Privacy notice

Who we are. Hesion is a sole proprietorship registered in India (Udyam registration UDYAM-TN-28-0045281), 2/956, 1st Street, JJ Nagar, Veerapandi Post, Tiruppur, Tamil Nadu 641605, India. We decide how the personal data described here is used (we are the "controller"). Contact for anything about your data: mathan@hesion.in.

1. If you are a hiring contact at an employer

Employers publish hiring contacts so that people can reach them about their vacancies. When a Czech employer lists your work contact in a vacancy on the Czech Labour Office portal (up.gov.cz), or on its own website in an HR or hiring role, we may pass it to a recruitment agency or labour supplier that buys that vacancy from us, so they can offer the employer workers for it.

• What we pass on: your name, work email and work phone as the employer published them, your hiring role, and the vacancy details. We only use company email addresses, never personal ones (such as gmail or seznam), and never data from personal profiles (LinkedIn, social media) or guessed addresses.
• Where it comes from: the employer's vacancy on the Czech Labour Office portal, or the employer's own website (we keep the page and date).
• Why, and on what legal basis: to connect employers that are hiring with agencies that can supply workers: our legitimate interest and that of the employer and the agencies (GDPR Art. 6(1)(f)). You published the contact for hiring, and it is used only for offers about that hiring.
• Who receives it: at most 3 agencies or labour suppliers per vacancy, in the EU or (for jobs open to non-EU workers) registered recruiting agents in India bound by the EU Standard Contractual Clauses, who must use it only to offer workers for that employer, tell you where they got it when they first contact you, respect your objection, and not pass it on (our terms of sale).
• How long: until 90 days after the vacancy is no longer published; then we delete it.
• We tell you: the first time your contact is passed on, we email you once, with a link to stop it.

2. If you buy from us

• What: your work email (to sign in with a one-time code), the company you buy for, invoice details you give us, and what you buy. Payments are handled by PayPal (or Razorpay for buyers in India); we never see your card number.
• Why: to run your account, deliver what you buy and invoice it (performing our contract with you, GDPR Art. 6(1)(b)); to keep accounting records (legal obligation, Art. 6(1)(c)).
• How long: your account while it's in use; invoices and payment records as long as tax law requires.

3. If you get an email from us and open its link

• What: the links in our emails carry a random code for that email, so we can see which link was opened, when, which page, and from which country (not your IP address). We use no cookies and no tracking pixel, and we cannot tell whether you opened the email itself.
• Why, and on what legal basis: to see whether an offer was of interest and to improve it: our legitimate interest (GDPR Art. 6(1)(f)). Only we see this data.
• How long: 12 months, then we delete it. Reply "stop" to any of our emails and we stop emailing you.

4. Where the data is kept, and who helps us

Our database is run by Supabase; emails are sent by Resend; payments by PayPal and Razorpay; the website is hosted by our hosting provider. They process data only on our instructions. Some of them store data outside the EU (including in India, where we are based); where GDPR requires it, the transfer is covered by the providers' standard contractual clauses.

5. Your rights

You can ask us for a copy of your data, to correct or delete it, or to restrict it, and you can object at any time to our passing on your work contact: we then stop. Write to mathan@hesion.in; we answer within a month. You can also complain to a data protection authority, in Czechia the Úřad pro ochranu osobních údajů (uoou.gov.cz).