Prevadzkovatel / controller

Privacy notice

This notice explains how the HR Onboarding application processes personal data during candidate intake, document collection, signing, retention, and compliance workflows.

Last updated: 2026-05-28

1. Controller

Name: Example Logistics s.r.o.
Company ID: 12345678
Tax ID: 2020000000
Registered office: Hlavna 1, 811 01 Bratislava
Contact email: hr@example.local
Data Protection Officer: Not appointed

2. Purposes and legal bases

Performance of an employment, work-activity or mandate agreement: Article 6(1)(b) GDPR
Compliance with tax, social-security and occupational-safety duties: Article 6(1)(c) GDPR
Audit, security and protection of the controller's rights: Article 6(1)(f) GDPR

3. Categories of personal data

We process identification data, contact data, document data, data needed to conclude and perform the contract, driving-licence data for driver positions, and health data from a health card or medical examination where required for the role.

Health data is a special category of personal data and is processed only where needed and supported by explicit consent or another applicable legal basis.

4. Recipients

Personal data may be disclosed to accounting or HR personnel, the health insurance provider, the tax authority, the Social Insurance Agency, security and IT service providers, and other recipients where required by law or by contract performance.

5. Retention

Completed onboarding processes: 1825 days.

Draft or abandoned onboarding processes: 90 days.

Audit logs: 3650 days.

Notification logs: 730 days.

DSAR exports: 30 days.

Criminal record documents: 90 days.

Specific retention periods may be adjusted where employment, tax, accounting, or other statutory rules require a longer period.

6. Data subject rights

You have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent where processing is based on consent. Withdrawal does not affect processing that was lawful before withdrawal.

You may lodge a complaint with the Slovak Office for Personal Data Protection.

7. Transfers, automated decision-making, and cookies

Cross-border transfers of personal data outside the EU or EEA are not carried out by default unless the controller states otherwise in a separate notice.

Automated individual decision-making and profiling are not used.

The application uses only the strictly necessary session cookie required to sign in and keep the service secure. It does not use third-party trackers.