Full privacy notice — the Anyway platform and the TudatOS services

Version: v2026-10-27 · Effective from: 27 October 2026
Changes since v2026-10-22: new 5.25. § on feedback sent in the apps and on the web (what we store, legal basis, retention: images are deleted 30 days after the feedback is closed, all other data after 12 months); related rows in the 13. § table.
Earlier changes (v2026-10-22, since v2026-10-21): new 5.24. § on the CV builder: the account created automatically when you complete it, AI processing (Anthropic, with Google as fallback), the CV snapshot kept for 30 days, and the retention of usage events (180 days) and ratings (365 days); Section 6 now describes how the platform actually works: the tdi_consent cookie that stores your cookie-banner choice (necessary), the tdi_attr attribution cookie set only with marketing consent, and the server-side Meta Conversions API, which also works only with marketing consent (6.3.); 5.21. § corrected: we do not store an IP address or a fingerprint with a saved personality-test result, only the time of consent, the version of its text and whether you or your parent gave it; the related rows in the tables of Section 4, Section 8, Section 10, Section 12 and Section 13.
Earlier change (v2026-10-21, since v2026-10-16): new 5.16.1. § registration reminder call (Norbi): if the next step needed for your employment notification depends on you, our AI-based voice assistant may call you before you start; this call type also appears in the references in Section 4, Section 8, Section 12, Section 13 and Section 15.
Earlier change (v2026-10-16, since v2026-10-15): under 5.11. § we e-mail you job offers that match your profile as part of the service (performance of the contract, with one-click unsubscribe); the weekly e-mail digest, recommendation push notifications / SMS and partner offers still require consent, which we also ask for at registration and when you open the application, including with an “Accept all” button. New 5.21.Tudatos Te personality test — saved result (deleted automatically 24 months after saving) and new 5.23.quick job finder, career test and major picker questionnaires; the Tudatos Points programme moves to 5.22.. In Section 10 and Section 8 the transfer safeguard for Anthropic is the SCC (EU 2021/914), not the DPF; the same applies to OpenAI and Apple, and Stripe’s certified entity is Stripe, LLC.
Earlier change (v2026-10-15, since v2026-10-09): 5.14. § now covers the monthly service update letter sent to partner-company contacts (legitimate interest, one-click objection) and the newsletter and offers sent only with prior consent.
Earlier change (v2026-10-09, since v2026-10-08): new 5.21. § Tudatos Points loyalty programme (points, tiers — applicable from the launch of the programme), with matching rows in the 4. § and 13. § tables; in 5.4. § we record your declaration about the health booklet instead of a photograph (and the 13. § row).
Earlier change (v2026-10-08, since v2026-09-04): new 5.16. § AI phone pre-screening (AI caller), 5.17. § automated interview-reminder calls, 5.18. § call log, 5.19. § profiling (automatic job recommendations, “student until” forecast, target groups), 5.20. § CrewClub; the automated-decision part of 8. § aligned with how the system actually works; new person responsible for data protection; corrected processor list, mobile app identifiers and company data of TDO (Tudatos Dolgozók Szociális Szövetkezet). (v2026-09-04 added 5.15. § Videos; in v2026-08-10 the Anyway platform was taken out of scope — see 4. §. This English version is identical in content to the Hungarian one; in case of discrepancy the Hungarian text prevails.)

This notice has been prepared in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Infotv.).

1. § The Controller — joint controllers (Article 26 GDPR)

(1) Personal data is processed by the following three Hungarian legal entities as joint controllers:

(2) The Controllers have entered into a joint controller arrangement under Article 26(1) GDPR. Its essence is as follows: T-Digital Solutions Kft. is responsible for fulfilling the administrative obligations relating to the joint processing; data subjects may exercise their rights against any of the joint controllers, through a single, unified point of contact. We send the essence of the arrangement on request.

(3) Single point of contact:
E-mail: dpo@tudatosdiak.hu · Postal address: 1117 Budapest, Dombóvári út 9., Hungary · Phone: +36 1 815 8990

(4) Person responsible for data protection (data protection contact for all three joint controllers): Leonárd Henrik Szabó — dpo@tudatosdiak.hu

2. § The software operator — processor (Article 28 GDPR)

(1) The software concerned (tudatosdiak.hu, anyway.hu, app.tudatosdiak.hu, app.anyway.hu, office.tudatosdiak.hu, and the TudatOS Karrier / Partner / Staff and CrewClub mobile applications) is developed and operated on behalf of the Controller by the following company:

(2) T-Cloud Solutions Kft. processes personal data exclusively on the documented instructions of the Controller, under a written Data Processing Agreement (DPA). It also engages further sub-processors; the full list is set out in Section 12.

3. § Definitions

• Processing: any operation or set of operations performed on personal data.
• Controller: the natural or legal person that determines the purposes and means of the processing.
• Joint controller: a controller that jointly determines the processing under an arrangement pursuant to Article 26 GDPR.
• Processor: a person that processes personal data on behalf of, and on the instructions of, the controller.
• Sub-processor: a person engaged by the processor to carry out part of the task.
• Recipient: a person to whom we disclose the personal data.
• Data subject: the natural person whose personal data we process.
• Consent: a freely given, specific, informed and unambiguous indication of wishes.
• Personal data: information relating to an identified or identifiable natural person.
• Special category data: a category under Article 9 GDPR (e.g. health data).
• Profiling: automated evaluation of personal data in order to predict certain characteristics.
• Cookie and local storage: a small data file placed on the user’s device, or data stored in the browser.
• Personal data breach: a breach of the security of personal data.
• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council.

4. § Scope of this notice

The Anyway platform is covered by a separate notice — on purpose. There the roles are different: for account data T-Cloud Solutions Kft. is the controller, while for the content uploaded by users (vouchers, documents) it is a processor under Article 28 GDPR, because there the controller is the subscriber itself. The same service cannot be described with two contradicting role allocations, so the Anyway platform and its mobile application are described exclusively by their own notice: konyveles.anyway.hu/adatkezelesi-tajekoztato

5. § Purposes, legal bases, data processed and retention

5.1. Registration and account management

• Mandatory data: last name, first name, e-mail address, password (stored hashed only, in a non-reversible form).
• Optional data: phone number, language, newsletter consent, gender, nationality, source of registration (UTM parameters, referrer, landing page).
• Purpose: identification of the user, account management, communication.
• Legal basis: Article 6(1)(b) GDPR — conclusion and performance of the account agreement.
• Retention: until the account is terminated; where the e-mail address is not confirmed, automatic deletion after 90 days; automatic deletion after 2 years of inactivity.

5.2. Detailed job-seeker and membership profile

• Data: address, place and date of birth, mother’s maiden name, nationality, student-ID number, tax-ID, TAJ (social-security) number, bank-account number, e-mail address of the legal guardian (parent), languages, work experience, qualifications, interests, driving licence.
• Purpose: job application, preparation of the cooperative membership relationship, fulfilment of statutory notification obligations.
• Legal basis: Article 6(1)(b) GDPR — contract; for the financial and tax fields Article 6(1)(c) — legal obligation (Act CXVII of 1995 on Personal Income Tax (Szja tv.), Act CXXII of 2019 on Social Security Contributions (Tbj.), Act X of 2006 on Cooperatives).
• Retention: until membership is established or the profile is deleted; in the case of membership, the duration of the relationship + a 5-year limitation period (accounting and payroll data: see 5.6.).

