Privacy Policy

1. Who We Are

HR Lab Limited is a company incorporated and registered in the Republic of Cyprus.

Company Registration No.: HE 488114
Ministry of Labour Licence No.: 587
Registered Office: 40, Themistokli Dervi, 1st Floor, Office No. 101, 1066, Nicosia, Cyprus
Email: info@hrlabltd.com

For the purposes of applicable data protection legislation, HR Lab Limited acts as the data controller in relation to the personal data described in this Privacy Notice, unless otherwise stated.

2. Who This Privacy Notice Applies To

This Privacy Notice applies to individuals whose personal data we process in connection with our services, including:

  • current, former and prospective candidates;

  • individuals who submit an application or CV to HR Lab;

  • individuals we identify or contact regarding potential employment opportunities;

  • employees or representatives of our clients and prospective clients;

  • referees and other professional contacts;

  • individuals who communicate with HR Lab;

  • visitors to our website; and

  • other individuals whose personal data we may lawfully receive in connection with our recruitment and HR services.

3. What Personal Data We Collect

Depending on our relationship with you and the services we provide, we may collect and process information including:

Candidate Information

  • name and contact details;

  • address and location;

  • CV/resumé;

  • education, qualifications and professional certifications;

  • employment history and experience;

  • skills and professional competencies;

  • current employment status;

  • availability;

  • salary expectations;

  • information provided during interviews or assessments;

  • references and information provided by referees;

  • information relating to your right to work, where relevant and legally required;

  • information contained in correspondence with us; and

  • other information you voluntarily provide in connection with your application or employment opportunities.

Where necessary and legally permitted, we may also process additional information required for a particular recruitment assignment or legal/regulatory requirement.

Client and Business Contact Information

For our clients and business contacts, we may process:

  • name and contact details;

  • job title and professional information;

  • company information;

  • correspondence and communications;

  • information relating to recruitment requirements;

  • contractual and billing information; and

  • other information necessary to establish and manage our business relationship.

Website Information

When you visit our website, we may collect certain technical information, such as IP address, browser type, device information, pages visited and information regarding your interaction with our website, subject to our Cookie Policy and applicable law.

4. How We Collect Personal Data

We may collect personal data directly from you or from other lawful sources.

This may include information provided:

  • when you submit your CV or application;

  • through our website or online application forms;

  • by email, telephone or other communication channels;

  • during interviews or meetings;

  • when you contact us regarding employment opportunities;

  • through professional networking platforms and publicly available professional information;

  • through job boards or recruitment platforms;

  • through referrals or recommendations;

  • from referees, where appropriate;

  • from our clients or prospective clients; or

  • from other third parties where we are legally permitted to obtain and use such information.

Where we receive personal data about you from another source, we will process it in accordance with applicable data protection requirements.

5. How We Use Your Personal Data

We may use personal data for purposes including:

  • identifying and assessing candidates for suitable employment opportunities;

  • matching candidates with vacancies and recruitment requirements;

  • communicating with candidates regarding available positions;

  • arranging interviews and recruitment meetings;

  • communicating with clients regarding recruitment requirements;

  • presenting suitable candidate profiles to clients;

  • conducting recruitment and selection activities;

  • obtaining and verifying professional references, where appropriate;

  • providing recruitment and HR-related services;

  • managing our relationship with clients and candidates;

  • maintaining appropriate recruitment and business records;

  • complying with legal and regulatory obligations;

  • protecting our legitimate business interests and rights;

  • improving our recruitment services and website; and

  • responding to enquiries, requests or complaints.

We will only process personal data where there is an appropriate lawful basis for doing so.

6. Legal Basis for Processing

Depending on the circumstances, we may rely on one or more of the following lawful bases under the GDPR:

Performance of a contract or steps prior to entering into a contract

Where processing is necessary to take steps at your request before entering into a contract or to perform a contract.

Legitimate Interests

We may process personal data where this is necessary for our legitimate interests, provided that those interests are not overridden by your fundamental rights and freedoms.

Examples may include managing recruitment activities, identifying suitable candidates for vacancies, communicating with clients and candidates, maintaining business records and protecting our business interests.

Legal Obligations

We may process personal data where this is necessary for compliance with a legal or regulatory obligation to which HR Lab is subject.

