employees involved in recruitment, on a need-to-know basis. Freelance recruiters and HR assistants acting on our behalf, under written agreements with us (including outside the EEA – see Section 7). Recruitment agencies acting on our behalf (if we engage one) that collect applications, screen or interview candidates for us. Software tools we use: our applicant tracking system (cloud-based recruitment software); our email, collaboration and cloud-storage tools. Other recipients, each responsible for its own processing: recruitment agencies that introduce you to us (where applicable); job portals, online platforms and messaging apps through which you apply or through which we communicate with you (for example, LinkedIn), each under its own terms and privacy policy; professional advisers (for example, lawyers), under confidentiality obligations; public authorities, courts and the Commissioner for Personal Data Protection, where the law requires it or where necessary to establish, exercise or defend legal claims.
Retention	During the recruitment process: only for as long as necessary to complete the recruitment process for the role concerned; if you are not hired: we keep your application file (your application and CV, our interview notes and assessments, the decision and our correspondence with you) for six (6) months from the date we tell you the outcome, or from the date you withdraw your application or decline our offer (or, if we could not tell you the outcome, from the date the vacancy is filled, closed or cancelled), only so that we can deal with any complaint or legal claim; we then delete it. During that period, access is limited to HR and Legal and the file is not used for any other purpose, including future vacancies. If you ask us to delete your data earlier, see Section 8; if you applied through a job portal and are not hired: the copy we downloaded into our own systems is kept and deleted as described above. Where the portal allows it, we also delete or close your application in our employer account on the portal within one (1) month of the outcome and, in any event, we do not use it after that date. Your own account, profile and CV on the portal are kept by the portal under its own terms; to delete them, use your account settings or contact the portal; if we approached you and you tell us you are not interested, or you do not reply within 30 days of our first contact: deleted within one (1) month. If you ask us not to contact you again, we keep only a short note of that request, for 24 months, so that we can respect it; CVs sent to us outside a specific vacancy (for example, by email): not kept for future vacancies and deleted within one (1) month of receipt; if you accept our offer: transferred to your personnel file and governed by our Staff Members Privacy Notice from the point you accept the offer; longer only where a complaint or legal claim concerning your application has been made (until it is finally resolved), or where the law requires us to keep the data.

3.2 Reference and Verification Data

Data we collect	Reference and verification data (where relevant and lawful): references (if you provide referees or ask us to contact them); your declared right-to-work/work-eligibility status (e.g., whether you already have the right to work in Cyprus or would require sponsorship). Detailed verification documents (e.g., identity and immigration documents) are collected only after you accept a conditional offer and are dealt with under our Staff Members Privacy Notice.
How we collect	From you; from referees you provide (where contacted, after your explicit permission).
Who has access	HR/recruitment staff; relevant hiring managers (as needed); legal/compliance (if needed).
Purposes	Obtain references and assess your suitability; understand whether sponsorship will be required for the role; record hiring decisions and deal with any complaint or legal claim.
Legal basis	Steps you ask us to take before entering into a contract (Art. 6(1)(b) GDPR): understanding whether sponsorship will be required for the role, as part of assessing your application. Our legitimate interests (Art. 6(1)(f) GDPR): obtaining references from referees you nominate, so that we can make an informed recruitment decision; dealing with complaints and establishing, exercising or defending legal claims.
Recipients	Internal recipients on a need-to-know basis; service providers acting on our behalf supporting recruitment; referees you have nominated. International transfers and safeguards: as described in Section 7.
Retention	As in Section 3.1: kept with your application file for six (6) months from the outcome (or your withdrawal or decline) and then deleted; if you accept our offer: transferred to your personnel file and governed by our Staff Members Privacy Notice; longer only where a complaint or legal claim concerning your application has been made (until it is finally resolved), or where the law requires us to keep the data.

Is providing this information mandatory?

