Lufthansa Systems Hungária Kft (hereinafter: LSYH), as Data Controller, processes personal data in connection with its recruitment and selection activities. Therefore, in accordance with Articles 13 and 14 of the Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, hereinafter: GDPR), LSYH provides applicants with information regarding the processing of their personal data.
This Privacy Notice applies to personal data that has been provided to us either by you or by another person. When processing personal data, we strive to ensure that such processing is limited to the personal data that is strictly necessary for assessing your application. We also place particular emphasis on transparency regarding the purposes and methods of data processing. The personal data made available to us will only be used for the purposes specified in this Privacy Notice.
During the recruitment process, we may also engage recruitment agency partners (hereinafter: partner organisation(s)). In the case of individuals referred by a partner organisation, the partner organisation is responsible for providing the information required under Article 13 of the GDPR.
Controller
Controller: Lufthansa Systems Hungária Kft.
Headquarters: 1117 Budapest, Neumann János u. 1. Building E.
Company registration number: 01-09-463417
Tax number: 12075452-2-43
Contact Details of the Data Controller
Data protection contact person: Data Protection Coordinator
E-mail address: lsyh_dp@lhsystems.com
Questions about personal data are welcome via the contact details provided.
Registration and Creation of a User Account on the Career Portal
Purpose of processing
The purpose of the processing is to provide a registration platform required for applying to job vacancies advertised through our career portal and to enable the submission of applications through the system.
You may register on our career portal and create a user account, where, after providing your personal data, you can track current job opportunities and ongoing applications. Once your user account has been created, you may apply for any of our open positions. By registering, you become part of our candidate database, through which we may contact you regarding current or future employment opportunities that match your qualifications and professional experience. You may update, add to, or delete the information in your profile at any time, view the status of your application(s), and upload additional documents.
Categories of personal data processed
Data provided during registration:
- name,
- email address,
- telephone number.
Any personal data contained in the documents you upload (for example, your CV/resumé or cover letter), as well as any other information you add to your profile or application.
Legal basis for processing
We process your personal data based on your consent pursuant to Article 6(1)(a) of the GDPR. Your consent is deemed to be given when, during registration, you actively tick the relevant checkbox and accept the processing of your personal data.
Retention period
By registering on the career portal, you consent to being contacted regarding employment opportunities that match your qualifications and experience. We will process your personal data until you withdraw your consent, but no longer than one year from the date of registration. Upon withdrawal of consent or expiry of the one-year retention period, your personal data will be automatically deleted.
You may delete your profile and uploaded attachments at any time through your profile settings. Deletion of your profile shall be considered a withdrawal of consent and may result in the termination of any ongoing application processes.
Recipients of personal data
Nexum Magyarország Kft. – operation and maintenance of the career portal, hosting and operation of the web server, system supervision, and data storage.
Transfer of personal data
The Controller does not transfer personal data to third parties. In addition to the above, we only make your personal data available to third parties where this is necessary to comply with a legal obligation imposed on us by applicable law, or where disclosure is required by a competent authority. Where your personal data is processed for the establishment, exercise, or defence of legal claims, we may transfer your personal data to the competent authority or court handling the matter.
Automated decision-making
The Controller does not perform any automated decision-making process on the data.
Application
Purpose of processing
We process your personal data for the purpose of recording your application, monitoring the progress of the assessment process for individual applications, and evaluating your job application. For the purpose of assessing applications, we conduct online and/or in-person interviews with applicants. We maintain ongoing communication with applicants to keep them informed about the status of the recruitment process. The processing is necessary for recruitment purposes in order to identify the most suitable candidate for the position and to make an offer with a view to establishing an employment relationship.
Categories of personal data processed
Profile data: name, email address, telephone number, preferred area of expertise, LinkedIn profile, Twitter profile, personal professional website, profile picture, interview notes, verbatim transcript of the interview, status of your application, as well as any job offer made to you and its acceptance or rejection.
As part of the selection process, we may also process interview assessments, professional and HR evaluations, references, recommendations, and documentation supporting recruitment decisions.
Any personal data contained in the documents you upload (for example, your CV/resumé, references, or cover letter), as well as any other information you add to your profile or application.
Legal basis for processing
We process your personal data based on your consent pursuant to Article 6(1)(a) of the GDPR. You provide your consent by ticking the relevant checkbox during registration and thereby accepting the processing of your personal data.
Retention period
We retain your personal data for one year from the date of your application for the relevant position. Upon expiry of the one-year retention period, the personal data will be automatically deleted.
Recipients of personal data
- Nexum Magyarország Kft. – operation and maintenance of the career portal, hosting and operation of the web server, system supervision, and data storage.
- Microsoft Ireland Operations Limited – provision of the O365 email system and the Microsoft Teams platform.
Transfer of personal data
For certain positions, the Controller may share an applicant's CV/resumé with a company within the Lufthansa Group or with a client where such entity is involved in the recruitment or selection process for the position.