5.3. Student ID and enrolment certificate photographs

• Data: photograph of the front and back of the student ID, student or pupil enrolment certificate.
• Purpose: verification of cooperative membership eligibility and of pupil/student status.
• Legal basis: Article 6(1)(c) GDPR — legal obligation (Act X of 2006 on Cooperatives).
• Retention: automatically deleted from both the file storage and the database 30 days after the date of the employment notification to the tax authority (NAV); immediately upon rejection.
• Recipients: the joint controllers; official student-status verification (KEF-IF / NEAK).

5.4. Occupational health data — special category data under Article 9 GDPR

• Data: date of the examination, examining physician, place of the examination, fitness statement (PDF), validity, FEOR code, job position. For the health booklet, your declaration: that you have a valid health booklet, its expiry date, and when and on which surface (web, app) you declared it; if a colleague recorded it based on what you told us, who recorded it and how we know (e.g. phone call, email). We do not ask for or store a photograph of the booklet: the booklet stays with you and the partner checks it at the workplace.
• Purpose: statutory certification of occupational health fitness.
• Legal basis — in two phases: while you work on the basis of the opinion (the opinion is valid and the employment is ongoing), Article 6(1)(c) and Article 9(2)(b) GDPR — legal obligation: only a person who is medically fit may be employed (Act XCIII of 1993 on Labour Safety (Mvt.) § 49(1); Decree 33/1998 (VI. 24.) NM; the liability of the school cooperative: Act X of 2006 on Cooperatives § 10/B). After that, during the 5-year retention as evidence, Article 6(1)(f) and Article 9(2)(f) GDPR — legitimate interest: the establishment, exercise or defence of legal claims (Ptk. § 6:22). The same two legal bases apply to the health booklet declaration (in a food-handling job no one may be employed without a valid booklet: Decree 33/1998 NM § 16).
• Retention: if you worked on the basis of the fitness opinion during its validity, we keep it for 5 years from your last working day, as evidence in case we need to prove your fitness after an accident or an inspection (limitation period for damage claims: Ptk. § 6:22; the liability of the school cooperative: Act X of 2006 on Cooperatives § 10/B); if an accident investigation, official proceeding or lawsuit is pending, until it is closed. If you did not work on the basis of the opinion, we delete it 30 days after it expires. The health booklet declaration is handled the same way: if you did booklet-required work during its validity, we keep it for 5 years from your last working day; otherwise we delete it 30 days after the declared expiry. Health booklet photographs uploaded before 8 October 2026 are deleted in one round. (The 30-year retention is an obligation of the occupational health service provider — Decree 33/1998 NM — not ours.)
• Recipients: the occupational health service provider, the joint controllers, T-Cloud Solutions Kft.
• Note: we do not record the specific medical result (diagnosis) of the examination — only the fit / not fit / fit with conditions rating and the validity period; if a document nevertheless shows a diagnosis, we do not record it.

5.5. Employment, work performance, attendance

• Data: individual assignment agreements, job position and FEOR code, place of work, hours worked, timesheet, shift schedule, absence, certificate of performance.
• Purpose: performance of the employment, settlement towards the partner, statutory record-keeping.
• Legal basis: Article 6(1)(b) and (c) GDPR (Act I of 2012 on the Labour Code (Mt.), Act X of 2006 on Cooperatives, Act C of 2000 on Accounting (Szvt.)).
• Retention: end of the relationship + 5 years; pay-related vouchers as set out in 5.6.
• The check-in function of the mobile application records a timestamp only; it does not record GPS coordinates.

5.6. Cooperative membership contract and payroll settlement

• Data: natural-person identification data, address, tax-ID, TAJ number, bank-account number; the data required for family and personal tax allowances (number of children, number of children under 16, child with a disability, single parent, date of first marriage, recent-graduate status); payslips, payments.
• Purpose: creation and performance of the membership contract, payroll accounting, tax and contribution returns, payment.
• Legal basis: Article 6(1)(b) GDPR (contract) and Article 6(1)(c) GDPR (Szja tv., Tbj., Act C of 2000 on Accounting (Szvt.), Act X of 2006 on Cooperatives).
• Retention: accounting vouchers 8 years (Szvt. § 169); payroll source data 50 years from the last day of the calendar year following the end of the employment (Act LXXXI of 1997 on Social Security Pension Benefits (Tny.) § 99/A); other membership data 5 years (limitation period under Act V of 2013 on the Civil Code (Ptk.)).
• Recipients: the joint controllers, NAV, the payroll provider (Hessyn / RLB-60), the accountant, OTP Bank Nyrt., KBOSS.hu Kft. (Számlázz.hu).

5.7. Contracts and electronic signature

• Data: name at the time of signing, place and date of birth, mother’s name, address; the channel used to send the one-time passcode (OTP) for identity verification (e-mail / SMS), its recipient and the time of successful verification; IP address, browser identifier (user-agent); the handwritten signature image and its seal; RFC 3161 timestamp and hash.
• Purpose: provable electronic signature (PAdES) for contracts and for filings with the authorities.
• Legal basis: Article 6(1)(b) GDPR — contract; Regulation (EU) 910/2014 (eIDAS).
• Retention: until the limitation period of the relationship underpinned by the contract expires (generally 5 years); as an accounting voucher, 8 years.
• Recipients: the joint controllers; Wiredsign Zrt. (signature service); FreeTSA (timestamping).

5.8. Job application (ATS — the Anyway platform)

• Data: name, e-mail, phone, CV (PDF), cover letter, the content of the job-seeker profile, answers to the application questions, the time and status of the application, internal notes and evaluations relating to the process.
• Purpose: conducting the application procedure, forwarding the application to the employer partner.
• Legal basis: Article 6(1)(a) GDPR — explicit consent (the submission of the application).
• Retention: we keep the application (with the related answers, notes and assessments) until your account is deleted, and delete it when the account is deleted. The employer partner can access the details of your application (contact details, CV, answers) for at most 60 days from the application — and at most until the end of a short grace period after the vacancy is closed; after that it cannot. If you tick the CV Database (Open to Work) option, partner access is governed by 5.10.
• Recipients: the employer partner whose vacancy you applied for; the joint controllers; T-Cloud Solutions Kft.

5.9. AI-based CV analysis, scoring and match recommendation

• Data sent to the AI: the full text of the uploaded CV, name, e-mail, phone, date of birth, nationality, languages, work experience, qualifications, driving licence, the answers given to the application questions.
• Data NOT sent to the AI: TAJ number, tax-ID, mother’s name, bank-account number, family-tax-allowance data, occupational health data, password, and all pay data (hourly rate, gross and net pay, amounts paid out and transferred, payslips).
• Purpose: structured data extraction (you can edit the result yourself), scoring of the match to the job, preliminary categorisation, generation of report and text drafts, internal assistant.
• Legal basis: Article 6(1)(b) GDPR — efficient performance of the recruitment process.
• Retention: the AI output follows the retention period of the application or of the profile, as applicable; the log of AI conversations: 24 months.
• Providers used: Anthropic PBC (Claude), Google LLC (Gemini) — see Section 8 and Section 12.

5.10. CV Database (Open to Work) and partner access

• What it means: a voluntary option that you can switch on separately in your profile. If you switch it on, your profile is added to the CV Database, and our contracted employer partners can find you even when you have not applied for the given vacancy.
• What the partner sees: full name, e-mail address, phone number, date of birth, place of residence (town), qualifications, languages, work experience, the uploaded CV and the interests given in the profile.
• What the partner does NOT see: TAJ number, tax-ID, mother’s name, bank-account number, occupational health data, pay data, your applications running at other partners.
• Legal basis: Article 6(1)(a) GDPR — explicit, separate consent, which can be withdrawn at any time with a single toggle.
• Retention: until consent is withdrawn, and at most 2 years, after which we ask you again.
• Important: if a partner transfers your data into its own system, from that point on it acts as an independent controller in respect of that data. Our contract obliges the partner to inform you of this and to ensure your rights.

