Information on the processing of personal data Hiring

Information provided below is intended to ensure that you are fully and transparently informed about the processing of your personal data, including special categories of personal data, by the controller of such data, in accordance with Article 13 of the Regulation (EU) No. 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation) (“GDPR”).

Identity and Contact Details of the Controller

Ataccama Software, s.r.o., the company duly established under the laws of the Czech Republic, ID No: 282 35 550, with its registered seat at Sokolovská 685/136f, Karlín, 186 00 Prague 8, Czech Republic, registered in the Commercial Register maintained by the Municipal Court in Prague, Czech Republic, File No. C 134322

E-mail: dpo@ataccama.com

(hereinafter the “Controller” or “We”)

We are committed to protecting the privacy and personal data of applicants and other individuals whose personal data we come into contact with during our hiring processes.

Below please find information regarding the processing - in particular the collection, disclosure, and other use - of personal data relating to job or cooperation applicants by us. If you would like to learn about our general approach to the processing of personal data and not only in relation to the processing of personal data in connection with your application for a position with us, please refer to our Privacy Policy.

Data Protection Officer has not been appointed by the Controller

Personal data processed about you by the Controller

We process your personal data that we have collected:

• directly from you - from hiring and other related communications and/or by contacting us via our career page available at domain jobs.ataccama.com or if you directly contact us via various professional and other social networks such as LinkedIn or Facebook, or via other similar public channels, or if you approach us at various events and/or projects and job or other fairs in person;
• from third parties - e.g. from references from your previous clients, employers, colleagues and other persons providing references on your work performance or from publicly available sources and social networks such as LinkedIn or Facebook or from other similar public channels, as well as from employment agencies or companies that recommend us job or cooperation candidates.

The information or data we process about you must be considered as personal data and include the following:

• name and surname;
• title;
• date of birth;
• contact address;
• telephone number;
• e-mail address;
• details of your previous employment;
• details of work experience;
• details of your education;
• information on certificates obtained and training courses attended;
• other information you have provided in your resume;
• other information and data you have provided to us by communicating with us; and
• other information and data you have provided in connection with the processing of the mock task and other assigned as part of the hiring process, if given at all.

Purpose of Processing your Personal Data and Legal Basis for Processing:

The purpose of processing of your personal data is:

• maintaining the process of the selection of the most suitable candidates for us during the hiring procedure and process;
• entering into an employment contract and/or other contract for provision of services or cooperation, or an agreement for work outside the framework of the contract with the selected candidates; and
• protecting our legitimate interests or the legitimate interests of a third party (protecting property, exercising rights and claims arising from the performance of the contractual relationship and communicating with data subjects).

The processing of personal data for these purposes is allowed under the following legal grounds:

• performance of a contract to which the data subject is a party or for the performance of pre-contractual measures taken at the request of the data subject within the meaning of Article 6(1)(b) GDPR; and
• consent, if you have provided one to us in relation to the possibility to contact you again with new offers for cooperation, which you can withdraw at any time (Article 6(1)(a) GDPR); or
• our legitimate interests within the meaning of Article 6(1)(f) GDPR.

Should it be necessary for us to further process your personal data beyond the obligations imposed on us by law or our legitimate interests or the legitimate interests of a third party, we will always request your prior written consent.

Should it be necessary for us to further process your personal data beyond the obligations imposed on us by law or our legitimate interests or the legitimate interests of a third party, we will always request your prior written consent.

How to withdraw your consent

Your consent for us to contact you with further offers for cooperation in the future is voluntary, and you do not have to grant your consent. Additionally, you can withdraw your consent at any time.

Non-granting or withdrawal of the consent does not have any effect on your relationship with our company or the performance of relationships for which such consent is not required.

The consent can be withdrawn:

• by written notice sent to the above address of our registered office; and/or
• by notification sent to the e-mail address: dpo@ataccama.com.

If you withdraw your consent, we will automatically conclude that you no longer wish us to process your personal data for the purpose of contacting you with offers for cooperation.

Request to provide your Personal Data

Providing your personal data is voluntary and you are not obliged to do so. However, the provision of personal data for these purposes is a necessary requirement for participation in the hiring procedure, and without the provision of personal data, participation in the selection procedure is not possible.