Providing your core application information (such as your name, contact details, and CV) is necessary for us to consider your application. If you do not provide it, we will not be able to process your application or progress you through the recruitment process. Providing any additional information (such as a cover letter or referees) is voluntary, although it may assist us in assessing your application. Any statutory or contractual requirements to provide identity, immigration, or right-to-work documents arise only after you accept a conditional offer and are explained in our Staff Members Privacy Notice.

3.3. Website / Careers Form Technical Data

When you access opiniq.com and submit an application form, your device and browser automatically transmit certain technical data (such as IP address, browser type, device type, and pages visited). This data is processed as described in our website Privacy Policy (https://opiniq.com/privacy-policy/) and Cookie Policy (https://opiniq.com/cookie-policy/). If you view our vacancies on LinkedIn, a job portal or another website, that website’s own privacy and cookie policies apply.

4. WHERE WE OBTAIN YOUR DATA FROM THIRD PARTIES

In some cases, we obtain your personal data from sources other than you directly. This applies where:

• a recruitment agency provides us with your CV or application details;
• we find your CV in a job portal’s CV database in which you have chosen to make it visible to employers;
• we proactively identify you as a potential candidate through publicly available professional sources (e.g., LinkedIn profiles or professional portfolios); or
• a referee provides a reference about you (we contact a referee only where you have provided their details for that purpose).

The categories of personal data we obtain from these third-party sources are: your name and contact details; your CV/resume and the employment, education, and qualification information it contains; your professional profile information; and any reference content provided about you. The purposes, legal bases, recipients, and retention periods for this data are the same as those set out in Section 3.

Where we receive your personal data from a source other than you, we will provide you with this Privacy Notice as soon as reasonably practicable, and in any event within one month of obtaining the data, at the time of our first communication with you, or — if we disclose the data to another recipient — when it is first disclosed, whichever is earliest.

5. WHERE YOUR DATA ARE HELD

Your data are held in our cloud-based systems and by the service providers described in Section 3; our applicant tracking system is hosted in the EU. If you apply through a job portal, the portal also holds your application under its own terms (see Section 3.1). Individual contractors engaged by us who take part in recruitment may access your data remotely from outside the EEA. We have security measures in place to ensure appropriate protection for all data we hold. Where we transfer your data outside the EEA, we do so in accordance with the safeguards described in Section 7 below.

6. KEEPING YOUR PERSONAL DATA SECURE

We have appropriate security measures in place to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal data to those who have a genuine business need to know it. Those processing your data will do so only in an authorised manner and are subject to a duty of confidentiality.

7. INTERNATIONAL TRANSFERS OF PERSONAL DATA

We primarily process personal data within the European Economic Area (EEA). Some of our service providers process data outside the EEA, and individual contractors engaged by us who take part in recruitment access your data from countries outside the EEA. In such cases, we implement recognised safeguards to ensure that your personal data receive an adequate level of protection. Where your personal data are transferred to a country outside the EEA that has not been granted an adequacy decision by the European Commission, we will ensure that appropriate safeguards are in place. Depending on the provider, these safeguards are:

• an adequacy decision of the European Commission (GDPR Art. 45), where the recipient’s country benefits from one;
• the European Commission’s Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914; GDPR Art. 46(2)(c)), which we put in place with each individual contractor or service provider (including any recruitment agency acting on our behalf) located outside the EEA in a country without an adequacy decision, together with
• any supplementary measures identified as necessary in our transfer impact assessment to ensure an essentially equivalent level of protection.

Our individual contractors and service providers may be located in any country, including countries without an adequacy decision. A current list of these countries is available on request from hr@opiniq.com. You can obtain a copy of the relevant safeguards by contacting us at hr@opiniq.com.

8. YOUR RIGHTS

This section explains the rights you have under the GDPR and Cyprus Law 125(I)/2018 in connection with your recruitment/application. Some rights apply only in certain circumstances, which we explain below.

Your right to object. Where we process your personal data on the basis of our legitimate interests, you have the right to object to that processing at any time on grounds relating to your particular situation. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims. To object, contact us at hr@opiniq.com.

