PRIVACY POLICY – CANDIDATES
The Rohlik Group is an international group of companies (operating under local brands Rohlik.cz, Kifli.hu, Gurkerl.at, Knuspr.de and Sezamo.ro) active primarily in the field of online grocery retail and related services. The Rohlik Group operates in several European countries through its local companies. The list of members of the Rohlik Group who are joint controllers of your personal data forms an Annex to this Privacy Policy (“We” or “Group”).
The Group, as a joint controller of personal data, informs you as a candidate about the processing of personal data and the principles of protection of your privacy.
This Privacy Policy includes the Group standards for processing personal data of candidates, and all rules set out in this document are properly implemented and followed by each company in the Group.
In this document you will learn in particular:
1. what personal data we will process about you, for what purposes, and how we will process your personal data and on what legal basis;
2. who your personal data may be shared with;
3. how we use artificial intelligence tools during the recruitment process;
4. how long we will process your personal data;
5. which online services we use on our websites; and
6. what rights you have in relation to the protection of your personal data.
If you need any part of this text explained, would like advice, wish to discuss further processing of your personal data, or exercise any of your rights, you can contact us at any time at privacy@rohlikgroup.com. You may also contact the relevant local data protection contact listed in the Annex to reach the appropriate company within the Rohlik Group directly.
1. Scope and Purpose of Personal Data Processing, Legal Basis
1.1 Scope and Purpose
If you apply for a specific role, we process the personal data you choose to share with us. Some of this information is essential for us to be able to run the recruitment process properly.
These data mainly include your contact details (name, surname, e-mail, and optionally phone number), as well as the information contained in your CV and cover letter (such as personal photograph, address, LinkedIn profile, education, work experience, and skills). We use the data you provide to stay in contact with you, to conduct the recruitment process, and to assess your suitability for a specific position.
Other data we may process include a recording (video and audio, if such recording is made and you do not object to it) and any transcript from an interview . We may also process information you provide during the recruitment process through personal or written communication, for example by e-mail.
If you give us your consent, we process your personal data for the purpose of inviting you to participate in another recruitment process (inclusion in the talent pool).
1.2 Legal Basis
The legal basis for processing the above data, which is necessary for the application process, is implementation of measures prior to entering into an employment contract and pre-contractual negotiations under Art. 6 (1) (b) GDPR.
If we process further data on the basis of your consent, for example for inclusion in our talent pool, the legal basis is your consent under Art. 6 (1) (a) GDPR.
The legal basis for the processing operations that help us streamline the recruitment process and enable us to review the work of our HR staff is our legitimate interest under Article 6(1)(f) of the GDPR. This primarily involves the use of tools for recording interviews and transcribing interview content. We have developed risk management documentation (LIA, DPIA) for these processes and created binding internal regulations governing the use of these tools. You have the option to refuse processing based on our legitimate interest. Objecting will not have any legal consequences for you.
2. Access to Your Personal Data
As a joint controller under the General Data Protection Regulation (EU) 2016/679 (GDPR), We are responsible for processing your personal data. We make your personal data available only to authorized employees and cooperating persons, or to specific contracted processors of personal data, and in some cases to other controllers — always only to the extent necessary to achieve the relevant purposes and on the basis of an appropriate legal ground for processing. This may include, for example:
● providers of HR systems,
● processors that supply us with server, web, marketing, cloud, or IT services,
● law firms.
3. Use of Tools with Elements of Artificial Intelligence
To be able to process a volume of applications with the same level of care, we utilize tools with elements of artificial intelligence. We never replace, human decision‑making during recruitment by AI automated decision-making.
Processing necessary for reviewing your application (e.g. CV parsing, keyword matching) is carried out based on Art. 6(1)(b) GDPR (steps required prior to entering into an employment contract).
Processing that is not strictly necessary for evaluating your application, such as AI-generated interview transcripts or optional AI-assisted summaries, is carried out either on the basis of your freely given consent under Art. 6(1)(a) GDPR, or based on our legitimate interest under Art. 6(1)(f) GDPR in ensuring an efficient, consistent, and unbiased recruitment process, provided such processing does not override your rights.
3.1 Management of the Recruitment Process
To streamline the recruitment process when handling a large volume of applications, we use the cloud platform Ashby. We use Ashby for assisted evaluation of CVs (based on parameters defined by us), searching the candidate database (according to our parameters), candidate relationship management (sorting candidate responses into “Interested” / “Not Interested”), automated interview scheduling (e.g. suggesting suitable times, sending invitations), transcription of interviews, and generating summary analyses. The outputs, such as CV evaluations, are always supplemented with explanations and references to specific sections of the assessed documents, which allows us to verify and, if necessary, correct any analysis produced using AI tools. Ashby never assigns numerical scores to candidates or automatically ranks them according to suitability. AI also checks the parameters we set and alerts us to any criteria that could potentially amount to prohibited discrimination.
