Privacy Policy and Personal Data Protection

1. Introduction

MGR Human Resources Ltd (“MGR-HR”, “we”, “us” or “our”) is committed to protecting the privacy and personal data of individuals in accordance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Cyprus data protection laws.

This Privacy Policy explains how we collect, use, store, share and protect personal data in connection with our recruitment, temporary placement, human resources consulting and related services.

“Personal Data” means any information relating to an identified or identifiable natural person.

2. Who We Are

MGR Human Resources Ltd provides services including:

• Recruitment and executive search services;
• Temporary and permanent placements;
• Human resources consulting;
• Candidate sourcing and assessment;
• Employment and workforce-related support;
• Payroll and employment administration services, where applicable;
• Career and recruitment-related events and initiatives; and
• Other related human resources services.

For the purposes of applicable data protection legislation, MGR-HR will generally act as the data controller in relation to the personal data described in this Privacy Policy.

In certain circumstances, MGR-HR may process personal data on behalf of a client, in which case MGR-HR may act as a data processor and the client will act as the data controller.

3. Individuals Covered by This Privacy Policy

This Privacy Policy applies to personal data relating to:

• Candidates and prospective candidates;
• Individuals applying for permanent or temporary employment;
• Temporary workers and contractors;
• Employees and prospective employees of MGR-HR;
• Client representatives and employees;
• Prospective clients;
• Referees and emergency contacts;
• Suppliers, service providers and business partners;
• Website visitors;
• Individuals attending events or conferences organised by MGR-HR; and
• Any other person who communicates or interacts with MGR-HR.

4. Personal Data We May Collect

The personal data collected will depend on the nature of your relationship with MGR-HR and the services being provided.

4.1 Identification and Contact Information

We may collect:

• Full name;
• Date of birth;
• Residential address;
• Postal address;
• Business address;
• Telephone and mobile numbers;
• Email address;
• Nationality;
• Identification documents, including passports and identity cards;
• Photographs;
• Signature; and
• Any other information required to verify your identity.

4.2 Candidate and Recruitment Information

For the purpose of providing recruitment, temporary placement and related services, we may collect:

• Curriculum vitae and cover letter;
• Academic and professional qualifications;
• Professional licences and certifications;
• Employment history;
• Job titles and responsibilities;
• Skills, experience and competencies;
• Current and previous remuneration;
• Salary expectations;
• Notice period and availability;
• Preferred employment type and location;
• Interview notes and assessment results;
• References and referee contact details;
• Work eligibility and immigration status;
• Social media profiles and publicly available professional information;
• Details of job applications and employment opportunities;
• Information relating to previous interactions with MGR-HR;
• Information provided during interviews, telephone calls or meetings; and
• Any other information that you voluntarily provide to us.

Where permitted or required by law, we may also process information relating to:

• Health or disability;
• Diversity and equal opportunity monitoring;
• Criminal convictions or offences;
• Background screening;
• Right-to-work checks; and
• Other sensitive or special-category personal data relevant to a particular role.

We will only process special-category personal data or criminal-conviction information where there is a lawful basis and the processing is permitted under applicable legislation.

4.3 Client and Business Contact Information

We may collect information relating to our clients, prospective clients, suppliers and business partners, including:

• Name and surname;
• Job title;
• Company or organisation;
• Business contact details;
• Information relating to recruitment requirements;
• Details of communications and meetings;
• Contractual and commercial information;
• Payment and invoicing information; and
• Information concerning services provided or requested.

4.4 Employment and Temporary Placement Information

Where you are employed or engaged by MGR-HR, including as a temporary worker, we may collect:

• Employment contract information;
• Payroll and salary information;
• Bank account details;
• Tax and social insurance information;
• Timesheets and attendance records;
• Leave and absence records;
• Performance information;
• Training records;
• Disciplinary and grievance information;
• Emergency contact details;
• Benefits and pension-related information;
• Health and safety information; and
• Other information required for employment administration and legal compliance.

4.5 Payment Information

Where relevant, we may collect:

• Bank account details;
• Payment instructions;
• Invoicing information;
• Tax-related information; and
• Other information required to process or receive payments.

4.6 Compliance and Due Diligence Information

We may collect information required to comply with legal, regulatory or contractual obligations, including:

• Proof of identity;
• Proof of address;
• Tax identification numbers;
• Social insurance information;
• Work authorisation documentation;
• Background screening information;
• Information concerning conflicts of interest; and
• Information required for fraud prevention or compliance checks.

