1. Controller and contact
The controller of personal data on the Link IT Pros platform is BJ Nexus s. r. o., company ID 57814805, tax ID 2123210595, Hontianska Vrbica 125, 935 55 Hontianska Vrbica, Slovakia. The company is registered with the Nitra District Court in section Sro, file 71203/N. Contact for questions and rights requests: jan.bodi@linkitpros.eu.
The controller has not appointed a data protection officer. We will update the contact information if this changes.
2. Scope and people concerned
This notice applies to candidates, recruiters, people acting for companies, website visitors and people who contact us, pay for services or submit complaints. The service is intended for adults. It is provided through linkitpros.sk; the availability of particular countries and features depends on the current platform configuration.
3. Data we process
Depending on the completed profile, candidate data includes identification and contact details, account identifier, photograph, country of residence, city and preferred work locations, specialisation, seniority, experience, work preferences, availability, expected pay, languages, technologies, profile and CV content, links, projects and portfolio, test results, calculated match and profile status.
For a candidate residing outside the EU, we also process their declaration of whether they currently have the right to work in an EU country and, if so, the countries they identify. We do not request a copy of a visa or permit at this stage. Residence does not establish citizenship or work authorisation, and the platform does not independently verify these declarations.
For recruiters and company users, we process names, company and contact details, authority to act for the company, billing details, orders, payments, unlock history, saved searches, favourite profiles, notes and communications. For all users, we may process IP addresses, session identifiers, device information, logins and security records.
The payment provider processes full payment card details; we receive transaction information needed to provide the service and keep accounts.
4. Purposes and legal bases
We process the data needed to create and manage accounts, register users, show profiles to authorised recruiters, provide search, unlock contacts and fulfil orders under Article 6(1)(b) GDPR, namely to perform a contract or take steps before entering into one.
We also process payment and document information under Article 6(1)(c) GDPR to comply with accounting and tax obligations. We process information for platform security, abuse prevention, company account checks, dispute handling and protection of legal claims under Article 6(1)(f) GDPR, based on our legitimate interests and users’ interest in a safe service. When relying on this basis, we consider the rights and interests of the people concerned.
Technical tests and indicative recommendations support requested platform features under Article 6(1)(b) GDPR. We send marketing messages on consent under Article 6(1)(a) GDPR or another legal basis only where the applicable electronic communications rules also permit it. Consent can be withdrawn at any time; direct marketing can always be objected to.
5. Required and optional data
Data marked as required in a form is needed for the relevant registration, feature or order. Without it, we may be unable to create an account, activate a profile or complete a payment. A photograph, portfolio, links, CV and other fields are optional unless the form explicitly states otherwise. Separate consent to marketing is not a condition of registration.
6. Sources of data
Most data comes directly from the user. Platform features generate test results and match scores from candidate information and recruiter requirements. We receive payment status from the payment provider. We may check company information against public registers when needed to verify an account.
7. Profile visibility and contact unlock
Before unlocking a contact, authorised recruiters may see a limited professional profile including an identifier, specialisation, experience, technologies, work preferences, location, country of residence, availability and indicative score. For a candidate residing outside the EU, they may also see declared work authorisation and countries. A limited profile may still be personal data if the person can be identified indirectly.
We release names, email addresses, telephone numbers and private information intended for unlock only after the service conditions are met. A candidate may change profile status or request that the profile be hidden. Hiding prevents new visibility within the service but does not remove data a recruiter lawfully received earlier.
8. Search, tests and automated decisions
The matcher may compare technologies, seniority, experience, preferred locations, work arrangements, test results and recruiter requirements to produce an indicative score or ranking. The recruiter makes the hiring decision independently. If country or city filtering is available, it uses profile data; feature availability depends on the current platform version.
