Privacy notices

Recruitment Privacy Notice

In this Recruitment Privacy Notice, we describe how we may process your personal data in connection with our recruitment processes and the rights you have with respect to such processing.

1. About Phrase

This Privacy Notice applies to personal data of job candidates processed by any company within the Phrase Group which offers a job position to job candidates; such employer company is the data controller with respect to the personal data of job applicants. Phrase Group (“Phrase” or “we”), for the purposes of this Privacy Notice, includes the following companies, which are jointly responsible for compliance with the applicable data protection legislation, Phrase a.s. is primarily responsible for exercising the rights of data subjects and providing information about data processing: 

• Phrase a.s., with its registered office at Václavské náměstí 2132/47, 110 00 Prague 1, Czech Republic;
• Phrase GmbH, with its registered office at ABC-Straße 4, 20354 Hamburg, Germany;
• Phrase UK Ltd, with its registered office at 73 Cornhill, EC3V 3QQ, London, United Kingdom;
• Phrase OpCo Ireland Limited, with its registered office at Unit A6, Santry Business Park, Swords Road, D09 X651 Dublin 9, Ireland;
• Phrase OpCo Spain, S.L., with its registered office at Calle Entença, 325-335, Planta 1ª, 08029 Barcelona, Spain;
• Phrase, Inc., with its office at 350 East Avenue, Suite 203 in Rochester, NY 14604, United States of America.
  

2. What personal data do we collect about you?

In the course of the recruitment process, we may ask you to provide or receive certain personal data, including but not limited to: 

• Identification data, which includes but is not limited to, your first and last name, title, date of birth, photograph and preferred pronouns;
• Contact details, which means personal information that allows us to contact you, such as your permanent residence and/or home address, phone number, and personal email address;
• Data related to work or study performance, such as information about your education, training, previous experience, and references;
• Identifiers and details about official documents (as necessary), which may include details about your ID card, passport, residence and work permits, social security, etc.;
• Suitability information, which means the data we use to assess whether you are a suitable candidate for a particular position, especially our assessment of your interview performance and test results. Depending on the requirements of the position you apply for, we may ask you to complete a personality assessment test or a career aptitude test. 

The exact scope of personal data processed in connection with recruitment for a specific position will depend on the type of position offered and on the market practice and local law requirements applicable to the respective Phrase affiliate.

3. How do we obtain your personal data?

We collect your personal data submitted during our recruitment process, or records obtained when you engage with Phrase. 

We may also receive personal data about you from other sources, such as recruitment agencies, public authorities, and publicly available sources. 

4. Why We Collect Your Personal Data

Within the recruitment process, we process your personal data for the following purposes:

• The hiring process

Candidates can apply to jobs via Phrase Careers page. We may also choose to reach out to suitable candidates on LinkedIn and invite them to apply for the relevant position based on our legitimate interest.

During the selection process, including the screening of candidates, we use identification and contact details, job performance data, and data on your suitability for the position in question. This data is processed under the legal basis of legitimate interest.

After that, personal data, such as first and last name, title, date of birth, permanent address, and personal email address, is processed under the legal basis of performance of the contract and implementation of pre-contractual arrangements, such as the preparation of an employment contract.

• Keeping your information to contact you with relevant job offers within three years.

Based on your consent, we may store your information in our candidate database and thus process your identification, contact details, and personal performance personal data to contact you with relevant future job offers. We may also use your data from the candidate database to better understand what kinds of job candidates are interested in the careers we offer. With your consent, we may process the data for up to three years after the end of the recruitment process. You may withdraw your consent at any time by contacting privacy@phrase.com. All data processing before revocation of your consent remains valid.

• Keeping your information for the purposes of protection against future lawsuits.

Based on our legitimate interest, we may keep some portion of your data for a period necessary for us to defend ourselves in case of any potential future lawsuits.

• Keeping the minimum amount of information necessary to maintain an opt-out list.

• Contract preparation and onboarding processes

• Keeping your information for a period of six months to contact you with an offer for the job for which you applied

If you didn’t provide consent to be included in our database of candidates (point (b) of this section), we can still contact you within six months of the rejection letter in case a different candidate either didn’t accept the offer or their employment was terminated during the probation period. The legal basis of this processing is our legitimate interest in contacting you with a relevant job offer.

• Creating internal accounts for a selected candidate

To ensure a seamless onboarding process based on our legitimate interest, if we send you an offer and you accept, we will create internal accounts for you (for example, an email account, an account in Personio – an employee management software used by us that contains your personal data).

