Last updated: 06.July 2026

CDM eStratégiai Tanácsadó Kft. (registered office: 1027 Budapest, Horvát utca 14-26., Hungary; company registration number: 01-09-926695; represented by András Müller; e-mail: contact@carussel.com) (the “Company” or the “Controller”) provides this Privacy Notice to inform job applicants about how the Company processes their personal data during recruitment and selection procedures.

The Company processes personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and applicable Hungarian data protection laws.

The Company may amend this Privacy Notice if changes in its recruitment process, internal procedures, applicable law, or guidance issued by the competent supervisory authority make this necessary.

1. Contact details of the Controller

Controller: CDM eStratégiai Tanácsadó Kft.
Registered office: 1027 Budapest, Horvát utca 14-26., Hungary
Company registration number: 01-09-926695
E-mail: contact@carussel.com

2. Data protection contact / Data Protection Officer

The Company’s data protection contact / Data Protection Officer can be contacted at:

Name: Takács Dóra
E-mail: dora.takacs@carussel.com

3. Purpose of processing

The Company processes applicants’ personal data for the following purposes:

• managing the recruitment and selection process;
• identifying the applicant;
• contacting the applicant;
• assessing the applicant’s professional experience, qualifications, skills and suitability for the relevant position;
• arranging and conducting interviews;
• preparing and communicating recruitment decisions;
• taking steps prior to entering into an employment contract or other work-related agreement;
• documenting and, where necessary, defending the lawfulness of the recruitment process.

The Company does not use applicants’ personal data for purposes unrelated to recruitment unless a separate legal basis applies and, where required, the applicant has been informed separately.

4. Categories of personal data processed

The Company may process the following categories of personal data:

• name;
• contact details, such as e-mail address, telephone number and postal address, if provided;
• CV and cover letter;
• information on education, qualifications, training and professional experience;
• information provided in references or recommendation letters, if submitted by the applicant;
• portfolio, LinkedIn profile, GitHub profile or other professional profile, if provided by the applicant or made publicly available for professional purposes;
• information shared by the applicant during interviews;
• interview notes and internal recruitment assessments;
• salary expectation and availability;
• any other information voluntarily provided by the applicant during the application process.

The Company does not request special categories of personal data, such as health data, biometric data, religious or political views, or trade union membership, during the recruitment process. Applicants are requested not to include such information in their application materials unless it is strictly necessary for the specific application.

The Company does not normally request copies of identity documents, tax identification documents, social security numbers or similar official identifiers during the application stage. Such data may only be requested at a later stage if required for the preparation or conclusion of an employment contract or by law.

5. Source of personal data

The personal data are primarily provided directly by the applicant.

The Company may also process data obtained from:

• recruitment platforms through which the applicant applies;
• publicly available professional sources, such as LinkedIn or professional portfolio websites;
• recruitment agencies, if the applicant applied through such agency;
• references, if the applicant provided them or authorised the Company to contact them.

6. Legal basis of processing

The legal basis of processing depends on the specific purpose:

1. a) Processing necessary for recruitment and pre-contractual steps

Where the Company processes personal data in order to assess the application and take steps at the applicant’s request prior to entering into an employment contract, the legal basis is Article 6(1)(b) GDPR.

1. b) Legitimate interest

The Company may process certain personal data on the basis of its legitimate interest under Article 6(1)(f) GDPR, in particular for:

• documenting the recruitment process;
• protecting the Company’s legal interests in the event of a claim;
• ensuring the integrity and transparency of the selection process;
• contacting applicants again within a limited period if a similar relevant position becomes available, unless the applicant objects.

The Company’s legitimate interest is balanced against the applicant’s rights and freedoms. The applicant has the right to object to processing based on legitimate interest.

1. c) Consent

If the Company wishes to keep the applicant’s application materials for a longer period for future recruitment opportunities, or wishes to process the applicant’s data for a purpose not covered by the above legal bases, the Company may request the applicant’s consent under Article 6(1)(a) GDPR.