Consent

Where required, we may rely on your consent for specific processing activities. Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Sharing Personal Data

As part of our recruitment and HR services, we may share personal data with appropriate recipients where this is necessary and lawful.

Depending on the circumstances, recipients may include:

  • our clients and prospective employers;

  • candidates and individuals involved in the recruitment process, where appropriate;

  • service providers supporting our business;

  • recruitment and candidate management platforms;

  • IT, cloud storage and communication providers;

  • professional advisers, including legal and accounting advisers;

  • government, regulatory or supervisory authorities where required by law; and

  • other third parties where disclosure is necessary, lawful and appropriate for the purposes described in this Privacy Notice.

We do not sell personal data to third parties.

Where candidate information is shared with a prospective employer, we aim to ensure that only information relevant and necessary for the relevant recruitment opportunity is disclosed.

8. International Transfers

Some of our service providers or technology providers may process personal data outside Cyprus or the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data protection legislation and that appropriate safeguards are in place where required.

9. Special Categories of Personal Data

In certain circumstances, recruitment or HR services may require the processing of special categories of personal data, such as information relating to health or disability, where legally permitted and necessary for a specific purpose.

We will only process such information where an appropriate legal condition under applicable data protection legislation applies and where the processing is necessary and proportionate to the relevant purpose.

We do not seek to collect sensitive personal information unless it is relevant, necessary and legally permitted.

10. Automated Decision-Making and Profiling

HR Lab may use recruitment technologies and software to assist with candidate searches, organisation of candidate information and the identification of potentially suitable candidates.

Where such technologies are used, they are intended to support our recruitment activities and do not replace appropriate human involvement in recruitment decisions.

We will not make decisions based solely on automated processing where such a decision would produce legal effects or similarly significantly affect you, unless permitted by applicable law and appropriate safeguards are in place.

11. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including recruitment, maintaining our business records, providing our services and complying with applicable legal, regulatory and professional obligations.

Retention periods may vary depending on:

  • the type and nature of the personal data;

  • the purpose for which it was collected;

  • whether there is an ongoing recruitment or business relationship;

  • our legal and regulatory obligations; and

  • our legitimate business requirements.

When personal data is no longer required, we will take reasonable steps to securely delete or anonymise it.

12. Your Data Protection Rights

Subject to applicable law and certain limitations, you may have the right to:

  • request access to the personal data we hold about you;

  • request correction of inaccurate or incomplete information;

  • request deletion of your personal data;

  • request restriction of processing;

  • object to certain processing activities;

  • request portability of your personal data where applicable;

  • withdraw consent where processing is based on consent; and

  • object to processing carried out on the basis of legitimate interests, subject to applicable legal requirements.

To exercise any of these rights, please contact us using the details provided below.

We may need to request additional information to verify your identity before responding to a request.

13. Data Security

We take appropriate technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration or disclosure.

Access to personal data is limited to individuals and service providers who require access for legitimate business purposes and who are subject to appropriate confidentiality obligations.

However, no method of transmission or electronic storage can be guaranteed to be completely secure.

14. Cookies and Website Technologies

Our website may use cookies and similar technologies to ensure that the website functions properly, improve user experience and, where applicable, understand how visitors use our website.

Further information regarding our use of cookies is available in our Cookie Policy.

15. Your Right to Make a Complaint

If you have concerns about the way HR Lab processes your personal data, we encourage you to contact us first so that we can investigate and address your concerns.

You also have the right to lodge a complaint with the competent data protection supervisory authority.

In Cyprus, the relevant supervisory authority is the Office of the Commissioner for Personal Data Protection.

Official contact details are available through the Commissioner's website.

16. Contact Us

If you have any questions about this Privacy Notice, wish to exercise your data protection rights, or have any concerns regarding the processing of your personal data, please contact us:

HR Lab Limited
15, Vragadinou, 2nd Floor, Office 209, 3041, Limassol, Cyprus
Republic of Cyprus

Email: info@hrlabltd.com
Telephone: +357 94 341 707

17. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in our services, business practices, technology or applicable legal and regulatory requirements.

Any updated version will be published on our website together with the relevant “Last Updated” date.

Last Updated: 29 August 2026