5.11. Communication (e-mail, SMS, push, newsletter)

• Data: e-mail address, phone number, push token, the content of the message and its delivery metadata (time, opens, clicks).
• Purpose: notifications about the process, reminders, job alerts, newsletter.
• Legal basis: for service-type (transactional) messages and for job offers that match you (below), Article 6(1)(b) GDPR; for marketing-type messages, Article 6(1)(a) — consent that can be withdrawn at any time, in line with Section 6 of Act XLVIII of 2008 on the Basic Requirements of and Certain Restrictions on Commercial Advertising Activity (Grt.).
• Retention: e-mail and SMS logs 24 months, then anonymised statistics; push: until delivery.
• Recipients: Amazon Web Services EMEA SARL (Amazon SES, Frankfurt — e-mail), Sendinblue SAS (Brevo — fallback e-mail delivery), SeeMe Solutions Kft. (SMS), Twilio Inc. (phone calls — 5.16–5.17.), Google FCM and Apple APNs (push).
• Push notifications — two kinds: service push notifications (contract, employment notification, occupational health, interview, timesheet, pay) are based on the performance of the contract — Article 6(1)(b). Recommendation push notifications (new jobs that match you, weekly digest, the “We miss you!” reminder, campaigns) are based on your consent — Article 6(1)(a), see below. Without consent, no recommendation push notification is sent; at most, the offer appears in the Notifications list of the application.
• Job offers by e-mail (service): as a registered student you are with us to find work, so we e-mail you specific job offers that match your profile (individual job ads chosen for you by our staff or by the automatic recommender — 5.19.). This is part of the service, based on the performance of the contract — Article 6(1)(b). If you have not given the “partner companies may contact you” consent, the partner company sees nothing of such an offer; only if you reply “Interested” does it receive your application. You can unsubscribe at any time with one click at the bottom of the e-mail or with the “Job offer e-mails” toggle in your settings. We do not send them to users under the age of 18 (7.3.).
• Consent to other recommendation messages: in the application (on a sheet shown when you open it and in the Notifications list), on the website (on a card on the student home page) and at registration, we ask for it with three separate checkboxes, none of them ticked by default — you can also give all three at once with the “Accept all” button: (1) a weekly e-mail digest of new jobs that match you; (2) push notifications or SMS about new jobs that match you and about our offers; (3) partner companies may send you personalised job offers through the platform — they only see your name and contact details if you accept. Giving consent is voluntary. We log your answer and every later change to it, together with the time, the interface (application / web), and the version of the card text and of this notice (Grt. § 6(5)). Without consent we send no weekly digest, recommendation push notification or SMS, and a partner’s own offer only appears among the notifications in your account; to users under the age of 18 we send none of these at all (7.3.).
• Withdrawal: there are three separate toggles in the notification settings of your profile (on the web under Notifications, in the application under Settings ▸ Notifications): “Job offer e-mails” (the weekly digest and the job offer e-mails together), “Recommendation push notifications and SMS”, “Offers from partner companies”. You can switch off any of them at any time, and you can also unsubscribe with one click at the bottom of the e-mails. Withdrawal does not affect the lawfulness of messages sent before it.
• Unsubscribing: a one-click unsubscribe link (RFC 8058) at the bottom of every marketing e-mail, and the notification settings in your profile.

5.12. Operational, security and audit logs

• Data: IP address, browser identifier (user-agent), the URL browsed, event type, session identifier, mobile application screen, application version, push opens; data-change audit (the old and the new value, who changed it and when).
• Purpose: troubleshooting, fraud and abuse prevention, accountability (Article 5(2) GDPR).
• Legal basis: Article 6(1)(f) GDPR — legitimate interest. The legitimate interest assessment (balancing test) is available on request.
• Right to object: at any time, at dpo@tudatosdiak.hu.
• Retention: detailed event log 90 days, then aggregate only; financial audit log 5 years; the session cookie at most 30 days. The sign-in log (the user identifier and the time of sign-in only — no IP address or browser identifier) is kept for 24 months, as it is the source of the monthly service-usage statistics.

5.13. Mobile device and app event data

• Data: device identifier, platform (iOS / Android), operating-system and application version, push token, screen-event history.
• Purpose: identifying the recipient of push notifications, measuring the stability of the application and feature usage, delivering application updates (OTA).
• Legal basis: for delivering service push notifications, Article 6(1)(b) GDPR; for recommendation push notifications, Article 6(1)(a) — consent (5.11.); for analytics and update delivery, Article 6(1)(f) GDPR, with an opt-out option.
• Retention: push token for as long as the application is installed; mobile event log 90 days.

5.14. Employer partner — contact-person and corporate data, service update letter, newsletter

• Data: the contact person’s name, e-mail address, phone number and job position; the company’s name, registered seat, tax number, company-registry data, representative and basic financial data (from Cégadat / Opten queries).
• Purpose: contracting and performance, invoicing, management of the recruitment project, partner-risk checks.
• Legal basis: Article 6(1)(b) GDPR contract; Article 6(1)(c) GDPR for the customer due diligence required by Act LIII of 2017 on the Prevention and Combating of Money Laundering and Terrorist Financing (Pmt.); Article 6(1)(f) GDPR legitimate interest for the risk checks.
• Retention: the duration of the business relationship + 5 years; accounting vouchers 8 years.
• Service update letter (monthly partner letter): at most once a month we send the contacts of partner companies using the platform an e-mail summarising how the service they already use has changed (new features, changes to processes and deadlines, contact details). The letter contains no advertising or offers. Recipients: the main contact of every partner company that has advertised or employed through the platform in the last 180 days, and those further users of the partner company who have used the platform in the last 60 days. Data: name, e-mail address, language, the partner company’s name and segment (office / service), main-contact status, time of last activity; the sending log (edition, time) and delivery metadata (5.11.). Legal basis: Article 6(1)(f) GDPR — our legitimate interest in informing our contracted partners about changes to the service they use; the balancing test has been carried out and is available on request. Objection: at any time, with one click, via the link at the end of the letter or your mail client’s unsubscribe button (List-Unsubscribe) — without logging in and with immediate effect — or at dpo@tudatosdiak.hu. An objection does not affect notifications necessary for the operation of the service (e.g. new applicant, contract, invoice).
• Newsletter and offers for partner contacts: we send e-mails containing advertising or offers (e.g. recommending a new service, the referral programme, discounts) only to contacts who have given prior, explicit consent on the platform via a checkbox that is unticked by default — Article 6(1)(a) GDPR and Section 6(1) of the Hungarian Advertising Act (Grt.). We log the time and interface of the consent and the version of the consent text (Grt. Section 6(5)). Consent can be withdrawn at any time with one click at the end of the letter or in the preference centre; withdrawal does not affect the lawfulness of earlier sends. We keep the fact and time of a withdrawal for 5 years to honour the opt-out.
• Retention (letters): sending log and delivery metadata 24 months (5.11.); consent records for 5 years after withdrawal. Recipient: Amazon Web Services EMEA SARL (Amazon SES, Frankfurt) — e-mail delivery (Section 12, row 10).

