Version: 1

Dearest candidate,

We recognize the fact that your personal data belong to you and no one else. Therefore, we consider it our highest priority to keep you well informed about how we treat your personal information. This data protection memorandum (“Memo”) is intended to give you a full overview of how we process your personal data in connection with recruitment processes and keeping in touch regarding potential job opportunities.


The organization which decides how your personal data should be processed and is responsible for ensuring that your privacy rights are always respected (the so-called data controller) is the following:

  1. Blockad s.r.o., a Czech limited liability company, ID: 08006458, with its registered office at Nádražní 344/23, Smíchov, 150 00 Prague 5, Czech Republic, entered in the Commercial Register maintained by the Municipal Court in Prague under file no.: C 311433.

(The company mentioned above will, for the purposes of this Memo, be referred to as the “Company” or simply as “we” or “Blockad”.)

Please see section 8 below to read about how you can contact the Company.


We may process the following categories of personal data relating to you starting from the moment you contact us regarding a job opportunity or join a recruitment process concerning an open position with us:

Category of Personal DataDescription
Identification DetailsThis includes in particular your name, date of birth, and photographs which you might send us e.g. as part of your CV.
Contact DetailsThis includes in particular your contact address, phone number and e-mail address.
Professional DetailsThis includes in particular details about your education (both official and by means of training courses and similar), relevant skills, prior work or other relevant experience, CVs, motivational letters and employer references.
Assessment DetailsThis includes in particular all data we note down about your fitness for any position applied for, your performance at interviews, assessment centers and tests, and your cover letter sent as part of your on-line application via the form at https:// or otherwise (if applicable).

We process the foregoing categories of personal data pertaining to you for each and every one of the purposes of processing listed below, although always only in such extent as (a) you provide us such information and (b) it is relevant for the given purpose.


Broadly speaking, we use your information in two ways. First, if you apply for a position with us or request proactively that we stay in touch should a suitable job opportunity arise, we keep it to be able to perform the applicable recruitment process, evaluate if we’ll get along or keep you informed about potential opportunities. Second, if you give us your consent, we might use your information to get in touch with interesting job openings for a longer period of time. The following lists all purposes and legal bases for our processing activities.


If you take part in the recruitment process pertaining to an open position at our Company or request that we inform you about potential job opportunities, we’ll have to process your personal data for the purposes, on the legal bases and for the time periods stated below:

Purpose of Processingof Purpose DescriptionLegal BasisRetention Period
Performance of Recruitment ProcessWe use your data to be able to carry out the recruitment process with you, which inherently includes appropriate candidate assessment. In particular, collecting this personal data enables us to invite you to interviews, communicate with you about your results and other things related and determine whether or not we’re going to be the right fit for each other professionally. Your data will be stored in our secure candidate database while we do so.The processing is a necessary measure towards reaching an agreement between you and us (e.g. an employment or other cooperation contract)

(Art. 6(1)(b) GDPR)

Approx. one (1) year from our receipt of the personal data
Informing about Potential Opportunitiesnforming about Potential Opportunities If you ask us to inform you about potential job opportunities with us or also with one or more of the affiliated companies under section 4.1, we use your data to (a) keep in touch with you regarding potential job opportunities with us or the relevant affiliated companies under section 4.1, and (b) to familiarize the competent persons at such relevant affiliated companies with your profile. Your data will be stored in our secure candidate database while we do so.The processing is necessary for us to be able to meet your request to stay in touch regarding potential job opportunities (and thus fulfil our informal contract with you to such effect)

(Art. 6(1)(b) GDPR)

Approx. one (1) year from our receipt of the personal data


If you choose to grant us your consent, we as well as the affiliated companies listed under section 4.1 will be able to process some of your personal data to be able to keep you in their candidate databases and send you relevant offers of jobs with them for an extended period. Whether or not you choose to give such consent has no effect on our evaluation of your performance during any recruitment process.

