1. INTRODUCTION
OPINIQ LTD (the "Company", "we", "us" or "our") is committed to protecting and respecting your privacy.
This Privacy Notice ("Privacy Notice") explains how we collect and process your personal data in connection with our recruitment activities. It applies in the following situations:
you submit an application for a role with us, including via the careers form on opiniq.com, through recruitment platforms (e.g., LinkedIn, HeadHunter, job boards), by email, or through recruitment agencies; and/or
we proactively approach you about potential opportunities (for example, via LinkedIn or other professional networks).
This Privacy Notice sets out what personal data we hold about you, how we collect it, how we use it, and with whom we may share it. We provide this information in line with the EU General Data Protection Regulation ("GDPR") and applicable Cyprus data protection law, including the Protection of Natural Persons with Regard to the Processing of Personal Data and for the Free Movement of Such Data Law of 2018 (Law 125(I)/2018), as amended.
This Privacy Notice covers the recruitment stage only. If you accept a conditional offer of employment, we will provide you with our Staff Members Privacy Notice before any further processing begins.
Please read this Privacy Notice carefully, along with any other similar notices we may provide when collecting or processing your personal data.
2. WHO COLLECTS YOUR DATA
OPINIQ LTD is the data controller for the personal data processed in connection with recruitment. Our details are as follows:
Company Name: OPINIQ LTD
Reg. No.: HE 450203
Reg. Address: 3 Krinou Street, The Oval Business Centre, 10th floor, Offices 1001–1002, Agios Athanasios, 4103 Limassol, Cyprus
Telephone: +357 95 996 660
Email: privacy@opiniq.com
We have not currently appointed a Data Protection Officer (DPO). You may direct any questions or concerns regarding your personal data or this Privacy Notice to us at privacy@opiniq.com.
3. WHAT DATA WE COLLECT, WHY, AND HOW LONG WE KEEP IT
The tables below summarise the data we collect and hold, how and why we do so, how we use it, with whom it may be shared, and for how long we keep it.
We apply appropriate technical and organisational measures, such as encryption in transit and at rest where appropriate, access controls, and data minimisation. Recipients are bound by confidentiality obligations.
3.1 Special-Category Personal Data
We do NOT request special-category personal data (such as data revealing your health, racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership) as part of the recruitment process.
Where you voluntarily provide special-category data for a limited purpose, we will:
use it only to the extent strictly necessary to consider and arrange the relevant adjustment;
rely on Article 9(2)(b) GDPR and, where relevant, Article 9(2)(f) GDPR; and
restrict access to authorised HR and, where necessary, legal personnel; store it separately where feasible; and retain it only for as long as necessary in connection with your application.
Any processing of special-category data in connection with onboarding or employment is not part of recruitment and is addressed in our Staff Members Privacy Notice.
3.2 Recruitment and Applicant Records
Data we collect
Name, contact details (email, phone), location (if provided); CV/resume, cover letter; employment and education history, qualifications, language skills; portfolio/links you provide (e.g., LinkedIn); interview notes, assessment/test results (if applicable); correspondence with you; offer/negotiation details (if applicable).
How we collect
From you (careers form on opiniq.com, email, interviews, assessments); from recruitment partners and agencies (where applicable); from publicly available professional sources you share or that are relevant (e.g., LinkedIn), where appropriate.
Who may access
Hiring managers and interviewers; HR / recruitment staff; IT/security (systems operation and incident handling); legal and privacy function (incident and breach assessment).
Purposes
Manage recruitment and assess your suitability; communicate with you and run selection steps; make and administer an offer (where applicable); maintain recruitment records and defend potential legal claims; where offered and you opt in: keep your details for future opportunities (talent pool).
Legal basis
Legitimate interests (Art. 6(1)(f) GDPR): running a fair and efficient recruitment process; assessing your suitability and improving our recruitment; protecting our organisation. Steps prior to a contract (Art. 6(1)(b) GDPR), where applicable. Consent (Art. 6(1)(a) GDPR), only where you opt in to the talent pool; you can withdraw at any time.