Consent may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

1. d) Legal obligation

In certain cases, the Company may process personal data to comply with a legal obligation under Article 6(1)(c) GDPR, for example if the processing is necessary in connection with legal, tax, employment or authority-related obligations.

7. Retention period

If the applicant is selected and enters into an employment contract or other work-related agreement with the Company, the necessary personal data will be transferred to the employee records and processed in accordance with the Company’s employee privacy notice.

If the applicant is not selected, the Company will retain the application materials and recruitment-related documents for a maximum of 1 year after the end of the recruitment process, based on the Company’s legitimate interest in documenting the recruitment process and, where relevant, contacting the applicant in relation to a similar future opportunity.

The applicant may object to this retention at any time by contacting the Company at any of the contact details specified in this Privacy Notice. If the objection is justified and there is no overriding legitimate reason for further processing, the Company will delete the applicant’s personal data.

If the Company requests and obtains separate consent to retain the applicant’s data for future recruitment opportunities, the retention period will be the period specified in the consent request, unless the applicant withdraws consent earlier.

After the applicable retention period expires, the Company deletes or anonymises the personal data, unless further retention is required by law or necessary for the establishment, exercise or defence of legal claims.

8. Persons authorised to access the data

Applicants’ personal data may be accessed only by persons for whom access is necessary for the recruitment process, including:

• the managing director or other authorised senior managers;
• HR or recruitment staff;
• the manager responsible for the position;
• persons involved in the interview or selection process;
• IT staff or service providers to the extent necessary for system operation and support.

All persons with access to applicants’ personal data are required to handle such data confidentially and in accordance with the Company’s internal data protection rules.

9. Recipients and processors

The Company may use service providers who process personal data on behalf of the Company, for example:

• IT and hosting service providers;
• e-mail and cloud service providers;
• recruitment platforms or applicant tracking systems;
• recruitment agencies, if involved in the specific recruitment process;
• legal advisers, if necessary for legal advice or claim management.

The Company ensures that its processors are subject to appropriate contractual data protection obligations.

The Company does not sell applicants’ personal data to third parties.

10. International data transfers

The Company primarily processes applicants’ personal data within the European Economic Area.

If any service provider used by the Company involves the transfer of personal data outside the European Economic Area, the Company ensures that such transfer is carried out only on the basis of an appropriate legal mechanism under the GDPR, such as an adequacy decision, standard contractual clauses or another appropriate safeguard.

11. Automated decision-making

The Company does not make recruitment decisions based solely on automated processing, including profiling, that would produce legal effects concerning the applicant or similarly significantly affect the applicant.

12. Applicant’s rights

The applicant has the following rights in relation to the processing of their personal data:

• the right to request access to their personal data;
• the right to request rectification of inaccurate or incomplete personal data;
• the right to request erasure of personal data;
• the right to request restriction of processing;
• the right to object to processing based on legitimate interest;
• the right to withdraw consent at any time, where processing is based on consent;
• the right to data portability, where applicable under the GDPR;
• the right to lodge a complaint with a supervisory authority.

The applicant may exercise these rights by contacting the Company at:

E-mail: contact@carussel.com
Data protection contact / DPO: dora.takacs@carussel.com

The Company will respond to requests without undue delay and, in any event, within one month of receipt of the request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. In such case, the Company will inform the applicant of the extension and the reasons for it within one month of receiving the request.

13. Right to lodge a complaint

If the applicant believes that the Company’s processing of their personal data infringes applicable data protection law, the applicant may contact the Company first so that the Company can investigate and respond to the concern.

The applicant also has the right to lodge a complaint with the Hungarian supervisory authority:

National Authority for Data Protection and Freedom of Information
Nemzeti Adatvédelmi és Információszabadság Hatóság
Address: 1055 Budapest, Falk Miksa utca 9–11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
E-mail: ugyfelszolgalat@naih.hu
Website: https://www.naih.hu

The applicant also has the right to seek judicial remedy before the competent court. Information on Hungarian courts is available at: https://birosag.hu/birosag-kereso.