Privacy Policy

PRIVACY POLICY / PERSONAL DATA PROCESSING POLICY

This Privacy Policy provides you with information about the purposes for which, the scope within which, and the period for which we process your personal data. This Policy also contains information about your rights in relation to the processing of your personal data and how you may exercise those rights.

This Personal Data Processing Policy applies to the processing of personal data carried out by the following companies:
- Advantage Consulting, s.r.o., with its registered office at Orlí 708/36, Brno-město, 602 00 Brno, Company ID No.: 26289822, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File No. 42062
- AC Jobs, s.r.o., with its registered office at Orlí 708/36, Brno-město, 602 00 Brno, Company ID No.: 26962985, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File No. 48540
- THEONES.CZ, s.r.o., with its registered office at Orlí 708/36, Brno-město, 602 00 Brno, Company ID No.: 14105586, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File No. 126707
- smitio.com s.r.o., with its registered office at U vodárny 2965/2, Královo Pole, 616 00 Brno, Company ID No.: 11967471, registered in the Commercial Register maintained by the Regional Court in Brno, Section C, File No. 125594

(hereinafter referred to as the “Companies” or “we”).

Within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter the “GDPR”), the Companies are joint controllers of your personal data, i.e. they collect, store and use (and otherwise process) your personal data in the course of their business activities. The individual purposes for which personal data are processed are specified in more detail below. Their activities primarily consist of providing employment placement services, including presenting data to potential employers and using your electronic contact details (in particular your email address) for the purpose of providing you with job offers.
The Companies have entered into a joint controllership agreement pursuant to Article 26 of the GDPR, which defines their respective responsibilities for compliance with the obligations arising from the GDPR. The Companies act as joint controllers for the following processing purposes:
- Candidate sourcing – legal basis: performance of a contract and compliance with a legal obligation pursuant to Article 6(1)(b) and (c) of the GDPR
- Employment placement – legal basis: performance of a contract and compliance with a legal obligation pursuant to Article 6(1)(b) and (c) of the GDPR
- Marketing (commercial communications) – legal basis: consent or legitimate interest pursuant to Article 6(1)(a) or (f) of the GDPR

Detailed information on the purposes of personal data processing, data subjects, categories of data and retention periods is provided in Annex 1 to this Policy.

Personal data may be processed both automatically and manually, either by us directly or through designated processors. The current list of such processors will be provided to you upon request from any of the Companies. The processing of personal data includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, sorting or combining, restriction, erasure or destruction of personal data. Conversely, processing does not include handling personal data merely on an irregular or incidental basis as a result of another activity, such as servicing technical equipment used for data processing.

The provision of all personal data is entirely voluntary. However, refusal to provide data related to employment placement or data necessary for this purpose may result in limiting or excluding the possibility of the Companies providing employment placement services.

Where the legal basis for processing is the performance of a contract (e.g. employment placement), the data concerned are necessary for the performance of that contract. In other cases, the legal basis may be the consent of the data subject.

Disclosure of Personal Data to Potential Employers

For the purpose of enabling potential employers to make an offer of employment or another form of cooperation, your personal data may be disclosed to third parties – potential employers. At the time the data are disclosed, such potential employers act as independent controllers of personal data and process the data under their own responsibility and in accordance with their own privacy policies for the purpose of potentially making an offer of employment.

Personal Data Processors

Personal data are stored on secure servers operated by the Companies or their contractual internet service providers and are handled in accordance with general information security principles. Recipients of the data may include, in particular, hosting providers, providers of ATS systems or other HR software, and persons responsible for the administration and maintenance of websites and information systems. Such entities act as personal data processors and process the data exclusively on the basis of a data processing agreement and in accordance with the controller's instructions.

Personal data are protected by appropriate technical and organisational measures in accordance with Article 32 of the GDPR.

Retention Period of Personal Data

Unless otherwise specified in Annex 1 to this Policy, personal data are retained for the period necessary to fulfil the purpose of processing such personal data (i.e. for the purpose of employment placement, ordinarily for five (5) years from the date of their provision); where consent has been given, until such consent is withdrawn with any of the Companies; and for a period of ten (10) years after termination of the contractual relationship with the Companies, exclusively for the purpose of protecting the legitimate interests of the Companies, namely defending against potential disputes or potential legal claims.

After the expiry of this period, the data are deleted.