Recipients
Internal recipients on a need-to-know basis. Service providers/processors: Huntflow; Google Workspace, Microsoft 365; recruitment agencies (where applicable); professional advisers (e.g., lawyers) under confidentiality; authorities/courts where required by law. Some providers may process data outside the EEA (Section 7).
Retention
If not hired and no talent pool opt-in: 6 months from the recruitment decision, then deleted. If you accept our offer: kept until your start date, then governed by our Staff Members Privacy Notice. Talent pool: see Section 3.5. Longer only where required for legal obligations or legal claims.
3.3 Reference and Verification Data
Data
References (if you provide referees or ask us to contact them); your declared right-to-work / work-eligibility status (e.g., whether you already have the right to work in Cyprus or would require sponsorship).
Detailed verification documents are collected only after you accept a conditional offer and are dealt with under our Staff Members Privacy Notice
How we collect
From you; from referees you provide (where contacted, after your explicit permission).
Who may access
HR/recruitment staff; relevant hiring managers (as needed); legal/compliance (if needed).
Purposes
Obtain references and assess your suitability; understand whether sponsorship will be required for the role; record hiring decisions and defend potential legal claims.
Legal basis
Legitimate interests (Art. 6(1)(f) GDPR): making an informed recruitment decision; protecting our organisation; planning for any sponsorship requirements. Steps prior to a contract (Art. 6(1)(b) GDPR), where applicable.
Recipients
Internal recipients on a need-to-know basis; service providers/processors supporting recruitment (Huntflow, email/collaboration tools); referees you have nominated. International transfers and safeguards: as described in Section 7.
Retention
References (if you provide referees or ask us to contact them); your declared right-to-work / work-eligibility status (e.g., whether you already have the right to work in Cyprus or would require sponsorship).
Detailed verification documents are collected only after you accept a conditional offer and are dealt with under our Staff Members Privacy Notice
3.4 Is Providing This Information Mandatory?
Providing your core application information (such as your name, contact details, and CV) is necessary for us to consider your application. If you do not provide it, we will not be able to process your application or progress you through the recruitment process.
Providing any additional information (such as referees) is voluntary, although it may assist us in assessing your application. Any statutory or contractual requirements to provide identity, immigration, or right-to-work documents arise only after you accept a conditional offer and are explained in our Staff Members Privacy Notice (Article 13(2)(e) GDPR).
3.5 Talent Pool
When you apply, you may choose to opt in to our talent pool so that, regardless of the outcome of your current application, we can contact you about future vacancies that may match your profile. Participation in the talent pool is entirely voluntary and is based on your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time by emailing privacy@opiniq.com.
Retention: If you opt in to the talent pool, we retain your application data for that purpose for 12 months from the date of the decision on your application (or until you withdraw your consent, whichever is earlier). At the end of that period your talent-pool data is deleted unless you renew your consent.
3.6 Website / Careers Form Technical Data
When you access opiniq.com and submit a careers form, your device and browser automatically transmit certain technical data (such as IP address, browser type, device type, and pages visited). This data is processed as described in our Website Privacy Notice.
4. WHERE WE OBTAIN YOUR DATA FROM THIRD PARTIES
In some cases, we obtain your personal data from sources other than you directly. This applies where:
a recruitment agency or headhunter provides us with your CV or application details;
we proactively identify you as a potential candidate through publicly available professional sources (e.g., LinkedIn profiles or professional portfolios); or
a referee provides a reference about you (with your permission).
Where we receive your personal data from a source other than you, we will provide you with this Privacy Notice as soon as reasonably practicable, and in any event within one month of obtaining the data (Article 14(3) GDPR).
5. WHERE YOUR DATA MAY BE HELD
Your data may be held at our offices, in our cloud-based systems, and by trusted third-party service providers. We have security measures in place to ensure appropriate protection for all data we hold. Where we transfer your data outside the EEA, we do so in accordance with the safeguards described in Section 7 below.