How to Exercise Your Rights

Submit requests by email to hr@opiniq.com (or by post to the address in Section 2). Please state which right(s) you wish to exercise and provide sufficient detail to help us identify the relevant data.

If we have reasonable doubts about your identity, we will ask you for information to confirm it before acting on your request. This is to protect you and ensure your data are not disclosed to an unauthorised person. We will respond without undue delay and in any event within one (1) month of receiving a valid request. Where requests are complex or numerous, we may extend by up to an additional two (2) months; if so, we will inform you within the initial month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive (GDPR Art. 12(5)).

Right to be informed. You have the right to receive clear information about how we collect, use, share, and retain your personal data. This Privacy Notice (and any updates we provide) fulfils that obligation.

Right of access. You may request confirmation of whether we process your personal data and, if so, receive a copy and supporting information (categories, purposes, recipients, retention, source, safeguards for international transfers, etc.). Where feasible we will provide copies electronically in a secure format.

Right to rectification. If any personal data we hold about you are inaccurate or incomplete, you can ask us to correct or update them. Please let us know if any information you submitted as part of your application changes (for example, your contact details or availability) so we can keep your application accurate and up to date.

Right to erasure / “Right to Be Forgotten”. You may ask us to delete personal data in certain circumstances, for example where:

• the data are no longer necessary for the purposes for which they were collected;
• you successfully object and no overriding grounds exist; or
• processing was unlawful.

We will keep data only where the law requires it or where it is needed to establish, exercise or defend a legal claim.

Withdrawing your application or asking us to delete it. You can withdraw your application at any time by emailing hr@opiniq.com. If you ask us to delete your CV or application, we will treat this as a withdrawal of your application and delete your application data (including, where the portal allows it, your application in our employer account on any job portal through which you applied) within one (1) month of your request. Your own account and CV on a job portal are controlled by that portal; to delete them, please use your account settings or contact the portal. We will keep specific data only if we need it to establish, exercise or defend a legal claim (for example, where a complaint or claim has already been made or is clearly foreseeable), and we will tell you if so. We keep a short record of your request and our response (your name, contact details, the date of your request and the action we took) for 3 months, to show that we handled your request properly.

Right to restriction of processing. You may request that we suspend the use of your data (while retaining it) where:

• you contest its accuracy (restriction applies while we verify);
• processing is unlawful and you prefer restriction to deletion;
• we no longer need the data but you require it for legal claims; or
• you have objected and we are verifying whether we have overriding grounds.

Right to data portability. For data you provided to us that we process by automated means on the basis of steps prior to entering into a contract, you may request the data in a structured, commonly used, machine-readable format and ask that we transmit it to another controller where technically feasible.

Right to object. As set out under “Your right to object” at the start of this Section 8, where our processing is based on legitimate interests you have the right to object on grounds relating to your particular situation.

Automated decision-making. We do not make decisions about you based on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (GDPR Art. 22). We do not use artificial-intelligence tools to assess, score or rank candidates.

9. HOW TO COMPLAIN

Any query or concern about our use of your data can be directed to hr@opiniq.com. You also have the right to lodge a complaint with the competent supervisory authority. The supervisory authority in Cyprus is:

Commissioner for Personal Data Protection

Address: Kypranoros 15, Nicosia 1061, Cyprus

Phone: +357 22 818 456

Email: commissioner@dataprotection.gov.cy

Website: https://www.dataprotection.gov.cy

You also have the right to lodge a complaint with the supervisory authority of the EU/EEA Member State where you habitually reside, where you work, or where the alleged infringement took place.

10. UPDATES TO THIS PRIVACY NOTICE

We may update this Privacy Notice from time to time to reflect changes in our processing activities, operational practices, or applicable law. We will publish the updated version on our website and revise the “Last updated” date above; where changes materially affect you — such as introducing new purposes of processing, new categories of recipients, or significant retention changes — we will provide additional notice in advance where practicable. If we intend to process your personal data for a purpose other than that for which it was collected, we will inform you before doing so (GDPR Art. 13(3)). Previous versions of this Privacy Notice are available on request