Recipients or Categories of Recipients of Personal Data

• our affiliates, which are member of either Ataccama or Adastra group entities and their subsidiaries, as listed at this website ataccama.com/company/offices (“Ataccama or Adastra Group”);
• state authorities (in particular the regional labour inspectorate, the Labour Office of the Czech Republic, the Office for Personal Data Protection, law enforcement authorities, the Police of the Czech Republic, prosecutors, courts, tax administrators) and other entities on the basis of other legal regulations; and
• entities that provide services to us (in particular banks, insurance companies, IT services, possible employment intermediaries, lawyers, and other consultants) and with whom we have concluded the relevant contract for the processing of personal data.
• provider of the Applicant Tracking System whose purpose is to help us in the hiring process and to reach out to job applicants and through which we can be contacted by job applicants, operated by Lever, Inc., 1125 Mission St, San Francisco, CA 94103, the United States of America, who process personal data in accordance with Lever GDPR Data Processing Addendum and other documentation accessible at Lever Privacy Centre.

Transfer of Personal Data to Other Countries

We do not intend to transfer personal data to a third countries or international organizations, with an exception of our affiliates, which are Ataccama or Adastra Group entities or to other reliable third parties that provide us with administrative or technical support.

Period of Storage of Personal Data

When dealing with your personal data for specific purposes, we respect the principle of storage limitation, whereby we keep your personal data only for the necessary period of time. We also respect the data minimisation principle where we only retain personal data that is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed.

Should you consent thereto, in case we do not agree on the start of cooperation, we may keep your personal data for 2 years after the end of the hiring process for the purpose of contacting you in the future again based on your prior consent to find new suitable workers for our company.

We may retain your personal data you voluntarily disclosed to us as part of the hiring process for the sole purpose of protecting our legitimate interests (protecting intellectual and other property, exercising rights and claims arising from the performance of the contractual relationship and communicating with data subjects) for a period of 3 years.

Balance Test of Our Legitimate Interest

Prior to processing and retaining your personal data, we have conducted a balance proportionality test for processing and retaining your personal data for the purpose of protecting our legitimate interests, during which we have assessed the legitimate interests of relevant data subjects while processing only those personal data that they voluntarily disclose when taking part in our hiring procedure and processes.

We have assessed our interest in protecting our legitimate interests based on a balancing proportionality test that our interest in protecting our legitimate interests does not exceed a tolerable level of interference with the rights of yours and other applicants, also with respect to their right to object to the processing of their personal data.

Automated Individual Decision-Making, including Profiling

The processing of your personal data does not involve any decision-making based solely on automated processing, including profiling, which would have legal effects on you or would significantly affect you in any way.

Your Rights in Relation to the Processing of your Personal Data

You have the following rights in connection with the processing of your personal data by us or for us:

• right to request access to personal data concerning you as a data subject and the right to obtain a copy of your personal data processed;
• right to have your personal data corrected - if you find that it is incorrect or inaccurate;
• right to erasure to the extent of the personal data voluntarily provided, i.e., in the context of the performance of contractual obligations. Conversely, you cannot request the deletion of personal data that we are obliged to collect on the basis of a legal obligation;
• right to restriction of processing of your personal data;
• right to transferability of your personal data in the extent foreseen by GDPR;
• right to object to processing based on our legitimate interests or the legitimate interests of a third party;
• right to lodge a complaint with a supervisory authority if you believe that the processing of personal data violates the General Data Protection Regulation. You can lodge a complaint with the relevant supervisory authority, which is the Office for Personal Data Protection, pplk. Sochor 27, 170 00 Prague 7 (see www.uoou.cz).

Where can you exercise your rights and how

You can exercise individual rights by sending an email to the address listed above under our contact details or by sending a written request to our registered office or mailing address.

We provide all communications and statements regarding the rights you have exercised free of charge. However, if the request is manifestly unfounded or unreasonable, in particular because it is repetitive, we are entitled to charge a reasonable fee considering the administrative costs involved in providing the information requested. In the event of a repeated request for copies of personal data processed, we also reserve the right to charge a reasonable fee for administrative costs on this basis.

How long before you can expect a reply

We will provide you with a statement and, where appropriate, information on the measures taken as soon as possible, but within one (1) month at the latest. We are entitled to extend the deadline by two (2) months if necessary and in view of the complexity and number of requests. We would inform you of any extension, including the reasons for it.