5.15. Videos — application introduction video, video interview, profile video, video reports

The platform has three independent video features. All three are free of charge for the student, all three are based on consent, and none of them is analysed or assessed by artificial intelligence or any other automated tool (see 8. §). Videos are kept in private storage, over an encrypted connection, and are accessible only through short-lived signed links; they have no public link.

• a) Introduction video for an application. If the employer partner asks for a short (up to approx. 60 seconds) introduction video for a vacancy, you can record, upload or replace it when applying or later on the “My applications” page. Purpose: assessing your application. Legal basis: Article 6(1)(a) GDPR — consent (submitting the video). Recipient: only the partner advertising the vacancy and the cooperative’s staff. Retention: deleted automatically 30 days after the application is closed (rejection, withdrawal or hiring), but no later than 1 year after upload.
• b) Asynchronous video interview. After you apply, the partner may send up to 3 questions which you can answer by video before a deadline. Purpose: assessing your application. Legal basis: consent, which you confirm separately before you start answering. Recipient: the partner concerned and the cooperative’s staff. Retention: the same rule as for the introduction video.
• c) Profile video (voluntary, in your profile). You can record an introduction video of up to 1 minute in your profile at any time. Purpose: keeping the video in your profile so that you can later — by your own decision — attach it to an application; until you do so, it does not reach any employer. The video is visible to you and, for checking the lawfulness of the content, to authorised staff of the cooperative (every viewing is logged). Legal basis: consent, which you can withdraw at any time by deleting the video — the file is deleted immediately and permanently. Retention: up to 12 months from the last active use of your account (login, opening the profile), but no longer than 24 months from upload; we notify you by e-mail 14 days before deletion. It is deleted immediately when your account is deleted.
• Minors: under 16, a profile video requires the e-mail approval of your legal guardian (7.2. §); at 16–17 you confirm your parent’s/guardian’s consent separately; without a date of birth no profile video can be recorded.
• Content rules and moderation: the video is your content and you are responsible for it; offensive, sexual, hateful or unlawful content, showing another person without their consent and using copyrighted music are prohibited. If a video breaches these rules, our staff may remove it; we notify you of this and of the category of the reason, and you can contest the decision with our customer service. Uploaded files are virus-scanned.
• Video reports: employer partners and our staff can report a video you sent if they consider it objectionable. We do not share the reporter’s identity or the text of the report with you; we notify you of the category of the decision taken on the report. Reports are kept for up to 12 months after they are closed; when your account is deleted, reports about you are deleted.
• Processor: the video files are stored by our hosting provider (DigitalOcean, Spaces — 12. §); notification e-mails are delivered by Amazon SES.

5.16. AI phone pre-screening (AI caller)

For some vacancies, the pre-screening of applications is carried out over the phone by an AI-based voice assistant: it calls you, asks a few questions about your application (for example weekly hours, start date, language skills, the questions of the vacancy) and answers your questions about the position.

• Whom we call: only applicants who are at least 18 years old, who gave a Hungarian mobile number in their application, and whose application concerns an active vacancy and is in a stage that has not been closed. We call on weekdays between 9:00 and 19:00 (until 20:00 if you asked for a call-back), with at most two attempts per application.
• When a call is started: if the vacancy requires phone pre-screening and your CV has passed pre-screening; if you did not respond within 48 hours to the interview invitation sent after your application; if you asked for a call-back; if mandatory data is missing from your application; or if a staff member starts it.
• How the call works: the call is placed from our office line (N-Tel SIP line) through the Twilio telephony provider. At the start of the call the assistant states that it is an AI assistant and that the conversation is recorded. If you do not wish to take part, simply hang up or tell the assistant. If you do not want AI calls at all, write to dpo@tudatosdiak.hu and a staff member will contact you instead.
• Data processed: the audio recording and the transcript of the conversation; call data (phone number, time, duration, outcome, short summary); the data extracted from your answers, which is added to your application; the AI’s assessment, score and recommendation. To prepare the call, the assistant receives your first name, your age, the result of the CV analysis, your application data, the data of the vacancy and a short summary of your earlier calls and applications.
• The role of AI: live voice — Google Gemini (fallback voice engine: OpenAI Realtime); refining the transcript from the recording — Google Gemini; extracting the answers, the assessment and score, and the quality review of the call — Anthropic Claude. The score and the recommendation are part of the pre-screening and influence whether your application moves forward — see 8. § (2)–(3).
• Who has access: only the cooperative’s authorised staff can access the recording and the transcript (the recording can only be opened through an expiring, signed link). The employer partner does not receive the recording or the transcript; for premium vacancies it sees the AI summary, the score and the application data you gave during the call. During the introductory period, our staff listen to some of the calls afterwards to check quality.
• Legal basis: for the call and the assessment, Article 6(1)(b) GDPR — steps taken at your request, based on your application, prior to entering into a contract (the same basis as in 5.9.); for making and keeping the recording, Article 6(1)(f) — legitimate interest (the pre-screening can be checked afterwards, disputes can be resolved and the AI’s operation can be verified). The balancing test is available on request.
• Retention: the recording for 90 days from the call (deleted immediately if the number was wrong); the transcript, the extracted data, the assessment and the call data are kept until your account is deleted, and are deleted when the account is deleted (5.8.).
• Storage and transfer: after the call the recording is deleted from Twilio’s systems and kept in our own private storage (DigitalOcean Spaces, Frankfurt). Twilio, Google, OpenAI and Anthropic are established in the USA — for the safeguards see 10. §.
• Your rights: you can object to the recording (Article 21 GDPR), ask for a human to review the pre-screening result based on the call, express your point of view and contest the result (Article 22(3) GDPR) — using the Request human review function or at dpo@tudatosdiak.hu.

5.16.1. Registration reminder call (Norbi)

If a partner company has hired you (submitted your employment record) and the next step needed for your employment notification depends on you — missing personal data, student-ID details, a failed student-status check or an unsigned contract —, Norbi, our AI-based voice assistant, may call you so that we can notify your employment before you start.

• Whom we call: the student of the submitted employment record, if the start date has not passed. We do not call anyone under 18 (age is calculated from the date of birth in your profile). We only call Hungarian mobile numbers.
• When: on weekdays (not on public holidays) between 9:00 and 19:00, if the step is still missing and you have not progressed with it for 2 hours; on the working day before your start, between 10:00–12:00 and 13:00–15:00.
• How often: on our own initiative at most twice per employment record (with a third call on the afternoon of the working day before your start if the step is still missing), at least 18 hours apart (3 hours for the last afternoon call). If you do not answer, we do not retry within a few hours; if the line drops due to a technical error, we call back once. If you ask us during the call to call you later, we call you back at your request: at the time you give (on weekdays until 20:00 at the latest), or about 3 hours later if you give no time.
• How the call works: at the start of the call Norbi states that it is an AI assistant and that the conversation is recorded. It tells you which job and which step it is about; if the step is still missing after the call, we send you the link by SMS. If we cannot reach you, we send a “We tried to reach you” SMS with the link (at most one a day).
• Data processed: the recording and transcript; call data (phone number, time, duration, outcome, short summary); the missing step; the partner’s name, the position and the start date; to prepare the call, your history from the last 7 days (Norbi’s earlier calls about this job, our staff’s calls with you and their notes, the number of SMS messages sent to you by type, start-date postponements, opening the link).
• Legal basis: for the call, Article 6(1)(b) GDPR — performance of the membership agreement and the individual assignment agreement (the notification is a condition of working); for the recording, Article 6(1)(f) — legitimate interest, for the same purposes as in 5.16.
• Retention, recipients, AI providers: as in 5.16. (recording 90 days — for a wrong number it is deleted in the night after the call; transcript and call data until your account is deleted). The partner does not receive the recording or the transcript.