For a candidate residing outside the EU, a registration rule may automatically prevent profile activation if the person does not declare a current right to work in at least one EU country. The rule uses only the entered country of residence and response concerning work authorisation. We do not infer citizenship or ethnic origin from residence. We assess the effect of such a decision under Article 22 GDPR; users may request data correction, an explanation, express their view and ask for human review at jan.bodi@linkitpros.eu. Where Article 22 applies, we will provide the rights and safeguards required by that article.
9. Recipients and providers
Where necessary, we may disclose personal data to authorised recruiters and companies; database, authentication, storage, hosting, email and payment providers; professional advisers; and public authorities where required by law. Key services used include Supabase, Netlify, Stripe and Brevo. The information available to each recipient depends on the feature and access rights.
10. Recruiter responsibilities after receiving contact details
After receiving contact details, the recruiter or company may determine subsequent processing for its own recruitment as an independent controller. It must provide its own processing information where GDPR requires, secure the data and observe retention rules. We remain responsible for processing and disclosure through our platform.
11. Transfers outside the European Economic Area
Some providers or their subcontractors may access data from outside the EEA. A transfer must rely on a valid Chapter V GDPR mechanism, such as an adequacy decision or European Commission standard contractual clauses with any necessary supplementary measures. Where the EU–US Data Privacy Framework is used, it must apply to the particular recipient and processing. Information on safeguards and how to obtain a copy is available by contacting us.
12. Retention periods
We retain an account and active profile while providing the service. For incomplete registration, we apply a period of no more than 90 days after the last activity; after account closure, we generally delete or anonymise the profile within 30 days unless further retention is justified. Deleted information may remain in restricted backups for up to 90 days. These periods concern our data; separate copies lawfully obtained by a recruiter are subject to its own rules.
After an account ends, we may retain payment and unlock history for up to four years to protect claims unless law requires a longer period. We keep accounting and tax documents for the period required by law, generally ten years. We keep complaint records for up to four years after resolution or longer during a dispute. Security logs are generally retained for no more than 12 months unless needed to investigate an incident. Data processed solely on consent is retained until withdrawal or the end of the stated period.
13. Special categories and profile content
Do not place health information, ethnic origin, beliefs, trade-union membership, sexual orientation or other special categories of data in a profile unless strictly needed and lawfully justified. Do not request or upload criminal offence or conviction data. We may remove such information if obtained without a necessary legal basis. Do not publish other people’s data or confidential information in a portfolio.
14. Cookies and local storage
We may use necessary cookies or local storage for login, sessions, security, settings and payments. If we use analytics or marketing technologies requiring consent under electronic communications rules, we will activate them only after valid consent and provide a way to withdraw it. Details of individual technologies should reflect the website’s current configuration.
15. Security
We use appropriate technical and organisational measures including encrypted transfer, separated access rights, database access rules and incident procedures. If a personal data breach triggers notification duties under GDPR, we will comply with them.
16. Your rights
Subject to GDPR conditions, you may request access, rectification, erasure, restriction of processing or data portability. You may object to processing based on legitimate interests and object to direct marketing at any time. Where we rely on consent, you may withdraw it without affecting earlier lawful processing. You may also exercise rights relating to automated decisions under Article 22 GDPR where applicable.
The right to erasure is not absolute: we may continue retaining some information for legal duties or legal claims.
17. How to make a request
Write to jan.bodi@linkitpros.eu and state which right you wish to exercise. We may verify your identity where reasonably necessary. We will respond without undue delay, generally within one month, and inform you of any permitted extension.
18. Supervisory authority
You may lodge a complaint with the Slovak Data Protection Authority at dataprotection.gov.sk or with the supervisory authority in the EU Member State of your habitual residence, place of work or place of the alleged infringement. Contacting us first is optional.
19. Updates and languages
We may update this notice if features, providers or legal requirements change. We will publish the current version and effective date on the platform and inform users appropriately about material changes. The Slovak and English versions contain the same information; if interpretation differs, the Slovak version will be used without prejudice to data-subject rights under GDPR.