In addition, we will only make your personal data available to third parties where this is necessary to comply with a legal obligation imposed by applicable law or where disclosure is required by a competent authority. Where your personal data is processed for the establishment, exercise, or defence of legal claims, we may transfer your personal data to the competent authority or court handling the matter.
Automated decision-making
The Controller does not carry out automated decision-making process on the data.
Tests
Purpose of processing
As part of the pre-screening process, applicants for certain positions may be required to complete a professional assessment test to evaluate their knowledge and skills. Recruiters will inform you in advance if a test is required for the position you have applied for. The test is designed to assess your professional suitability and will subsequently be evaluated as part of the selection process.
Categories of personal data processed
- Name
- Email address
- Responses provided to test questions
- Test results
Legal basis for processing
We process your personal data pursuant to Article 6(1)(b) of the GDPR, as the processing is necessary in order to take steps at your request prior to entering into an employment contract.
Retention period
The results of professional assessments and the evaluations prepared on the basis of those results are processed for the purpose of conducting the selection process. Such data are stored as part of your candidate profile and will be deleted upon expiry of the retention period applicable to candidate data or upon deletion of your candidate profile, whichever occurs first.
Recipients of personal data
- Nexum Magyarország Kft. as the operator of the career portal and applicant tracking system, responsible for receiving applications and managing candidate data through the applicant tracking system (ATS).
- Providers of professional aptitude and skills assessment tests, which administer online assessments as part of the recruitment process, generate test results, and make such results available to Lufthansa Systems Hungária Kft. Individual test providers may provide applicants with separate privacy notices regarding their own processing activities.
- In addition, candidate data may be accessed, to the extent necessary for the performance of their duties, by the competent HR personnel involved in the recruitment process and by designated managers and employees of the organisational unit seeking to fill the position.
Transfer of personal data
The Controller engages certain service providers and processors for the processing of personal data, including in particular the operator of the career portal and applicant tracking system, as well as providers of professional assessment tests used during the recruitment process. These organisations process personal data on behalf of and in accordance with the instructions of the Controller.
Apart from the above, personal data will only be disclosed where required by law or in response to a request from a competent authority or court. In such cases, the legal basis for the disclosure is compliance with a legal obligation pursuant to Article 6(1)(c) of the GDPR.
Automated decision-making
The Controller does not carry out automated decision-making process on the data.
Referral
Purpose of processing
As part of our employee referral programme, our employees may recommend candidates for open positions through our career portal or by email. In connection with the referral process, we process the personal data of both the referring employee and the referred candidate in order to identify the referred candidate, contact them regarding employment opportunities, and identify and maintain records of the referring employee.
Source of personal data
The personal data of the referred candidate may be provided to the Controller through a referral made by one of the Controller's employees.
Categories of personal data processed
- Referred candidate: Name, Email address, Telephone number, Position applied for, CV/resumé
- Referring employee: Name, Email address, Fact of the referral, Date of the referral
Legal basis for processing
The personal data of the referred candidate are processed on the basis of the Controller's legitimate interest pursuant to Article 6(1)(f) of the GDPR.
We have a legitimate interest in sourcing candidates from a broad talent pool, including individuals who, in the opinion of employees of Lufthansa Systems Hungária Kft., may be suitable for the relevant position. This contributes to the effectiveness of the recruitment process and supports long-term employee retention.
With regard to the referring employee, the legal basis for processing is Article 6(1)(b) of the GDPR, as the processing is necessary for the performance of the employment relationship between the employee and the Controller.
Retention period
Where the referred candidate submits an application through the career portal using the referral link provided, they become an applicant in the recruitment process. From that point onwards, their personal data will be processed in accordance with the retention period applicable to applicants, until withdrawal of consent or deletion of their profile, but no longer than one year from the date of registration.
Where the referred candidate does not provide the necessary consent for the processing of their personal data through the career portal within 30 days, their personal data will be automatically deleted from our systems after the expiry of that 30-day period.
In the event of an unsuccessful referral, referral-related data will be retained for one year from the date of the referral in order to ensure that the referral can still be taken into account if the referred candidate is subsequently hired within that period.
Recipients of personal data
- Nexum Magyarország Kft. – operation and maintenance of the career portal, hosting and operation of the web server, system supervision, and data storage.
- Microsoft Ireland Operations Limited – provision of the O365 email system and the Microsoft Teams platform.
Transfer of personal data
The Controller does not transfer personal data to third parties. In addition, personal data may only be disclosed where this is necessary to comply with a legal obligation imposed by applicable law or where disclosure is required by a competent authority. Where personal data are processed for the establishment, exercise, or defence of legal claims, the Controller may transfer such personal data to the competent authority or court handling the matter.
Automated decision-making
The Controller does not carry out automated decision-making.