If you do not want such calls: tell Norbi during the call — after that Norbi will not call you about anything. If you have already replied to a recruitment call notice e-mail that you do not want calls, that also applies to this call. You can also object by e-mail at dpo@tudatosdiak.hu (Article 21 GDPR); a staff member will then contact you. Not taking the call has no disadvantage: you can complete the step via the link or with a staff member.

5.17. Automated interview-reminder call

• What it is: if the employer partner asks for a reminder for the interview, you receive an automated call with a synthetic voice within the 24 hours before the interview (between 9:00 and 19:00). At the start of the call it is stated that this is an automated reminder, followed by the time of the interview and the company name.
• Key press: key 1 confirms that you will attend; key 2 automatically cancels the interview — the staff member who organised the interview is notified by e-mail, and you receive a confirmation by e-mail and SMS.
• Data: name, phone number, time of the interview, company name, the key pressed, the call identifier. No recording is made; if voicemail answers, the call is ended.
• Legal basis: Article 6(1)(b) GDPR — organising the selection process (interview). Retention: together with the application, until your account is deleted (5.8.).
• Recipient: Twilio Inc. (telephony, synthetic voice) — USA, see 10. §.

5.18. Call log and staff call notes

• Staff notes: when a staff member calls you or a contact person of a partner company, they may record a note about the call (type, direction, subject, note, outcome, duration, name of the staff member) on the partner or application record. A summary entry of this kind is also created for AI calls (5.16.).
• Call data of the phone system: the office phone system (Yeastar) creates call detail records (CDR): calling and called number, time, ringing and talk time, call status, extension or staff member. These are taken over by our internal system (Finance), which deletes them automatically after 90 days; calls are linked to the student and partner records by phone number (number, direction, answered or not, duration, time, staff member, note). For customer-service calls, the staff member may add a category and a comment.
• Staff calls are not recorded.
• Purpose and legal basis: keeping track of contact and case handling, organising call-backs, customer-service quality — Article 6(1)(b) GDPR (performance of the application, the membership or the partner contract) and Article 6(1)(f) (legitimate interest). You can object at dpo@tudatosdiak.hu.
• Retention: raw call data of the phone system 90 days; notes on the partner record the business relationship + 5 years (5.14.); the call log linked to the student record until the account is deleted; notes linked to an application are deleted when the account is deleted.

5.19. Profiling — automatic job recommendations, “student until” forecast, target groups

• Automatic job recommendations: based on your profile (place of residence, interests, education, language skills, availability, student status, earlier applications and jobs), your behavioural data (jobs viewed, logins, e-mail opens and clicks, app usage) and the data of the vacancies, the system calculates a match score and recommends the best-matching jobs via push notification, e-mail and in some cases SMS. Below the threshold score we send no recommendation; frequency is capped (at most 1 recommendation message per day and 3 per week), and students currently in active work receive none. Automatic recommendations only go to users with a verified or estimated student status.
• Win-back (“We miss you!”) message: if you have not logged in to the website or the application for a while, we may send you fresh jobs that match you, based on your login and app-usage data. By e-mail, push notification or SMS only with your consent (5.11.).
• “Student until” forecast: if we do not know the end of your student status from a certificate, we estimate the expected end and the expected period of your work placement from the start of your studies and the usual length of the programme (failing that, from your year of birth). The estimate is used to filter job recommendations and for target-group classification; actual employment always requires a verified status (5.3.).
• Career-starter and work-placement target groups: based on the estimate and your profile we may classify you as a career starter (your student status recently ended or is about to end) or as looking for a work placement, and recommend such vacancies accordingly. Our staff also see this classification in an internal report used to organise career-starter and placement vacancies; partners do not receive this list.
• Legal basis: Article 6(1)(f) GDPR — legitimate interest (relevant job offers to a registered job seeker, as an essential part of the service). The recommendations have no legal effect: you can apply for any job whether or not we recommend it. We do not create marketing profiles of minors (7.3.).
• Withdrawal and objection: you can unsubscribe from job offer e-mails at any time, and withdraw your consent to recommendation messages (weekly digest, push/SMS, partner offers — 5.11.) at any time, each one separately (with one click at the bottom of the e-mails, or with the three separate toggles in the notification settings of your profile); you can object to profiling (Article 21 GDPR) at dpo@tudatosdiak.hu.
• Retention: scores and estimates are continuously recalculated from the profile data and are deleted when the account is deleted.

5.20. CrewClub — student discount programme

CrewClub is the discount programme for our students: discounts of partner shops can be used in the TudatOS Karrier application and in the standalone CrewClub application (see 9. §). The detailed rules and data processing of the programme are set out in the CrewClub privacy supplement (in Hungarian); this point is a short summary of it.

• Data: identification and eligibility data, verification of student status, the total of hours worked, the level, the personal QR code, coupon codes, clicks and redemptions (with device data), favourites, the accepted terms (time, IP address, browser characteristics).
• Level: the level is calculated automatically from the hours worked with us and settled in recent months (those who worked in the period get a higher level; those who did not, the basic level). The level only determines which discounts are available; a human review of it can be requested.
• QR scan — the partner as recipient: when the partner shop scans your QR code, the partner sees your first name, the initial of your surname and your level, plus the discount you can still use in the current month — solely to verify eligibility. The partner may not record these. We log the redemption (time, amount, data of the scanning device).
• Guest mode: in the standalone CrewClub app, offers can be browsed without logging in; as a guest, we register no push token and log no behavioural events.
• Legal basis: Article 6(1)(b) GDPR — participation in the programme (acceptance of the membership terms); for handling abuse, Article 6(1)(f).
• Controllers: according to the supplement, Tudatos Diák Iskolaszövetkezet and T-Digital Solutions Kft. are joint controllers in the programme; the partner shops providing the discounts are independent controllers for their own processing.

5.21. Tudatos Te personality test — saved result

The result of the Tudatos Te personality test is calculated by your browser; it only reaches your account if you save it with the “Save to my account” button, with separate consent.

• Data: your type, your five scores (0–100), the test variant, its language and the date of completion; to prove consent, the time of consent, the version of the consent text, and whether you gave it yourself or (under 16) saved it on the basis of your parent’s or guardian’s approval — in that case also the time of that approval. We do not store an IP address or a browser identifier with the saved result, nor your individual answers.
• Purpose and legal basis: so that you can look back at your result in your account — Article 6(1)(a) GDPR, your consent, which you can withdraw at any time by deleting the result.
• Who sees it: only you. Partner companies and employers do not see it, and we do not use it for selection, screening applications or job recommendations.
• Minors: under 16 it can only be saved with the approval of a parent or guardian (see Section 7); at 16–17 you must confirm that your parent or guardian knows about it.
• Retention: until you delete it in your account, at the latest until your account is deleted, but no longer than 24 months from saving — after that it is deleted automatically.

5.22. Tudatos Points loyalty programme — points, tiers

Tudatos Points is the loyalty programme of the Tudatos Diák School Cooperative for student users: work done through the cooperative and the use of the TudatOS services earn points, the points add up to three tiers (Green, Silver, Gold), and the tiers give discounts and services. The rules of the programme are set out in the terms of participation; this point is a summary of the data processing and applies from the launch of the programme.