4.7 Publicly Available Information

We may collect personal data from publicly available sources, including:

• Professional networking platforms;
• Company websites;
• Social media profiles;
• Recruitment platforms;
• Professional registers;
• Online directories;
• Public databases; and
• Other publicly accessible sources.

5. How We Collect Personal Data

We may collect personal data:

• Directly from you;
• When you submit your curriculum vitae or apply for a role;
• When you register through our website or recruitment platform;
• When you communicate with us by telephone, email, social media or another communication channel;
• During interviews, assessments, meetings or events;
• From clients seeking candidates for employment opportunities;
• From recruitment agencies and professional introducers;
• From referees;
• From employers or previous employers;
• From job boards and recruitment platforms;
• From professional networking websites;
• From publicly available sources;
• From government departments and public authorities;
• From background screening and identity verification providers;
• From service providers acting on our behalf; and
• Through cookies and similar technologies used on our website.

Where another person provides personal data to us on your behalf, that person is responsible for ensuring that they are authorised to provide the information and that you have been informed about how it may be used.

6. How We Use Personal Data

We may process personal data for the following purposes:

6.1 Recruitment and Placement Services

• Assessing your suitability for current or future employment opportunities;
• Matching your qualifications, skills and experience with available roles;
• Presenting your profile to prospective employers;
• Arranging and managing interviews;
• Communicating with you about vacancies and applications;
• Obtaining references;
• Conducting assessments and background checks;
• Negotiating employment terms;
• Facilitating permanent or temporary placements;
• Managing job offers and onboarding;
• Maintaining a record of recruitment activity; and
• Providing career-related support.

We will generally seek your agreement before sending your curriculum vitae or identifiable candidate profile to a prospective employer, unless you have already instructed or authorised us to do so.

6.2 Client Services

• Understanding and managing client recruitment requirements;
• Identifying and recommending suitable candidates;
• Providing recruitment and HR consulting services;
• Managing client relationships;
• Preparing proposals and contracts;
• Communicating with client representatives;
• Processing invoices and payments;
• Managing complaints and service quality; and
• Developing and improving our services.

6.3 Employment and Temporary Worker Administration

• Managing employment and temporary placement arrangements;
• Processing salaries, payments and benefits;
• Managing timesheets, attendance and leave;
• Meeting tax, social insurance and employment obligations;
• Managing performance and workplace matters;
• Providing training;
• Managing health and safety obligations;
• Communicating with clients at whose premises temporary workers may be assigned; and
• Maintaining personnel and employment records.

6.4 Business Administration and Legal Compliance

• Managing our day-to-day business operations;
• Maintaining accounting and tax records;
• Managing suppliers and service providers;
• Protecting our legal rights;
• Preventing fraud and misuse of our services;
• Maintaining physical, organisational and information security;
• Complying with court orders, legal obligations and requests from competent authorities;
• Establishing, exercising or defending legal claims;
• Managing insurance requirements; and
• Conducting internal audits and business reporting.

6.5 Marketing and Communications

Where permitted by law, we may use your contact information to:

• Inform you about suitable employment opportunities;
• Send recruitment updates;
• Inform clients and prospective clients about our services;
• Invite you to events, webinars or networking activities;
• Share newsletters, market updates or other relevant communications; and
• Conduct research relating to the effectiveness of our website, marketing and recruitment activities.

You may unsubscribe from marketing communications at any time by using the unsubscribe option included in the communication or by contacting us.

7. Legal Grounds for Processing

We may process personal data on one or more of the following legal grounds:

7.1 Consent

You have provided your consent for a specific processing purpose, such as:

• Retaining your curriculum vitae for future employment opportunities;
• Receiving marketing communications;
• Processing certain special-category information; or
• Publishing photographs or recordings.

You may withdraw your consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.

7.2 Performance of a Contract

Processing is necessary:

• To perform a contract with you;
• To perform a contract with a client;
• To provide recruitment or temporary placement services;
• To manage an employment relationship; or
• To take steps at your request before entering into a contract.

7.3 Legal Obligation

Processing is necessary to comply with legal obligations relating to matters such as:

• Employment;
• Payroll;
• Taxation;
• Social insurance;
• Immigration;
• Health and safety;
• Accounting;
• Record keeping;
• Court orders; and
• Regulatory or governmental requirements.