Transfer of a Company (Sale, Merger, Transformation)

In the event of a sale of a business, merger, demerger, transformation or liquidation, personal data may be transferred to a legal successor. Such transfer will be carried out in accordance with applicable laws and while maintaining a level of personal data protection corresponding to the requirements of the GDPR.

Processing Related to User Profile Registration

We strive to make your search for a new employment opportunity as easy as possible. To facilitate your search for employment opportunities, we enable you to create a user profile on www.smitio.com/cs/home. Through this profile, you can:

apply for job offers,
follow selected job offers or positions,
receive email notifications about newly opened job offers,
create and manage your CV,
complete online testing.

In order to provide these services to you, it is necessary for us to process your personal data.

Purpose of Processing

user registration,
administration and management of the user account,
enabling applications for job offers,
facilitating contact with potential employers,
sending notifications related to the employment profile,
keeping a record of the history of applications for job offers.

Scope of processed data: identification data (first name, surname, date and place of birth), contact details (telephone number, email address, residence), information about education, qualifications, professional experience, skills and other professional experience, information contained in the CV, including any photograph, information about applications for job offers and activity within the user account, and other data voluntarily provided by you as part of your profile.

The provision of personal data is voluntary. However, without providing mandatory registration data (in particular your email address), it is not possible to create and register a user account or provide you with the related services.

Legal basis: Processing is necessary for the performance of the contract concluded between you and the controller when creating and using the user account (Article 6(1)(b) of the GDPR).

Personal data are processed for the duration of the user account and thereafter for the period necessary to protect the controller's rights or comply with legal obligations. You may cancel your account at any time; this does not affect the processing of data necessary to comply with legal obligations or protect legitimate claims.

What Are Your Rights?

As we process your personal data, you have certain rights, which we would like to inform you about in this section. Since your personal data are processed by several Companies acting as joint controllers (see above), you may exercise your rights with any of them.

You may exercise all your rights with us in any manner that is convenient for you and that enables us to verify that you are the person making the request (identity verification is required). We will endeavour to respond to your request within 1 month of its submission.

To enable us to assist you as effectively as possible, we ask that you exercise your rights in writing or in person at Palác Magnum, Orlí 36, Brno 602 00, or by email at poverenec@acjobs.cz. In justified cases, particularly with regard to the complexity and number of requests, we may extend this period by an additional 2 months. We will inform you of such an extension within 1 month of receiving your request, together with the reasons for the extension.

Right to Withdraw Consent

If we process your personal data on the basis of your consent, you have the right to withdraw your consent to the processing of personal data, including consent to receive commercial communications and consent to statistical processing.

With regard to the processing of your personal data for the purposes of sending commercial communications, you may withdraw your consent to the processing of personal data and to receiving commercial communications simply by clicking the relevant link provided at the end of each commercial communication.

Right of Access

You have the right to access the personal data we process about you and to receive information about what personal data we process, for how long, the purposes for which they are processed, to whom they are disclosed, and whether we use them for automated decision-making.

Upon your request, we may provide you with a copy of your personal data free of charge. Only in the event of multiple such requests may we charge a reasonable fee based on the administrative costs of providing additional copies.

Right to Rectification

It is in our interest to keep your information up to date, as this is the only way we can send you relevant job offers and help you progress in your career. If you discover that we process incomplete or inaccurate personal data about you, you have the right to have such data updated.

In connection with the creation of a user profile, you may update some of your data yourself at www.smitio.com/cs/profile.

Right to Data Portability

You may request the provision of personal data that you have provided to us on the basis of your consent or for the performance of a contract and which we process automatically. Upon request, we will provide you with personal data meeting these conditions in a commonly used, structured and machine-readable format or, where technically feasible, transfer them to another controller designated by you.

Right to Restriction of Processing

You have the right to request restriction of the processing of your personal data in the following cases:

if you contest the accuracy of the personal data, for the period necessary to verify their accuracy;
if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
if we no longer need the personal data for the purposes of processing, but you require them for the establishment, exercise or defence of legal claims;
if you have objected to the processing, pending verification of whether our legitimate grounds override your reasons.

Right to Erasure

You also have the right to have your personal data erased. In order to request erasure, one of the following grounds must apply:

the data are no longer necessary for the purposes for which they were collected;
the processing is unlawful;
you have withdrawn your consent and there is no other legal basis for the processing;
you have successfully objected to the processing;
there is a legal obligation to erase the data.