• Data: only point events (source, points, date) derived from data we already process, and the tier calculated from them. Sources: approved monthly working hours (attendance settlement, 5.5.), the day of login, first use of the Career app, use of the CV builder, profile completeness, the existence of a profile video, completed feedback surveys, the date of signing the membership agreement and paid referral rewards. The programme collects no new data.
• Tier: calculated automatically once a night from the points of the last 365 days (from 1 January 2026 at the earliest). The tier only determines which discounts and services are available. It does not affect job placement: the assessment of applications, the order of candidates and presentation to partners are independent of the tier; partner companies do not see the tier. A human review of the calculation can be requested (hello@tudatosdiak.hu).
• Notifications: we notify you of a tier upgrade by e-mail and app notification; this is a service message forming part of the programme, not marketing (independent of the consents under 5.11.). We do not send a notification when a tier goes down.
• Who sees it: you (My points page, mobile app) and the staff of the cooperative (customer service).
• Legal basis: Article 6(1)(b) GDPR — participation in the programme on the basis of the membership relationship or the account contract (the General Terms and Conditions accepted at registration); Article 6(1)(f) — legitimate interest in recognising members’ activity and handling abuse.
• Exclusion: participation is automatic, without a separate declaration; anyone who does not wish to take part may ask customer service to be excluded — their points and tier are then deleted.
• Retention: point events for 24 months from their creation, the tier for the life of the account; programme data is deleted with the account.

5.23. Quick job finder, career test and major picker questionnaires — registration at the start

Before filling in the quick job finder, the career test (19 questions) or the major picker questionnaire (available in Hungarian), you give your name and e-mail address. If you are over 16 and tick registration, these, together with your declaration about being 16 and your consent, reach us at that point and your account is created (we do not ask for a phone number). Your answers are stored by your browser until you request the summary at the end: only then does the result reach us. On the questionnaire pages no session recording and no tag manager (GTM) code runs; if you accept analytics cookies, only the Google Analytics 4 page view (the page title) is measured, not your answers. The questionnaire overview page collects no questionnaire data; there the website’s measurement codes run under the general rules, only after cookies are accepted (layer-1 notice, point 3). If you have already registered at the start of a questionnaire, your browser remembers your name and e-mail address (localStorage), so you do not have to enter them again at the end or in the other two questionnaires; you can delete them with the “Not you?” button.

• What we ask: in the quick job finder, your town (or that you would work from home), when you are available, which interest category you are interested in, whether you are over 18, how many hours a week you would take on and when you could start. The career test has 19 questions. In the major picker, your favourite subjects, up to three strongest subjects and six interest questions.
• Age declaration: at the start, whether you are over 16 — an account is only created with this, and we send confirmation of it to the TudatOS system. If you did not tick it at the start, you can still register on the form at the end; at the end of the quick job finder, if you answered yes to “Are you over 18?”, we pre-tick this box (your own earlier answer; you can untick it). In the major picker we also ask your school year (or whether you are a university student or working); your browser does not send this, only whether we treat you as under 18. We use the answer about 18 and the school year so that we do not recommend night work under 18; the career test does not ask your age, and there we recommend without night work for everyone.
• Data: at the start, surname, first name and e-mail address (a phone number only if you register on the form at the end of the questionnaire rather than at the start); at the end, the result and summary calculated from your answers; the campaign source (UTM parameters, referring page, landing page); your IP address and browser identifier (user agent) to prove consent and registration. We do not send your raw answers (town, subjects, hours etc.) to the TudatOS system: what goes there is the result recalculated by the website’s server from your answers (six interest scores and the three-letter code) and the text of the summary built from your answers (for example jobs available in the town you gave, or majors matching your subjects). In your browser the answers stay in localStorage until submission; the completion page deletes them.
• Purpose and legal basis: (1) creating a Tudatos Diák account (at the start) and linking your result to it (at the end), so that we can show you jobs that suit you — Article 6(1)(b) GDPR, the account contract. If you do not finish the questionnaire, your account remains; you can request its deletion at dpo@tudatosdiak.hu. If you already have an account with that e-mail address, your account data does not change, only the result is linked to it. (2) The separate, not pre-ticked job offers box — Article 6(1)(a) GDPR, your consent: job-offer e-mails and following the two best-matching industries (notifications of new jobs). You can withdraw consent at any time in your account or at dpo@tudatosdiak.hu.
• Who sees it: you and the authorised staff of the cooperative. Partner companies do not see the questionnaire result, and it does not affect the order of applications.
• Minors: under 16 no account is created and we store nothing; the name and e-mail address you gave at the start are not sent, and your browser does not remember them either. At the end, if you ask, we send the full evaluation only to the e-mail address you gave (your name is used for the greeting). For 16–17-year-olds Section 7 also applies.
• Technical note: if the TudatOS system is temporarily unavailable, we forward the submitted data once by e-mail to an internal IT mailbox so that the registration can be completed manually.
• Retention: the result is kept together with your account and deleted when your account is deleted (erasure under the GDPR also covers the result).
• Your rights: access, rectification, erasure, objection, withdrawal of consent — see the section on rights, or write to dpo@tudatosdiak.hu.

5.24. CV builder — automatic account, AI help

The CV builder (also in the TudatOS Karrier app) turns the data you enter into a downloadable CV (PDF and Word, in English and Hungarian). You enter your data by hand, or upload your old CV and the AI reads it.

• Automatic account creation: when you tick the checkbox and create your CV, a TudatOS account is created with the e-mail address you gave (with a job-seeker profile), and you are logged in so that you can download the CV and apply for jobs. We e-mail you that the account has been created. If an account already exists for that e-mail address, no new account is created and we do not log you into the existing one: you can download the CV without logging in, or log in and save it to your own profile.
• Data: name, e-mail address, phone number, town, headline and introduction, work experience, education, language skills, skills, driving licence, availability (when and how many hours a week you would work), links (e.g. LinkedIn), and if you give them: year of birth, photo, hobbies, achievements, certificates, your own sections; the template and design you chose. The data goes into your profile (5.2.), and the finished CV into your profile documents so that you can apply with it in one click (5.8.). On request we also e-mail the CV to your account’s e-mail address.
• CV snapshot: we also keep the submitted form as a snapshot for 30 days, so that the download, the CV sent by e-mail and the online CV show exactly what you saw in the preview; after that it is deleted automatically. Download links are valid for 7 days, the shareable online CV link for 30 days — anyone who receives the link can view the online CV.
• AI processing: if you upload your old CV or ask for AI help (polishing and spell-checking the text, a cover letter, matching against a job ad, interview preparation), the uploaded file or the texts and CV data concerned are sent to the AI provider for the duration of the processing: primarily Anthropic (Claude), with Google (Gemini) as fallback — see Section 8. We do not store the uploaded file. The data also leaves the EEA (USA); the safeguard is the standard contractual clauses (SCC, EU 2021/914) for Anthropic and the EU–US DPF for Google (Section 10). The providers do not use data received via the API for model training (Section 8 (5)). The AI only makes suggestions; it makes no decision about you.
• Usage events: to measure how the CV builder works, we log the steps (opening, starting to fill in, reading a CV, the CV being created, download, opening the online CV, the suggested jobs being shown) with the session identifier, the language and — if there is one — your account identifier; they are deleted automatically after 180 days.
• Rating: if you rate the CV builder at the end (stars, written feedback and, if you give it, your e-mail address), the rating is e-mailed to our developer and kept for 365 days for the summary report; after that it is deleted automatically.
• Legal basis: creating the account, creating and storing the CV and the AI functions you request — Article 6(1)(b) GDPR, the service you asked for and the account contract (as in 5.1.); usage events and ratings — Article 6(1)(f), our legitimate interest in measuring and improving the service (you may object, Section 15); for an e-mail address given with a rating, your consent — Article 6(1)(a).
• Retention: account and profile data until the account is deleted (5.1.–5.2.); the snapshot 30 days, usage events 180 days, ratings 365 days. If you accepted marketing cookies, Meta may also be notified of the registration — see 6.3. For minors, Section 7 applies.