7.4 Legitimate Interests

Processing may be necessary for the legitimate interests of MGR-HR, a client or another third party, provided that those interests are not overridden by your rights and freedoms.

These legitimate interests may include:

• Providing effective recruitment and HR services;
• Identifying suitable candidates;
• Maintaining candidate and client relationships;
• Developing our business and services;
• Protecting our systems and information;
• Preventing fraud;
• Conducting internal administration and reporting;
• Managing complaints;
• Establishing or defending legal claims; and
• Communicating relevant employment opportunities.

7.5 Vital Interests

Processing may be necessary to protect your vital interests or the vital interests of another person, including in an emergency.

8. Sharing Personal Data

We may share personal data with the following recipients where necessary and lawful:

• Prospective and existing employers;
• Clients seeking candidates or temporary workers;
• Recruitment agencies and professional partners;
• Payroll providers;
• Accounting, tax and audit advisers;
• Legal advisers;
• Insurance providers;
• Background screening and identity verification providers;
• IT service providers;
• Website hosting providers;
• Cloud storage providers;
• Recruitment software and applicant tracking system providers;
• Communication and marketing service providers;
• Training providers;
• Government departments;
• Social insurance and tax authorities;
• Courts, law enforcement authorities and regulatory bodies;
• Professional advisers; and
• Other service providers supporting MGR-HR’s operations.

We will only share personal data where there is an appropriate legal basis and where the recipient requires the information for a legitimate purpose.

We do not sell personal data.

9. Candidate Information Shared with Clients

As part of our recruitment services, candidate information may be shared with clients and prospective employers.

The information shared may include:

• Curriculum vitae;
• Qualifications;
• Employment history;
• Skills and experience;
• Salary expectations;
• Availability;
• Interview or assessment information;
• References, where appropriate; and
• Other information relevant to the particular role.

We take reasonable steps to ensure that personal data shared with clients is relevant and proportionate to the employment opportunity.

Clients receiving candidate information are responsible for processing that information in accordance with applicable data protection law.

10. Events, Conferences and Recruitment Activities

When you register for or attend an event, career fair, conference, webinar or recruitment activity organised or attended by MGR-HR, we may collect:

• Your name;
• Contact information;
• Job title;
• Company;
• Academic or professional qualifications;
• Employment interests;
• Curriculum vitae; and
• Other information relevant to the event.

This information may be used to:

• Organise and manage the event;
• Communicate event-related information;
• Identify potential employment opportunities;
• Follow up with candidates, participants or clients;
• Inform you about similar events; and
• Promote our services, where permitted by law.

Photographs, video recordings, audio recordings or live streaming may take place during an event. Where appropriate, participants will be informed in advance.

You may inform us if you do not wish to be photographed or recorded. We will take reasonable steps to respect such requests, subject to the nature of the event and applicable legal requirements.

11. Security of Personal Data

MGR-HR implements appropriate physical, technical and organisational measures designed to protect personal data against:

• Unauthorised access;
• Accidental loss;
• Destruction;
• Alteration;
• Disclosure; and
• Unlawful processing.

These measures may include access controls, secure storage, password protection, staff confidentiality requirements, security monitoring, backups and appropriate internal procedures.

Personal data may be stored electronically or in paper form.

Although we take reasonable steps to protect personal data, no system or method of transmission can be guaranteed to be completely secure.

12. Personal Data Relating to Other Individuals

Where you provide personal data relating to another individual, including a referee, emergency contact, employee, representative or colleague, you confirm that:

• You are authorised to provide the information;
• The information is accurate;
• The individual has been informed that their information may be provided to MGR-HR; and
• The individual has been directed to this Privacy Policy where appropriate.

13. Data Retention

MGR-HR retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including compliance with legal, accounting, tax, employment and reporting obligations.

13.1 Unsuccessful Candidates

Where you are not appointed to a role, we may retain your personal data for a reasonable period:

• To manage any queries or legal claims arising from the recruitment process;
• To comply with legal requirements; and
• To consider you for future employment opportunities where you have consented or where we otherwise have a lawful basis.

Where retention is based on consent, we may contact you periodically to confirm that you wish us to continue retaining your information.

You may request deletion of your candidate profile at any time, subject to any legal or legitimate requirement to retain certain information.

13.2 Successful Candidates and Employees

Where you accept an offer of employment or a temporary placement, information collected during the recruitment process may form part of your personnel or placement record.