5. How long will we keep your personal data?

We take reasonable steps to ensure that we retain your personal data only for as long as is necessary for the purposes for which it was collected.

By submitting the application form, you acknowledge that Phrase may store and process your personal data for the duration of the recruitment process, and your personal data will be deleted without delay after completion of the recruitment process, unless a longer storage period is required or permitted by law (see Section 4 above).

If you have provided your consent with the processing and retention of your personal data in Phrase candidate database in order to receive notifications about future job opportunities at Phrase, we may retain your personal data in our database for the period of 3 years following the submission of the application form (or for such other period for which the specific consent was given).

6. With whom do we share your personal data?

Your Personal Data may be processed and stored by Phrase’s trusted third party software providers whose services are essential for the recruitment process with Phrase. Any other disclosures to third parties will only be made when required by the applicable law.

Phrase requires these third parties to provide at least a comparable level of protection to your personal data as Phrase provides, to keep your personal data confidential, to only process your personal data for the purposes for which it was disclosed and to only access the minimum amount of personal data they need to deliver specific services related to the recruitment process. 

List of third party suppliers:

• Google Ireland Limited, with offices at Gordon House, Barrow Street, Dublin 4, Ireland – email client and document storage provider;
• Greenhouse Software, Inc., with offices at 18 West 18th Street, 6th Floor, New York, NY10011, USA – applicant tracking and recruiting software provider;
• Howlings s.r.o., ID No. 27572102, with offices at Vítkova 244/8, Karlín, 186 00 Praha, Czech Republic – recruitment and advertising platform provider;
• LinkedIn Ireland Unlimited Company, with offices at Wilton Plaza, Wilton Place, Dublin 2, Ireland;
• Slator AG, with offices at Klosbachstrasse 103 Zürich, 8032 Switzerland – recruitment and advertising platform provider;
• StartupJobs.com s.r.o., ID No. 29153786, with offices at Šostakovičovo náměstí 1515/5, 155 00 Praha 5 – Stodůlky, Czech Republic – recruitment and advertising platform provider.

Apart from the third-party software suppliers, your personal data may be shared with other Phrase Group affiliates (as defined above) and with selected recruitment agencies.

7. Transfers of your personal data outside of your home country

Your personal data may be transferred to, stored and processed in the countries outside the European Economic Area (EEA) to countries in which Phrase, its affiliates and suppliers are located or maintain facilities. These countries include the USA and the United Kingdom.

We reserve the right to change our business partners and/or data locations. When we transfer any personal data to the USA or any other country outside the EU or EEA in which Phrase, its affiliates, contractors, suppliers or vendors maintain facilities, we will implement such appropriate legal mechanisms as are required by EU data protections laws to ensure an adequate level of personal data protection by such third parties receiving your personal data.

When transferring personal data to third countries outside the EEA, we will rely (i) either on adequacy decisions of the European Commission under Article 45 of the GDPR (where the European Commission recognizes that a third country ensures a level of protection adequate to the GDPR) or (ii) on standard contractual clauses agreed with the parties with which we share the data internationally.

The countries recognized by the European Commission as having an adequate level of protection can be found on the webpages of the European Commission here, and include, among others, also the USA (when sharing personal data with commercial organizations participating in the EU-US Data Privacy Framework), Japan (when sharing personal data with private sector organizations) and Canada (when sharing personal data with specific federally regulated organizations).

Where we cannot rely on the adequacy decision, we will rely on data transfer agreements based on model standard contractual clauses (SCCs) approved by the European Commission to ensure that the persons to whom we transfer data in those countries commit to ensure an adequate level of protection of your personal data. In addition to the SCCs we require strict security standards and measures to be employed by each of our processors and sub-processors, including additional technical and organizational measures as required by applicable EU case law and guidelines. We also contractually require our processors and sub-processors to provide us with a prompt notice of any data breach or security incident concerning processed data. 

8. Protecting your personal data

We have implemented and will maintain appropriate technical and organizational measures, internal controls, and information security routines in accordance with good industry practice while keeping in mind the state of technological development in order to protect your data against accidental loss, destruction, alteration, unauthorized disclosure or access or unlawful destruction. Such measures may include, without limitation, taking reasonable steps to ensure the reliability of employees having access to your data and providing for limited access rights and access controls on a need-to-know basis; authentication; personnel training; regular back up; data recovery and incident management procedures; restrictions on storing, printing and disposal of personal data; software protection of devices on which personal data is stored; etc.