5.25. Feedback sent in the apps and on the web

In the apps (TudatOS Karrier, Partner, Staff) and on the web you can report a problem or send an idea through the “Feedback” tab.

• Data and retention: We store the text of the feedback you send in the apps and on the web interfaces, the attached screenshot, the page address, the app version, the device type, and your name and email address, for the purpose of bug fixing and development, on the basis of our legitimate interest (GDPR Art. 6(1)(f)), in our development team’s internal ticketing system (IT hub); images are deleted 30 days after the feedback is closed, all other data after 12 months.
• Objection: you may object to processing based on legitimate interest (15. §).

6. § Cookies and data stored in the browser

On the platform (app.tudatosdiak.hu, app.anyway.hu, office.tudatosdiak.hu) we do not use analytics cookies. A marketing cookie (tdi_attr) and the related server-side Meta notification are used only with your consent (6.3.): the cookie banner shown when you first open app.tudatosdiak.hu or app.anyway.hu asks for it, and you can change your choice at any time. We distinguish three groups.

6.1. Strictly necessary cookies

The service does not work without these, so no consent is required to set them (Section 155(4) of the Hungarian Electronic Communications Act, Article 5(3) of the ePrivacy Directive).

6.2. Functional (convenience) storage

These remember your settings. They are not strictly necessary, which is why we list them separately — saving the setting is your own choice and you can change it at any time in the interface. We do not use them for tracking and do not share them with third parties.

The analytics and marketing cookies used on the tudatosdiak.hu visitor-facing surface, together with the keys stored in the browser (td_cookie_consent, td_web_visitor_id, td_web_session_id, td_web_session_ts, td_web_landing, td_web_utm, td_lead_popup, td_active_promo, theme), are listed item by item in section 3 of the layer-1 notice. Those are loaded only after consent has been given, and consent can be changed at any time using the Cookie settings button in the footer.

6.3. Marketing attribution and the Meta Conversions API — only with consent

If you also accept marketing cookies in the cookie banner, the cookie below is placed in your browser. If you do not accept them, we do not set it (registration and applications work without it).

Meta Conversions API (server-side notification): if, when your account was created (registration at the start of a questionnaire — 5.23., the CV builder — 5.24., the prize draw), you had accepted marketing cookies, you came from a Meta (Facebook or Instagram) ad, and we know that you are over 18 (from your date of birth, your 18+ declaration or your answer in an application), our server may also notify Meta directly that you registered or that you applied for a job yourself. In that case Meta receives: the type and time of the event, the page address (for an application, the link of the job ad), your e-mail address and phone number hashed with SHA-256 (one-way encoded), the ad-click identifier, your browser’s Meta identifier (the _fbp cookie, if the Meta Pixel has already set it on the website), your IP address and your browser type (user agent). Purpose: measuring the effectiveness of our ads. Legal basis: your consent to marketing cookies — Article 6(1)(a) GDPR. Without that consent we send nothing; if you withdraw it in the cookie settings of app.tudatosdiak.hu, we send nothing about your later applications either. We never send any data about a minor. Meta Platforms may also transfer the data to the USA (Section 10).

The TudatOS Karrier / Partner / Staff and CrewClub applications do not use cookies and do not run marketing trackers; they keep the login token and the interface preferences in the device’s own, application-level storage. (The Anyway mobile application works differently — it is described by its own notice, see 4. §.)

7. § Minors — data subjects under the age of 18

This chapter is for you if you are not yet 18 — and for your parent, too.

7.1. Age limits

7.2. Under the age of 16: parental approval

If you are not yet 16, the approval of your parent or other legal guardian is required for processing based on consent.

This works as follows:

1. During registration we ask for your date of birth.
2. If you are under 16, you must enter your legal guardian’s e-mail address (in the system: parent_email).
3. We send a message to that address informing your parent about what data we process and asking for their approval.
4. We record the fact and time of the approval and the confirmation data — this is our evidence that we act lawfully (Article 8(2) and Article 7(1) GDPR).
5. Until approval is given, the features based on consent (newsletter, CV Database, marketing contact, profile video) are not available.

Important: under the age of 18, we send official notices (contract, employment notification to the tax authority (NAV), occupational health appointment) exclusively to your legal guardian’s e-mail address.

7.3. What we NEVER do with a minor

• We do not build a marketing profile of a minor.
• We do not send them consent-based marketing contact (newsletter, offers, remarketing).
• We do not pass their data to a partner that may not employ minors.
• Under the age of 16, the CV Database (Open to Work) can only be switched on with valid parental approval.

7.4. Employment under the age of 18

The law prescribes an age limit of 18 for certain job positions. If you apply for such a vacancy, the system may automatically reject your application on the basis of your date of birth. This is an automated decision, and therefore:

• we always state the reason for the rejection;
• you can ask for a human to review it — using the Request human review function, or at dpo@tudatosdiak.hu (Article 22(3) GDPR);
• we continue to recommend other job opportunities that have no age limit.

7.5. Plain language and parental rights

Under Article 12(1) GDPR, information addressed to minors must be clear and intelligible. If there is anything you do not understand, write to dpo@tudatosdiak.hu and we will explain it in simpler terms.

As a parent, you can at any time request access to, rectification of or erasure of your child’s data, or withdraw approval previously given — at the same address. After withdrawal we cease the processing based on consent; processing based on a legal obligation (pay, employment notification, occupational health) remains in place until the statutory retention period expires.

8. § AI processing and automated decision-making (Article 22 GDPR)

(1) To speed up the recruitment and application process, we use large language models (LLMs) and vector-embedding models. These run at external providers, under a processor agreement; the safeguard for each transfer outside the EEA is shown per provider in Section 10 (for Anthropic: SCC, EU 2021/914).

(2) Automated decisions in pre-screening — named explicitly. Applications are assessed by an AI-based pre-screening system on the basis of the CV, the application data and answers and, for premium vacancies, the AI interview (chat or phone, 5.16.): it gives a score from 1 to 10 and a recommendation (forward to the partner / staff decision / rejection). The system also checks knock-out criteria: an age under 18 where the vacancy does not accept it; where the vacancy only accepts students, the lack of student status; missing required language skills; not meeting the location requirement of the vacancy; non-EEA or foreign status where the vacancy does not accept it. A difference in weekly hours alone does not lead to automatic rejection. On this basis:

• For “Start” package vacancies, an application that has passed CV pre-screening is forwarded to the partner without human intervention. A staff member decides if the student status or the age is uncertain, a mandatory document is missing, or the AI flagged a knock-out reason. On Start vacancies running in fully automated (“act”) mode, the system may also reject the application automatically.
• For “Premium” package vacancies, an application that has passed pre-screening and the AI interview (chat or phone) is likewise forwarded to the partner automatically; the final rejection of an application, however, is decided by a staff member.
• For vacancies subject to a statutory age limit, an application below the age limit may be rejected automatically (7.4.).