Background Screening
Purpose of processing
Prior to the establishment of an employment relationship, we carry out embargo, sanctions, and export control compliance checks in order to ensure compliance with national and international trade, sanctions, and export control requirements applicable to the Lufthansa Group.
Categories of personal data processed
- Name
- Birth name (if available)
- Date of birth
- Nationality
- Position
- Basic employment-related data
- Results of sanctions list screening
- Compliance documentation and records generated during the screening process
Legal basis for processing
The legal basis for processing is Article 6(1)(f) of the GDPR, namely the legitimate interest of the Controller in ensuring compliance with sanctions and export control requirements applicable to the Lufthansa Group, as well as in preventing legal, financial, and reputational risks.
The Controller has carried out a legitimate interest assessment, the results of which are available upon request.
Retention period
In the event of an unsuccessful application, the data will be retained in accordance with the retention period applicable to candidate data.
In the event of a successful application, the data will be processed for the duration of the employment relationship. Documentation relating to the screening checks will be retained following the termination of employment for the applicable limitation period necessary for the establishment, exercise, or defence of legal claims.
Recipients of personal data
Personal data processed during compliance screening may only be accessed, to the extent necessary for the performance of their duties, by HR personnel involved in the recruitment process, managers participating in the hiring process, and employees responsible for compliance-related functions.
Transfer of personal data
The Controller does not transfer personal data to third parties. In addition, personal data may only be disclosed where necessary to comply with a legal obligation imposed by applicable law or where disclosure is required by a competent authority. Where personal data are processed for the establishment, exercise, or defence of legal claims, the Controller may transfer such personal data to the competent authority or court handling the matter.
Automated decision-making
The Controller does not carry out automated decision-making.
Rights of Data Subjects and Available Remedies
We would like to inform you that you may exercise your rights under the GDPR at any time by submitting a request through any of our contact channels, whether verbally, in writing, or electronically.
A summary of your data protection rights is provided below.
Right of Access
You have the right to obtain confirmation from us as to whether we process your personal data. Where we process your personal data, you have the right to receive information about the personal data we hold about you and the circumstances under which such data are processed. You also have the right to request a copy of your personal data. Such copies may be provided in a commonly used, machine-readable format or, where requested, in printed form. The first copy is provided free of charge; however, we may charge a reasonable fee for additional copies.
Withdrawal of Consent
You have the right to withdraw your consent at any time without giving reasons. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. Following withdrawal, we will cease processing the personal data concerned and will delete them, unless another legal basis permits or requires further retention.
Right to Rectification
You have the right to request the correction of inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you also have the right to have incomplete personal data completed. Where the accuracy of personal data is contested and cannot be verified without additional information, the processing of the relevant data may be restricted until the matter is resolved.
Right to Erasure
You have the right to request the deletion of your personal data where such data are no longer necessary for the purposes for which they were collected, or where you have concerns regarding the lawfulness of the processing. Where we are required to erase personal data, we will cease processing and delete the relevant data.
Right to Restriction of Processing
You have the right, in certain circumstances, to request the restriction of the processing of your personal data, for example where you contest the accuracy or lawfulness of the processing, or where we no longer need the data but you require them for the establishment, exercise, or defence of legal claims. During the restriction period, we will not process the personal data other than storing them, unless:
- you have given your consent;
- the processing is necessary for the establishment, exercise, or defence of legal claims;
- the processing is necessary to protect the rights of another natural or legal person; or
- the processing is necessary for reasons of important public interest of the European Union or a Member State.
Right to Object
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data where such processing is based on Article 6(1)(f) of the GDPR (legitimate interests).
This right applies to all processing activities described in this Privacy Notice that are based on Article 6(1)(f) GDPR. In such cases, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims. Where an objection is justified, we will cease processing your personal data for the affected purpose and will delete the relevant data.
Right to Data Portability
You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and to transmit those data to another controller, where:
- the processing is based on your consent or on a contract; and
- the processing is carried out by automated means.
In such cases, we will provide the relevant personal data in a structured, commonly used, machine-readable format. Exercising this right does not automatically result in the deletion of the personal data from our systems.
If you wish to exercise any of your rights relating to the processing of your personal data, or if you have any questions regarding this Privacy Notice, please contact us in writing at lsyh_dp@lhsystems.com. We will respond to your request without undue delay and, in any event, within one month of receipt of your request.
If you believe that your personal data have been processed improperly or in violation of applicable legal requirements, or if we have failed to respond appropriately to your request concerning the exercise of your rights, you have the right to lodge a complaint with the competent data protection supervisory authority.
CONTACT DETAILS OF THE NATIONAL AUTHORITY FOR DATA PROTECTION AND FREEDOM OF INFORMATION
Address: 1055 Budapest, Falk Miksa utca 9-11
Mailing address: 1363 Budapest, Pf.: 9
E-mail address: ugyfelszolgalat@naih.hu
Call center: +36 (30) 683-5969; +36 (30) 549-6838
Effective: October 20, 2026 –