The final decision on both pre-selection and the final selection always remains with our recruiters. We use Ashby’s AI tools in compliance with the requirements of the GDPR and the European Union Artificial Intelligence Act (EU) 2024/1689.
3.2 Recording and Transcription of Online Interviews with Recruiter
If you participate in an online interview with an recruiter, a recording (audio/video) may be made, if you agree. The purpose of the recording is to ensure fair and transparent evaluation of the recruitment process, to allow later verification of the content of the interview, and to support fair decision-making by our recruiters.
For online interviews, we also use the Metaview service, which uses artificial intelligence to transcribe the interview into text form, if you agree. The transcript allows us to capture key information more easily, prepare concise summaries, and streamline the recruitment process. Metaview never assigns numerical scores to candidates, does not rank them, and does not make decisions about the outcome. Each transcript is always reviewed and assessed by our recruiter.
You are free to refuse recording or transcription of the interview without any negative consequences for your application.
3.3 AI interviews
To streamline our recruitment process, we utilize the Talent Pilot platform. As part of the hiring process, you may be invited to an interview with our AI assistant Alex. A significant advantage for you is total time flexibility; you can complete the interview whenever it is most convenient for you. Alex is available 24/7, eliminating the need for complex scheduling.
The use of artificial intelligence significantly accelerates the entire process, allowing you to receive a potential job offer much sooner. Furthermore, Alex processes your responses objectively and fairly, based on specific criteria established by our recruiters. This approach ensures equal opportunity for all candidates and helps eliminate unconscious bias.
A text transcript is generated from the online interview, which serves our recruiters as a basis for the subsequent selection stages and for the verification. However, the final decision regarding your advancement always remains with our human recruiters. The entire process is designed to comply with all GDPR requirements as well as the European Union Artificial Intelligence Act (EU) 2024/1689.
4. Retention Period of Personal Data
We will process your personal data for the duration of the recruitment process for the specific position and for an additional six (6) months after its completion.
If you give us your consent to contact you with a similar job offer in the future (i.e. to include you in the talent pool), we will process your personal data for a period of five (5) years. You may withdraw the consent at any time during this period, with effect from that point onwards.
5. Online Services We Use
On our website https://career.rohlik.group/group (the “Website”), we use online services provided by us and by third parties. These online services operate on the basis of cookies and similar technologies (e.g. tags, pixels), which store and retrieve identifiers and other information about computers, phones, and other devices used to access the Website. They help us provide, protect, and improve the Website, as well as select advertising that may be of interest to you.
On our Website, we use cookies for the following purposes:
● ensuring the proper functioning of the Website;
● enabling convenient Website functions;
● anonymized evaluation of user navigation on the Website;
● personalization of advertising displays.
All personal data are processed in a lawful and transparent manner, and only data that are adequate, relevant, and necessary in relation to the purpose of processing are required.
Cookie settings can be managed through our cookie banner, which is divided into categories – necessary, functional, analytical, and marketing – where you will also find detailed information about these services. A link to reopen the cookie banner is permanently available at the bottom of the Website. Cookies may also generally be refused, or their use limited to certain types, via your browser settings (Chrome; Firefox; Opera; Microsoft Edge).
6. Your Rights Regarding Your Personal Data
In relation to the processing of personal data carried out by us, you as a candidate have the following rights:
● the right of access to personal data;
● the right to rectification;
● the right to erasure (“right to be forgotten”);
● the right to restriction of processing;
● the right to object to processing; and
● the right to lodge a complaint concerning the processing of personal data; and
● the rights relating to profiling which produce legal effects.
Your rights are explained below to give you a clearer understanding of their content.
As a candidate, you may exercise all your rights by contacting us at privacy@rohlikgroup.com or via the contact details provided in the Annex. If you use the shared e-mail address privacy@rohlikgroup.com to exercise your rights, your request will be handled by the Group DPO (unless you specify which entity your request relates to). The Annex also contains the contact details of the Data Protection Officers (DPOs) of the respective Group companies.
You may also lodge a complaint with the competent supervisory authority. The list of competent supervisory authorities corresponding to each Group company is provided in the Annex to this Privacy Policy.
The right of access means that you may at any time request confirmation from us as to whether or not personal data concerning you are being processed and, if so, for what purposes, to what extent, to whom they are disclosed, how long we will process them, whether you have the right to rectification, erasure, restriction of processing or to object, the source of the personal data, and whether the processing of your personal data results in automated decision-making, including profiling. You also have the right to obtain a copy of your personal data, with the first copy provided free of charge and subsequent copies subject to a reasonable fee covering administrative costs.
The right to rectification means that you may at any time request the correction or completion of your personal data if it is inaccurate or incomplete.
The right to erasure means that we must delete your personal data if (i) it is no longer needed for the purposes for which it was collected or otherwise processed, (ii) the processing is unlawful, (iii) you object to the processing and there are no overriding legitimate grounds for the processing, or (iv) we are required to do so by law.