Purpose of ProcessingPurpose DescriptionLegal BasisRetention Period
Job OffersWith your prior consent, we will have the option to (a) store your data in its candidate database in order to be able to contact you with relevant job offers later on and (b) to provide such data to the affiliated companies stated under section 4.1 below for the purposes of maintaining a candidate database and contacting you with relevant job offers, and (c) we and the affiliated companies stated under section 4.1 below will be permitted to contact you with relevant offers of jobs with them for 3 years.Your voluntary consent

(Art. 6(1)(a) GDPR)

Three (3) years from the date of your last consent

Please note that even if you give us your consent with respect to the processing described above, you may withdraw it at any time in the manner described in section 8 below or as otherwise allowed by us from time to time. Withdrawing your consent doesn’t affect the lawfulness of processing based on such consent before you withdrew it.


Whenever necessary for the attainment of the processing purposes described in section 3 above, we might have to share some of your personal data with the following types of recipients:


If you’re requested that we put you in touch with or ask that we inform you of any opportunities at an affiliated company or if you’ve given us your consent to processing for the purposes of Job Offers (see section 3.2 above), the following companies may, in addition to Blockad, depending on the case at hand, have access to the relevant groups of data relating to you and assume the role of a data controller towards you:

  • Rockaway Ventures a.s., ID No.: 063 87 136;
  • Rockaway IT Services s.r.o., ID No.: 051 49 878;
  • Internet Mall, a.s., ID No.: 262 04 967;
  • MallPay s.r.o., ID No.: 070 93 331;
  • Mall Group a.s., ID No.: 041 96 830;
  • VIVANTIS a.s., ID No.: 259 77 687;
  • s.r.o., ID No.: 256 55 701;
  • Koší s.r.o., ID No.: 030 23 877;
  • Uloženka s.r.o., ID No.: 242 99 162;
  • EUROMEDIA GROUP, a.s., ID No.: 497 09 895;
  •, a.s., ID No.: 267 02 924;
  • Heureka Shopping s.r.o., ID No.: 023 87 727;
  • Manifesto Holding s.r.o., ID No.: 078 26 397; and
  • other companies from the Rockaway group stated from time to time at;

as well as

  • ROC services, s.r.o., ID No.: 241 53 273; and
  • Rockaway Advisors, s.r.o., ID No: 090 52 127.


Alongside the companies mentioned above, it is inevitable that the following types of persons and organizations will, to some extent, have access to your data:

  • cloud service providers (e.g. Google Ireland Limited or Microsoft Ireland Operations Ltd.);
  • other technical or support services providers (e.g. software providers, online test operators, assessment center organizers etc.);
  • persons working at or closely with our Company or, if applicable, the companies as per section 4.1 above.

To the extent any of the foregoing recipients process your data as data processors (i.e. on behalf of and in accordance with the instructions of the Company), adequate protection is procured via data protection agreements in accordance with the applicable laws. Protection of data processed outside of the European Economic Area is safeguarded contractually using the model clauses issued by the European Commission or otherwise.


Unless your data is erased prematurely (e.g. because you’ve withdrawn your consent to its processing), this is how long we store your personal data:

(a) By Default

Unless you choose to give us your consent with processing for the purposes of Job Offers (see section 3.2 above) or start working with us, we will normally erase your personal data within three months from the expiry of the retention period in section 3.1 or the expiry of any other reason why you gave us your personal information. Please beware, however, that we may also retain your data for as long as 15 years if for whatever reason we need them to defend our rights in court or otherwise.

(b) With Your Prior Consent

If you choose to give us your consent with processing for the purposes of Job Offers (see section 3.2 above), we and any further companies who have received your data for the purposes of Job Offers will erase the relevant personal data after 3 years from the date of your consent (or, if applicable, renewed consent).