The right to erasure does not apply where processing is necessary:

for compliance with a legal obligation;
for the establishment, exercise or defence of legal claims;
for exercising the right to freedom of expression and information;
for other purposes specified in Article 17(3) of the GDPR.

Where the right to erasure does not apply, your personal data will be restricted to the extent necessary.

Right to Object

You have the right to object at any time to the processing of your personal data that we carry out on the basis of our legitimate interest (Article 6(1)(f) of the GDPR). If you object, we will cease processing your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims.

If we process your personal data for direct marketing purposes, you have the right to object to such processing at any time. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.

Right Not to Be Subject to Automated Individual Decision-Making, Including Profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

This right does not apply where the decision is necessary for entering into or performing a contract between you and us, is authorised by Union or Member State law, or is based on your explicit consent. In such cases, we will take appropriate measures to safeguard your rights and freedoms and legitimate interests, including the right to human intervention, the right to express your opinion and the right to challenge the decision.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. The supervisory authority will inform you of the progress and outcome of your complaint.

Supervisory authority in the Czech Republic:

Office for Personal Data Protection

Pplk. Sochora 27

170 00 Prague 7

www.uoou.gov.cz

Our appointed Data Protection Officer (DPO) will be happy to answer your questions. You can contact them at: poverenec@acjobs.cz.

Last revised: May 2026

Annex No. 1

Detailed Information on the Processing of Personal Data

Subject Matter of Processing	Data Subject	Categories of Data	Nature and Purpose of Processing	Legal Basis	Processing Period
Candidate Sourcing	Job applicants, potential candidates contacted during candidate sourcing, clients and their contact persons	Identification and contact details, date and place of birth, citizenship, information about work experience, education, previous employment, other information provided by the applicant (e.g. information contained in the CV, including a photograph included in the CV, information about education and professional experience, and other knowledge and skills), and other information provided by the applicant in the form of a CV, including its electronic version, or during an in-person or telephone interview	Collection, recording, searching and administration of job applicant data; matching applicants with potential employers (users of employment agency services); mutual sharing of the database and providing individual Companies with access to it; communication with applicants; maintaining records relating to job offers; compliance with the legal obligations of an employment agency	Article 6(1)(b) of the GDPR (contract); Article 6(1)(c) of the GDPR (compliance with a legal obligation)	For the duration of the recruitment process; in accordance with the periods stipulated by applicable legislation, in particular the Labour Code and the Employment Act, as well as health and social insurance regulations
Employment Placement	Job applicants, clients and their contact persons	Identification and contact details, date and place of birth, citizenship, information about work experience, education, previous employment, other information provided by the applicant (e.g. information contained in the CV, including a photograph included in the CV, information about education and professional experience, and other knowledge and skills), and other information provided by the applicant in the form of a CV, including its electronic version, or during an in-person or telephone interview	Conducting the recruitment process by the client based on the recommendation/selection of candidates provided from the agency's database; maintaining records relating to job offers; compliance with the legal obligations of an employment agency	Article 6(1)(b) of the GDPR (contract); Article 6(1)(c) of the GDPR (compliance with a legal obligation)	For the duration of the recruitment process; in accordance with the periods stipulated by applicable legislation, in particular the Labour Code and the Employment Act, as well as health and social insurance regulations
Marketing (Commercial Communications)	Job applicants, potential candidates contacted during candidate sourcing, potential employers, clients and their contact persons	Identification and contact details, date and place of birth, citizenship, information about work experience, education, previous employment, other information provided by the applicant (e.g. information contained in the CV, including a photograph included in the CV, information about education and professional experience, and other knowledge and skills), and other information provided by the applicant in the form of a CV, including its electronic version, or during an in-person or telephone interview. Identification and contact details of the client for the purpose of facilitating the presentation of potential candidate profiles	Collection, recording, searching and administration of job applicant data; matching applicants with potential employers (users of employment agency services); mutual sharing of the database and providing individual Companies with access to it; communication with applicants; maintaining records relating to job offers	Article 6(1)(a) of the GDPR (consent) or Article 6(1)(f) of the GDPR (legitimate interest)	For the duration of the data subject's consent (where consent is the legal basis) or for the duration of the legitimate interest (e.g. in the case of direct marketing to candidates who have already been contacted or to our own clients), until an objection is raised