6. KEEPING YOUR PERSONAL DATA SECURE
We have appropriate security measures in place to prevent personal data from being accidentally lost, or used or accessed in an unauthorised way (Article 32 GDPR). We limit access to your personal data to those who have a genuine business need to know it.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable supervisory authority of a suspected data security breach where we are legally required to do so (Articles 33–34 GDPR).
7. INTERNATIONAL TRANSFERS OF PERSONAL DATA
We primarily process personal data within the European Economic Area (EEA). Nonetheless, transfers outside the EEA may occasionally be necessary — for example, when we engage service providers who process data outside the EEA or are hosted in third countries.
In such cases, we implement recognised safeguards, including:
the European Commission's Standard Contractual Clauses (SCCs) under Commission Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR); and/or
any supplementary measures necessary to ensure an essentially equivalent level of protection, in accordance with EDPB Recommendations 01/2020.
You can obtain more information about these safeguards by contacting us at privacy@opiniq.com.
8. YOUR RIGHTS
This section explains the rights you have under the GDPR and Cyprus Law 125(I)/2018 in connection with your recruitment/application. Some rights apply only in certain circumstances.
8.1 Right to Object (Article 21)
Where we process your personal data on the basis of our legitimate interests, you have the right to object to that processing at any time on grounds relating to your particular situation. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing is necessary for the establishment, exercise or defence of legal claims. To object, contact us at privacy@opiniq.com.
8.2 How to Exercise Your Rights
Submit requests by email to privacy@opiniq.com. Please state which right(s) you wish to exercise and provide sufficient detail to help us identify the relevant data.
We aim to respond within one (1) month of receiving a valid request. Where requests are complex or numerous, we may extend by up to an additional two (2) months; if so, we will inform you within the initial month (Article 12(3) GDPR).
Right to be informed
Art. 13–14
Receive clear information about how we collect, use, share, and retain your personal data. This Privacy Notice fulfils that obligation.
Right of access
Art. 15
Request confirmation of whether we process your personal data and, if so, receive a copy and supporting information (categories, purposes, recipients, retention, source, safeguards for international transfers, etc.).
Right to rectification
Art. 16
Ask us to correct or update inaccurate or incomplete data. Please let us know if any information you submitted changes (e.g., contact details or availability).
Right to erasure("Right to Be Forgotten")
Art. 17
Ask us to delete personal data where: it is no longer necessary for the purposes collected; you withdraw consent; you successfully object; or processing was unlawful. We may retain data where required by law or to establish, exercise or defend legal claims.
Right to restriction of processing
Art. 18
Request that we suspend use of your data (while retaining it) where: you contest its accuracy; processing is unlawful; we no longer need it but you require it for legal claims; or you have objected pending verification.
Right to data portability
Art. 20
For data you provided to us that we process by automated means on the basis of consent or steps prior to a contract, receive the data in a structured, machine-readable format and have it transmitted to another controller where technically feasible.
Right to withdraw consent
Art. 7(3)
Withdraw consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
Automated decision-making
Art. 22
We do not make decisions about you based solely on automated processing, including profiling, which produce legal effects or similarly significantly affect you. If this changes, we will inform you.
9. hOW TO COMPLAIN
Any query or concern about our use of your data can be directed to privacy@opiniq.com. You also have the right to lodge a complaint with the competent supervisory authority (Article 77 GDPR). The supervisory authority in Cyprus is:
Commissioner for Personal Data Protection
Address: Kypranoros 15, Nicosia 1061, Cyprus
Phone: +357 22 818 456
Website: https://www.dataprotection.gov.cy
You also have the right to lodge a complaint with the supervisory authority of the EU/EEA Member State where you habitually reside, where you work, or where the alleged infringement took place.
10. UPDATES TO THIS PRIVACY NOTICE
We may update this Privacy Notice from time to time to reflect changes in our processing activities, operational practices, or applicable law. We will publish the updated version on our website and revise the "Last updated" date above; where changes materially affect you, we will provide additional notice in advance where practicable.
If we intend to process your personal data for a purpose that is incompatible with the original purpose, we will notify you and, where required by law, obtain your consent or provide you with an opportunity to object. Copies of previous versions are available on request.