These decisions are automated decisions necessary for entering into a contract under Article 22(2)(a) GDPR: the partner asks for a fast pre-selection of applicants according to uniform criteria, and with a large number of applications the process could not be completed in time without it. The logic of the decision: comparing the requirements of the vacancy (knock-out criteria, required education, language skills, availability) with the content of the application; the better the application matches the requirements, the higher the score. The consequence: the application is forwarded to the partner, or the process ends for that vacancy — with no effect on other vacancies.

(3) Safeguards (Article 22(3) GDPR): against any automated decision you have the right to obtain human intervention, to express your point of view and to contest the decision. You can do so with the Request human review function in your web profile settings, or by e-mail at dpo@tudatosdiak.hu (please state which application it concerns and your point of view).

(4) Your rights in relation to AI processing:

• Requesting human review — using the Request human review function, or at dpo@tudatosdiak.hu.
• Objecting to AI processing, profiling (5.19.) and AI calls (5.16., 5.16.1.) — by e-mail at dpo@tudatosdiak.hu (Article 21 GDPR). AI processing cannot be switched off in the profile; the objection is assessed by a staff member.
• Requesting an explanation of a given AI output, in human language.
• Rectification or erasure of the data extracted by the AI, in the profile.

(5) Anthropic, Google and OpenAI provide contractual guarantees that data submitted via the API is not used for model training. At the providers, the data is stored temporarily for abuse-investigation purposes (typically for up to 30 days), after which it is automatically deleted.

(6) Guest CV analysis: if you upload a CV for analysis without logging in, the content of the file is sent to the AI provider for the duration of the analysis; we do not store the file itself, and we do not link the result of the analysis to any account.

9. § Mobile application permissions

We operate four mobile applications. Permissions can be revoked at any time at the operating-system level (iOS → Settings → Privacy; Android → App permissions). None of the applications uses geolocation or the contact list.

TudatOS Karrier / Tudatos Diákmunka (student, job seeker) — Android: hu.tudatosdiak.app · iOS: hu.tudatosdiak.career

TudatOS Partner (employer) — Android: tudatos.partner.hu · iOS: hu.tudatosdiak.partner

TudatOS Staff (internal, for staff members) — Android and iOS: hu.tudatosdiak.staff

CrewClub (student discount programme) — Android and iOS: hu.tudatosdiak.crewclub

A standalone application for the CrewClub programme (5.20.); you log in with the same account as in the TudatOS Karrier application. In guest mode the offers can be browsed without logging in — in that case we register no push token and log no behavioural events.

The Anyway mobile application (hu.anyway.app) is not covered here: its permissions are listed by the platform’s own notice and by the anyway.hu layer-1 notice.

Application updates (OTA) are delivered by the Capgo service; for this, an application-level device identifier and the application version number are transmitted. None of the applications carries out marketing tracking.

10. § Data transfers to third countries

Some processors are established outside the European Economic Area. Such transfers always take place with appropriate safeguards:

The provider of mobile application updates (OTA), Digital Shift OÜ (Capgo), is established in Estonia, i.e. inside the EEA — third-country transfer rules under Articles 44–49 GDPR do not apply to it, which is why it was removed from this table. A data processing agreement under Article 28 GDPR is in place with the provider, concluded automatically by using the service (capgo.app/dpa). The provider’s own sub-processors and storage location are not public; we are requesting them and will add them here once received.

The status of the certifications can be checked at dataprivacyframework.gov. The standard contractual clauses under EU 2021/914 (SCC) are available to the data subject on request at dpo@tudatosdiak.hu.

11. § Domestic data transfers

12. § Processors and sub-processors

T-Cloud Solutions Kft. (as the Controller’s processor) engages the following sub-processors. It notifies the Controller before engaging a new sub-processor.

13. § Retention periods — summary

14. § Data security measures

• Encryption: TLS 1.2+ for all communication; AES-256 encryption at rest on the databases and the file storage.
• Access control: role-based access control (RBAC), two-factor login on the staff interface, password hashing (bcrypt); private documents are accessible only through expiring, signed links.
• Logging and audit: every material change is audit-logged, recording the old and the new value.
• Backup: daily backup with a 7-day recovery point; restoration only with the approval of an executive officer.
• Network protection: Cloudflare WAF and DDoS protection, reCAPTCHA on forms, rate limiting.
• Human factor: contractual confidentiality obligation, annual data-protection training for staff members who have access.

15. § Data-subject rights and how to exercise them

You have the following rights. You may exercise your rights against any of the joint controllers, through the single point of contact. We provide our response within 1 month; in justified cases this may be extended by a further 2 months, of which we notify you in advance. Fulfilling a request is free of charge; where a request is manifestly unfounded or excessive, we may charge a fee or refuse to act on it (Article 12(5) GDPR).

What happens on erasure: data subject to statutory retention (pay, accounting vouchers, occupational health certificates, employment notifications) must be retained by us until the statutory deadline — we store these separately, with restricted access, and use them exclusively for the statutory purpose. All other data is deleted or irreversibly anonymised, and the files (CV, documents) are physically deleted as well.

Suppression list after erasure: we add the deleted e-mail address — that single item of data, in technical form — to a suppression list. This is needed precisely so that we can give effect to your erasure request: without it, a later import or sign-up would bring your address back and you would receive mail again. The legal basis is Article 17(3) GDPR (limits on the right to erasure, for the establishment of legal claims and compliance with a legal obligation) together with Article 6(1)(c), read with Section 6(5) of the Hungarian Advertising Act (Grt.), which requires a register of advertising opt-outs. We use the suppression list for no other purpose, and on request we will confirm whether you are on it.

Deceased data subject: upon presentation of the death certificate and proof of identity, a close relative within the meaning of the Civil Code (Ptk.) may exercise the data-subject rights within 5 years of the death (Act LIII of 2018 §§ 25/G–25/J).

16. § Personal data breach

(1) On detecting a breach we inform NAIH without undue delay, but at the latest within 72 hours (Article 33 GDPR).

(2) Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, we also notify the data subjects directly (Article 34 GDPR), describing in plain terms what happened and what they should do.

(3) We keep an internal register of breaches: the categories and number of data subjects affected, the time, the circumstances, the effects, and the measures taken.

(4) If a breach occurs at one of our processors, the contract obliges them to notify us without delay.

17. § Supervisory authority

Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa u. 9–11. · Postal address: 1363 Budapest, P.O. Box 9.
Phone: +36 1 391 1400 · E-mail: ugyfelszolgalat@naih.hu · Web: naih.hu

Before you lodge a complaint, we are happy to help: dpo@tudatosdiak.hu.

18. § Final provisions — version control

(1) The Controller reserves the right to amend this notice unilaterally, in particular in the event of a change in legislation. We inform data subjects of material changes in advance, through the main communication channel (e-mail, the application login screen, the website header).

(2) On their first login after a new version takes effect, the user confirms that they have read the notice; the time of this, the version number, the IP address and the browser characteristics are logged. The notice is not to be accepted but to be read and understood — acceptance applies to the terms of service (ÁSZF).

(3) The earlier versions (v2026-10-21, v2026-10-16, v2026-10-15, v2026-10-09, v2026-10-08, v2026-09-24, v2026-09-04, v2026-08-10, v2026-08-09, v2026-08-01, v2026-07-06, v2026-05-01, 2025-08-01, 2025-05-01), as well as the v2026-09-24 and v2026-08-19 extracts built into the platform, are kept in an archive and are available on request.

(4) Version v2026-10-27 of this notice is effective from 27 October 2026.