Version dated 2026-10-23.
I am a recruiter (headhunter). I search for people to fill senior positions at companies in the Czech Republic and Slovakia, most often in IT, ERP and management. Here you can find out what data I hold about you, what I need it for, how long I keep it, who I pass it on to and what rights you have.
I am the controller of your personal data:
Operator: Roman Gál, Company ID (IČO) 75647460, registered office Škvorecká 1904, 250 82 Úvaly, Czech Republic. Employment agency licensed by the Labour Office of the Czech Republic, ref. no. UPCR-2017/39683/4 of 31 May 2017. Sole trader registered in the Trade Licensing Register.
Contact: roman@kenny.one. I have not appointed a data protection officer; the law does not require me to.
Candidates, that is people who have sent me a CV, talked to me about a job, or whom I have introduced to a client: contact details, CV, work history, my notes and assessments from interviews, the history of our communication and, for recorded calls, the transcript (section 6).
People I have searched for or approached about an open position: name, job role, company, a link to a public profile and contact details. For some of them I have a phone number or email address from a contact lookup tool.
People at client companies and at companies I am discussing cooperation with: name, role, company, work contact details and the history of our dealings. Three people at client companies have a testimonial on this website with their name, job title, company and photo, and they know about it.
People I have had a free career consultation with: the transcript and notes from the call.
I search for people for my clients' open positions, both for employment and for contract work. I also keep candidates' data so that I can offer them other positions that might interest them. I give a free career consultation to people who ask for one. With people at client companies I maintain a business relationship; the testimonials stay on the website for as long as I keep them there, or until their author asks for them to be removed. I keep some data as evidence: whom I introduced to whom and when, and how I handled your request.
I process data on the basis of legitimate interest under Article 6(1)(f) of the General Data Protection Regulation (GDPR). My interest is to do my job: to find a suitable person for a client and to offer you work you may be interested in. I do not ask for consent for this, and the new form does not ask for it either. You can object to the processing at any time (section 11).
The exception is CVs sent through the earlier form on kenny.one (2018 to 2026). That form required consent to the processing, and for those submissions the consent continues to apply: I keep the data from them for no longer than 3 years from the submission. You can withdraw your consent at any time by emailing roman@kenny.one; the withdrawal does not affect the lawfulness of the processing carried out before it. Before the 3 years are up, I will ask you whether you want to stay in my records. Older submissions will be deleted together with the data of the old website. If we have talked or written about a job in the meantime, the same applies to you as to other candidates.
Candidates: 5 years from our last two-way communication. The period is extended only by communication you took part in: your reply, a call, a meeting, a CV you sent. If I write to you and you do not reply, the period is not extended.
People I have searched for or approached about a position:
For these periods, I treat a position that has been on hold for more than 6 months as closed.
People at client companies: I have no fixed period. Once a year I go through the contacts and remove those that are no longer current.
Career consultations: the same as for candidates, 5 years from our last two-way communication.
The periods for recordings are in section 6, the period for CVs from the earlier form in section 4. Before a period ends, I may ask you once whether you want to stay in my records. When the period ends, I delete the data from my records; what remains even after that is described in sections 12 and 13.
I record some calls and have them transcribed by the Wispr Flow app. At the start of the call I always say that recording and transcription are running; if you do not want that, I switch the recording off. The app recognises who is speaking from a short voice sample and can produce a summary from the transcript. Wispr keeps the audio of the call on its servers for 7 days; a copy of the audio remains in the app on my computer. I keep the recording and the transcript:
I also use Wispr Flow for dictation. Dictations (the text and, since October 2026, also the audio) stay only on my computer and the periods above do not apply to them; at your request I will go through them.
Artificial intelligence helps me with CVs and documents. The AI assistant Claude from Anthropic reads documents, email, the calendar and messages and prepares summaries and draft texts; the Wispr Flow app transcribes calls. It is always me who decides whom I approach, whom I keep talking to and whom I introduce to a client. I do not carry out automated decision-making with legal or similarly significant effects.
Both in Claude and in Wispr I have switched off the use of my data for training their models. According to their rules, this does not apply to feedback I send them myself and, at Anthropic, to conversations flagged by its safety checks.
Clients: I send your CV and an introduction to a client only if we have agreed in advance on an introduction to that specific client. The client then processes your data as an independent controller, possibly in its own recruitment system.
Service providers I use for my work:
Until they are erased, CVs from the earlier form are also stored on the server where the old website ran. After the move to the new website, I will ask the operator of that server to delete them.
The website and the form run on servers in Bratislava. According to the hosting provider, only ACTIVE 24 and WebSupport, both companies in the EU, have access to the files, and the files are checked by antivirus software within their infrastructure.
Apple, Anthropic, Wispr, LinkedIn, Notion and GitHub hold data in the USA (Apple, according to its policy, usually). The transfers rely on the European Commission's standard contractual clauses; Apple enters into them within its group of companies. LinkedIn and GitHub also state that they participate in the EU-US Data Privacy Framework.
Fastmail is an Australian company. It holds data mainly in the EU (in Amsterdam), backups and operational logs in the USA, and it also names Australia, India and Austria as countries of processing; the transfers rely on standard contractual clauses.