The right to restriction of processing means that until any disputed issues regarding the processing of your personal data are resolved, we must restrict the processing of your personal data so that we may only store it and possibly use it for the establishment, exercise, or defense of legal claims.
The right to object means that you may object to the processing of your personal data based on our legitimate interest. If you object to processing, your personal data will no longer be processed for these purposes, unless we have an overriding legitimate reason to continue.
The rights relating to profiling which produce legal effects
In accordance with Article 22(3) of the GDPR, we take appropriate measures to protect your rights and freedoms, monitor automated profiling/decision-making with the option to review the decision in justified cases, and in the event of automated profiling/decisions, you also have:
a. the right to request a review by a human being,
b. the right to set out their point of view and provide explanations and supporting evidence.
This Privacy Policy has been effective since 25 May 2018 and is regularly updated.
Last update: April 2026
Annex
List of Joint Controllers
Czech Republic
1. Rohlik skillz s.r.o, ID No.: 09990739, with registered seat at Karolinská 654/2, Karlín, 186 00 Prague 8, the Czech Republic, entered into Commercial Register maintained by Municipal Court in Prague, File No. C 345970
2. Rohlik Group a.s., ID No.: 09960678, with registered seat at Karolinská 654/2, Karlín, 186 00 Prague 8, the Czech Republic, entered into Commercial Register maintained by Municipal Court in Prague, File No. B 26123
3. VELKÁ PECKA s.r.o., ID No.: 03024130, with registered seat at Karolinská 654/2, Karlín, 186 00 Prague 8, the Czech Republic, entered into Commercial Register maintained by Municipal Court in Prague, File No. C 226550
• DPO: FairData Professionals a.s. (Mgr. Jaroslav Šuchman, LL.M., Mgr. Ing. Jana Schwarz Duchková), e-mail: privacy@rohlikgroup.com, tel. +420 483 104 376
• Supervisory authority: Office for Personal Data Protection, website: www.uoou.cz
Hungary
1. Kifli.hu Shop Kft., ID No.: 01-09-339560, with registered seat at Jászberényi út 49., 1106 Budapest, Hungary
• DPO: Tamás Lengré, e-mail: dpo@kifli.hu
• Supervisory authority: National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11.; Tel: +36 1 391 1400; Fax: +36-1-391-1410, e-mail: ugyfelszolgalat@naih.hu; website: http://naih.hu/
Germany
1. Großer Kern GmbH, ID No.: HRB 256048, with registered seat at Tal 30, 80331 Munich, Germany
• DPO: legal data Schröder Rechtsanwaltsgesellschaft mbH, Maximilianstraße 27, 80539 Munich, E-Mail: datenschutz@legaldata.law, Tel. +49 (0)89 954 597 520
• Supervisory authority: Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Tel.: +49 (0) 981 180093-0, E‑Mail: poststelle@lda.bayern.de, Website: www.lda.bayern.de; If you are staying in another federal state or outside Germany, you may also contact the data protection authority competent for that location.
Austria
1. Gurkerl.at GmbH, ID No.: FN 535948 i, with registered seat at Tech Park Vienna – Gutheil-Schoder-Gasse 17, 1230 Vienna, Austria
• DPO: legal data Schröder Rechtsanwaltsgesellschaft mbH, Maximilianstraße 27, 80539 Munich, E-Mail: datenschutz@legaldata.law, Tel. +49 (0)89 954 597 520
• Supervisory authority: Austrian Data Protection Authority, Barichgasse 40–42 1030, Vienna, Austria, Tel. +43 1 52 152-0; e-mail: dsb@dsb.gv.at; website: www.dsb.gv.at
Romania
1. COVRIG CROCANT S.R.L., ID No.: J2022003903230, VAT: RO44505200, with registered seat at Sat Ștefăneștii de Jos, Comuna Ștefăneștii de Jos, Strada Linia de Centură, Nr. 5, unitatea J2 si extindere depozit din clădirea BUN1 (inclusiv parcare), Camera C9.1F.12, parc industrial CTPark Bucharest North, Judet Ilfov, Romania
2. SEZAMO S.R.L., ID No.: J2024003334230, VAT: RO50051526, with registered seat at Sat Ștefăneștii de Jos, Comuna Ștefăneștii de Jos, Strada Linia de Centură, Nr. 5, unitatea J2 si extindere depozit din clădirea BUN1 (inclusiv parcare), Camera C9.1F.26, parc industrial CTPark Bucharest North, Judet Ilfov, Romania
• DPO: Ene & Partners - Cabinetul de Avocat „ENE CONSTANTIN DOREL” (Av. Ene Constantin Dorel, e-mail: dpo@sezamo.ro)
• Supervisory authority: National Authority for the Supervision of Personal Data Processing (ANSPDCP via https://dataprotection.ro/)