Such information may be retained throughout the employment or placement relationship and for the period required under applicable law after the relationship ends.

13.3 Legal Claims

We may retain information for longer where necessary to establish, exercise or defend legal claims or comply with a legal obligation.

At the end of the applicable retention period, personal data will be securely deleted, destroyed or anonymised.

14. International Transfers

Personal data may be transferred to, accessed from or stored in countries outside the European Economic Area where necessary for the purposes described in this Privacy Policy.

Where personal data is transferred outside the European Economic Area, MGR-HR will take appropriate steps to ensure that the transfer complies with applicable data protection legislation.

These safeguards may include:

• A European Commission adequacy decision;
• Standard contractual clauses approved by the European Commission;
• Binding corporate rules;
• Contractual, technical and organisational safeguards; or
• Another transfer mechanism permitted under the GDPR.

You may contact us for further information concerning the safeguards applied to international transfers.

15. Your Data Protection Rights

Subject to applicable law, you may have the following rights:

15.1 Right of Access

You may request confirmation as to whether we process your personal data and obtain a copy of the information we hold about you.

15.2 Right to Rectification

You may request the correction of inaccurate or incomplete personal data.

15.3 Right to Erasure

You may request that we delete your personal data in certain circumstances.

This right does not apply where we are legally required to retain the information or where the information is required to establish, exercise or defend legal claims.

15.4 Right to Restriction of Processing

You may request that we restrict the processing of your personal data in certain circumstances.

15.5 Right to Data Portability

Where applicable, you may request that personal data provided by you be transferred to you or another organisation in a structured, commonly used and machine-readable format.

15.6 Right to Object

You may object to processing based on legitimate interests where you believe that your rights and freedoms outweigh our legitimate interests.

You have an absolute right to object to the use of your personal data for direct marketing.

15.7 Rights Relating to Automated Decision-Making

You have the right not to be subject to a decision based solely on automated processing, including profiling, where the decision produces legal effects or similarly significantly affects you, subject to the exceptions permitted by law.

MGR-HR does not generally make recruitment decisions based solely on automated processing without meaningful human involvement.

15.8 Right to Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time.

15.9 Right to Make a Complaint

You have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.

Further information is available from the Commissioner’s official website:

www.dataprotection.gov.cy

16. Exercising Your Rights

To exercise any of your data protection rights or raise a privacy-related question, please contact:

MGR Human Resources Ltd

Office Address:
2 Diagorou Street
ERA House, Floor 9
1097 Nicosia
Cyprus

Telephone: +357 2287 7744
Email: info@mgr-hr.com

Please include sufficient information to allow us to identify you and understand your request.

We may request additional information to verify your identity and prevent the unauthorised disclosure of personal data.

We aim to respond to valid requests within one month of receipt. Where a request is complex or multiple requests have been submitted, we may extend this period as permitted by law. We will notify you if an extension is required.

We may charge a reasonable fee or refuse to act where a request is manifestly unfounded, excessive or repetitive, as permitted by applicable law.

17. Failure to Provide Personal Data

Where personal data is required by law or under a contract and you do not provide the requested information, we may be unable to:

• Consider you for an employment opportunity;
• Introduce you to a prospective employer;
• Complete a recruitment or placement process;
• Enter into or perform an employment or service agreement;
• Process payments or payroll;
• Comply with legal obligations; or
• Provide the requested services.

Where this applies, we will inform you of the possible consequences.

18. Complaints

MGR Human Resources Ltd will endeavour to respond promptly and fairly to privacy-related questions and complaints.

Complaints should be submitted using the following contact details:

Office Address:
2 Diagorou Street
ERA House, Floor 9
1097 Nicosia
Cyprus

Telephone: +357 2287 7744
Email: info@mgr-hr.com

If you are not satisfied with our response, you may lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.

19. Cookies

Our website may use cookies and similar technologies to improve functionality, analyse website usage and enhance the user experience.

Further information is available in the Cookie Policy published on the MGR-HR website.

20. Third-Party Websites

Our website or communications may contain links to third-party websites.

MGR-HR is not responsible for the privacy practices, security or content of third-party websites. You should review the privacy policy of each website before providing personal data.

21. Changes to This Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in:

• Our services;
• Our processing activities;
• Applicable laws;
• Regulatory guidance; or
• Our data protection practices.

The revised Privacy Policy will be published on the MGR-HR website and will apply from the date of publication unless otherwise stated.

Last updated: 22/07/2026