Lusha (Lusha Systems in the USA and in Israel) and Crustdata (USA) have their own contact databases; I process the contacts I take over from them myself, as the controller. Lusha states that the transfers rely on standard contractual clauses and, for Israel, on the European Commission's adequacy decision. Crustdata only states that it processes data in the USA with appropriate safeguards; it does not name a specific mechanism.
According to WhatsApp, calls via WhatsApp are end-to-end encrypted. According to its policy, WhatsApp Ireland Limited transfers data to the USA on the basis of the EU-US Data Privacy Framework and standard contractual clauses.
I will send your data to a client outside the European Economic Area only with your explicit permission.
I keep CVs, notes and records in iCloud with Advanced Data Protection turned on: the content of files is encrypted so that Apple cannot read it. This protection does not cover file and folder names, contacts and the calendar. The disk of my computer is encrypted, and so is its backup.
A CV sent through the form is encrypted as soon as it is received; it is unencrypted only while the server is receiving it. On the web host's server it waits, encrypted, until my computer collects it. The web host does not have the decryption key; only I have it. In the hosting backups it remains for up to 14 days after deletion, also encrypted.
The web host logs access to the website, including IP addresses, and keeps the logs for 14 days. It keeps a record of every email the website sends for 30 days.
To protect against abuse, the form remembers an irreversibly encoded fingerprint of your IP address and email, not the addresses themselves. It stops using it after one hour and deletes it by the next day at the latest; it may remain in the hosting backups for up to 14 days. For each submission the website keeps an operational log for 12 months: the time, the result, the submission number, the number and size of files and whether the emails were sent, without the name, email or IP address.
Deleted data still lingers for some time in backups and with service providers: in the hosting backups for up to 14 days, in iCloud for 30 days in the Recently Deleted folder and then according to Apple, which does not state a period, in work email for 7 to 14 days (Fastmail does not state a fixed period for its backups), in Wispr's backups for 14 days, in Notion for up to 60 days and in the backup of my computer until it is overwritten by newer backups. What the AI assistant reads during work stays in logs on my computer for 180 days (the logs of one add-on have no fixed period and I clear them manually) and at Anthropic usually for 30 days, for conversations flagged by its safety checks for up to 2 years.
You have the right to:
Right to object. You can object at any time to processing based on legitimate interest. Just write to roman@kenny.one that you do not want to be in my records. I will then delete the data, except for what section 12 describes.
I will reply to a request within one month. I reply to the address or account we have used to communicate so far, so that no one else gets access to your data; if a request comes from elsewhere, I will ask for confirmation from an address I know. When handling an erasure request, I also go through the AI assistant's logs on my computer and delete those that contain you.
If you are not satisfied with how I handle your data, you can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz).
If I have introduced you to a client, I keep, even after erasure, a record of the introduction (to whom and when, without contact details) and the documents supporting it: the email to the client and my message to you confirming that we agreed on the introduction. I keep them for 10 years from the introduction, because I may need them to defend legal claims (Article 17(3)(e) GDPR). I also keep a record of how I handled your request for 10 years: from the introduction or, if I did not introduce you to anyone, from the handling of the request.
I will write to the client I introduced you to that you have asked for erasure and ask them to delete your profile and CV; they hold them as an independent controller. Contracts and invoices in which you are named are kept for the period required by accounting and tax regulations. In transcripts of calls with clients I replace your name with the word "candidate"; the content of the call remains. On LinkedIn I delete my messages and notes; the thread itself can only be archived, and deleted messages remain listed in LinkedIn's InMail Compliance Report. If your name is in my work notes on GitHub, I remove it from the current files; it remains in the change history.
So that a deleted person does not return to my records by mistake, I keep only what lets me recognise you (your email or profile link) and a note that I must not contact you. I keep that record for 10 years from the erasure; after an objection, with no time limit; otherwise I could not honour the objection.
When a period ends, I delete your data from my records. Some places, however, I do not clear according to the periods, only at your request: emails, LinkedIn messages, the calendar, contacts and messages on my phone, my dictations and the backups of the candidate records on my computer. At your request I will go through them and delete whatever the service allows; on LinkedIn only my own messages and notes can be deleted.
Please do not send me information about your health, religion, political opinions, trade union membership, origin, sexual orientation, family circumstances or criminal record, and do not talk about them in a call unless you yourself consider it necessary. I do not need it for my work. If it appears in a CV or in a call, I do not carry it over into my notes or into an introduction to a client; it remains only in the original CV or call transcript.
I get most of the data directly from you: from your CV, the form, an email or a call. Sometimes another person recommends you to me. For people I have searched for myself: from the public LinkedIn profile and other public sources, for example a company website, and for some people from contact lookup tools (Lusha, Crustdata).
If I change the policy, you will find the new version here with a new date. This is an English translation of the Czech policy; the Czech version is authoritative.
Operator: Roman Gál, Company ID (IČO) 75647460, registered office Škvorecká 1904, 250 82 Úvaly, Czech Republic. Employment agency licensed by the Labour Office of the Czech Republic, ref. no. UPCR-2017/39683/4 of 31 May 2017. Sole trader registered in the Trade Licensing Register. Privacy Policy