We have also implemented Information Security Management in accordance with the requirements of information security standard – ISO 27001, including penetration tests, vulnerability scans, secure development frameworks, access management, supplier management and compliance processes.

Please see our Security Statement for more information.

9. Your rights

This section describes your rights under the applicable laws and the procedures for exercising them. If you exercise any of your rights pursuant to this section or pursuant to the applicable laws, we will notify each recipient to whom your personal data has been disclosed, as specified in Section 8 of this Privacy Notice, about any correction, deletion, or restriction of processing carried out in accordance with your request, unless this notification proves impossible or requires disproportionate effort.

To exercise your rights, please contact us at privacy@phrase.com. We will respond within one (1) month after receipt of your request. In exceptional circumstances, we retain the right to extend this period by up to two (2) months. We will in any event inform you within one (1) month after receipt of your request if we decide to extend the period for our response. If needed, we might ask you for additional information to confirm your identity before processing your request.

You are not required by law to provide your personal data to us, however, if you don’t, then we may not be able to provide you or your organization with our service. If you object to the processing of your personal data, we will respect that choice in accordance with our legal obligations. Depending on the scope of your request, this could mean that we will not be able to provide you or your organization with our service.

If you would like to exercise any of your rights, please let us know by getting in touch using the contact details below.

You are entitled to:

Request access to processing information

You have the legal right to request information at any time about whether we are processing your personal data. If this is the case, you have the right to be informed about the extent to which your personal data is being processed as well as to be provided with a copy of your personal data. Where the personal data is transferred to third countries, you also have the right to be informed of the appropriate safeguards implemented by us in relation to the transfers.

Request the correction and/or deletion of your personal data

You have the right to obtain the rectification of inaccurate personal data concerning you and/or to have incomplete personal data completed. In certain circumstances you have the right to erasure of the personal data concerning you without undue delay. The right to erasure does not apply, in particular, if processing is necessary to comply with legal obligations.

Object to the processing of your personal data

You have the right to object at any time to the processing of your personal data that is based on legitimate interest. We will no longer process personal data unless we can demonstrate legitimate grounds for the processing which override the interests, rights and freedoms of you as data subject or for the establishment, exercise or defense of legal claims. If you object to processing of your data for direct marketing purposes, we will cease to process your data for these purposes.

Request the restriction of the processing of your personal data

If you request us to restrict the processing of your personal data, e.g. in circumstances when you contest the accuracy, lawfulness or our need to process your personal data, we will limit processing of your personal data to the necessary minimum (storage) and, if applicable, will process them only for the establishment, exercise or defense of legal claims or, where necessary, for protection of rights of another natural or legal person, or other limited reasons dictated by the applicable law. In case the restriction is lifted, and we continue processing your personal data, you will be informed accordingly without undue delay.

Portability of your personal data

You have the right to receive personal data relating to you and which you have provided to us. If you approach us with such a request, we will provide your personal data in commonly used and machine-readable format to you without undue delay from receipt of your request. If you request so, we will send your personal data to a third party (another data controller) which you will identify in your request, unless such request would adversely affect rights or freedoms of others and where technically feasible.

Withdraw your consent

If you have provided us with any consent to the processing of personal data, for example for marketing communication, you can withdraw your given consent at any time without stating any reason. We will stop any further processing of your personal data. Please note that the withdrawal of your consent does not affect the lawfulness of any processing based on consent before its withdrawal.

Children’s privacy

Recruitment at Phrase is not intended for individuals under the age of 18, and we do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18, we will take immediate steps to delete such information and close the associated account. Legal guardians who believe that we may have collected data from their child under 18 should contact us in accordance with this Privacy Notice to request the removal of the data.

Complain to a data protection authority 

You have the right to submit a complaint concerning our data processing activities of

For Phrase a.s.: 

Úřad pro ochranu osobních údajů, at Pplk. Sochora 727/27, 170 00 Praha 7, Czech Republic

For Phrase GmbH:

Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 7.OG, 20459 Hamburg, Germany

For Phrase OpCo Ireland Limited:

Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland

For Phrase OpCo Spain, S.l.:

Agencia de Protección de Datos, C/Jorge Juan, 6, 28001 Madrid

For Phrase UK Ltd:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

10. Contact Us

If you have questions or requests regarding the processing of your personal data, or require additional information, please contact: privacy@phrase.com.

Last updated: December 6, 2024