We get your Identification Details, Contact Details and Professional Details mostly from yourself, but occasionally also from professional networking websites (e.g. LinkedIn), recruitment agencies and websites (e.g. Human Capital Advisory Group, Grafton Recruitment, COCUMA,,,,, and similar), as well as persons who know you and put in a good word for you. We either derive your Assessment Details from your performance at interviews, tests and assessment centers, or obtain them from persons or organizations who hold tests or assessment centers on our behalf.


As the sole proprietor of your personal data, you have multiple rights which you can use to maintain or regain full control of them whenever you deem fit:


You have the right to know all there is to know about how we process your personal data as well as your rights connected with such processing. While this Memo should answer most of your questions already, you may at any time ask us for confirmation as to whether or not we process (certain) personal data concerning you – if indeed we do, you are entitled to full information about such processing activity. The right to access includes the option to request a copy of all personal data concerning you which we process; we’ll give you the first copy for free and only charge you a fee for any further copies.


We all make mistakes sometimes. Should you ever notice that some of the personal data concerning you and processed by us is inaccurate or incomplete, you have the right to demand that we correct or supplement it without undue delay.


In some cases you have the right to demand that we erase your personal data. We are obliged to do so if:

  • (a) we no longer actually need the personal data for the purposes for which it was originally processed;
  • (b) you have withdrawn your consent with the processing of the data and no other legal basis exists for such processing;
  • (c) you have objected to a certain processing activity performed by us based on our legitimate interests and we conclude that such legitimate interests no longer exist; or you have objected to a processing activity used for direct marketing; or
  • (d) the processing activity in question has been or has become unlawful.

Please beware that your right to erasure isn’t absolute even if one of the conditions above is met – we may have the right to keep some of your personal data if this is necessary for the fulfilment of our legal obligations or for the protection of our legal claims.


In some circumstances you may have the right to demand that we limit the processing of your personal data (other than erase it altogether). This means that we will have to set your data aside and stop processing it for the time being, but not forever (that would be where the right to erasure comes in). We are obligated to restrict processing:

  • (a) if you dispute the accuracy of the personal data processed, until we can verify the accuracy and make corrections, if needed;
  • (b) if our processing of your personal data has been or has become unlawful (e.g. because it is excessive for the respective purpose) but you don’t want us to erase it (perhaps because you do need us to have it for later purposes);
  • (c) if we no longer need the personal data, but you require it to be able to protect your legal claims; or
  • (d)if you object to a processing activity, in which case we will suspend the processing while we investigate the merits of your objection.


You have the right to obtain all such personal data concerning you and collected or otherwise processed by us based on your consent. If you invoke this right, we will be obliged to provide you all such data in a structured, commonly used and machine-readable format (XLS, PDF or similar). Your data portability right only applies to data which we process automatically.


You may object to any processing performed based on our legitimate interests. If the processing at issue is conducted for direct marketing purposes, we’ll stop the processing activity immediately; in other instances we’ll first investigate the merits of your objection and cancel the processing if we find that we have no substantial legitimate interests to continue with the processing activity.


Regardless of any other rights you might invoke, you may always file a complaint with the competent supervisory authority. This is especially so if you feel that your personal data is being processed unlawfully. Should you wish to lodge a complaint against processing performed by us, the competent authority would be the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů) located at Pplk. Sochora 27, 170 00 Prague 7, Czech Republic.


If you have a question about our data protection policy or your rights under it, wish to exercise any of your rights under section 7, want to withdraw your consent with the processing of personal data or simply need to get in touch in a related matter, please write us an e-mail at

We’ll do our best to deal with your query as fast as we can, but in any event within one month. Since we’re no automated tech-giant, please understand that some of the more complicated queries might exceptionally take us up to two more months to sort out – but we’ll obviously let you know if this happens to be the case.

Please note that we may only advise you on your rights to the extent required of us by the applicable data protection laws. We highly encourage you to seek independent legal advice should you have any questions beyond that scope.