Politica de confidențialitate pentru prelucrarea datelor cu caracter personal ale solicitanților de locuri de muncă

1 General Provisions

We are committed to respecting your privacy and protecting your personal data. These Privacy Policy (the “Politica de confidențialitate”) describe how the companies within the CTP group (the “Grupul CTP" sau "noi”) process and protect your personal data in relation to the recruitment process.

In this Privacy Policy, “personal data” refers to information that identifies a job applicant and potential candidates for employment with us (“tu" sau "candidat”), which the candidate has provided to us as part of their job application (online or in writing) and/or through alternative channels (e.g., via professional recruitment agencies).

This Privacy Policy also inform you about your rights regarding the processing of personal data and how and by what means you can exercise them.

We recommend that you carefully read this Privacy Policy.

2 Data Controller and Processor

2.1 Identification of the Data Controller

The controller of your personal data is always the company from the CTP Group that is advertising the particular job position.

List of Data Controllers:

• CTP Invest, spol. s r.o., company ID no.: 26166453, CTPark Humpolec 1571, 396 01 Humpolec (for the positions with a place of work in Czechia);
• CTP Invest SK, spol. s r.o., company reg. no. 36697109, Laurinská 18, 811 01 Bratislava – Staré Mesto, Slovak Republic (for the positions with a place of work in Slovakia);
• CTP Invest Germany GmbH, company reg. no. HRB 257014 B, Lietzenburger Str. 75, 10719 Berlin, Germany (for the positions with a place of work in Germany);
• CTP Invest Immobilien GmbH, company reg. no. FN 528284 p, Mariahilfer Strasse 17/4, 1060 Vienna, Austria (for the positions with a place of work in Austria);
• CTP Invest București SRL, company reg. no. 19746002, Dragomiresti-Deal village, Dragomiresti Vale commune, 1 Gabriela St., Building B, Ground floor, Ilfov county, Romania (for the positions with a place of work in Romania);
• CTP Invest EOOD, company reg. no. 204087798, 247 Botevgradsko Shose Blvd., Administrative Building, 7th floor, Sofia, Bulgaria (for the positions with a place of work in Bulgaria);
• CTP Invest d.o.o. Beograd-Novi Beograd, company reg. no. 21287172, Megarska 9, 11070 Belgrade, Serbia (for the positions with a place of work in Serbia);
• CTP Management Hungary Kft., company reg. no. 1309186380, 2051 Biatorbágy, Verebély László utca 2, Hungary (for the positions with a place of work in Hungary);
• CTP Invest BV, Apollolaan 151, 1077 AR Amsterdam, Netherlands, and CTP N.V., Apollolaan 151, 1077 AR Amsterdam, Netherlands as joint controllers (for positions with a place of work in the Netherlands);
• CTP Invest Denmark ApS, company reg. no. 45266850, C/O CSC (Denmark) ApS Sundkrogsgade 21, København Ø 2100 (for positions with a place of work in the Denmark).

2.2 Processor

The processor of your personal data for companies within the CTP group is CTP Invest, spol. s r.o., CTPark Humpolec 1571, 396 01 Humpolec, company ID no. 26166453.

2.3 Contact person, contact details

The contact person for personal data protection within the CTP Group is: Ing. Rohia Hakimová, Group AML & Compliance Officer.

In the case of requests and/or complaints regarding these Privacy Policy, you can contact us via email: Privacy@ctp.eu.

3 Purpose, Legal Basis, Scope, and Duration of Processing of Personal Data

3.1 Purposes, Legal Basis, and Duration of Processing

We process your personal data only to the extent necessary to fulfill our contractual or legal obligations, or based on your consent, for the purposes outlined below.

3.1.1 For the purpose of the Recruitment Process (Filling Vacant Positions), Negotiating the Conclusion of an Employment or Similar Relationship.

The legal basis for processing your personal data during the recruitment process is primarily our legitimate interest (Article 6(1)(f) GDPR), which enables us to identify and assess candidates for potential employment in an efficient and fair manner. We rely on this basis particularly in the initial stages of the recruitment process (e.g., screening and evaluating applications), where the processing is necessary to manage and improve our recruitment procedures.

In the later stages of the recruitment process, where the processing of personal data is directly related to negotiating or concluding an employment contract, we rely on Article 6(1)(b) GDPR (processing necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract).

If you are not selected for the position, and unless you provide us with your consent for future contract regarding job opportunities, your personal data will be retained for period of no longer than six (6) months after the recruitment process for the position you applied for has closed. This retention period allows us to address potential legal claims related to the recruitment process, such as those concerning equal treatment and non-discrimination, and to ensure the transparency and fairness of the selection process. After this period, your personal data will be securely deleted unless further retention is required by law.

3.1.2 For the Purpose of Maintaining a Record of Job Applicants and Contacting Them Regarding Job Opportunities (Vacancies) within the CTP Group.

We may wish to retain your personal data to contact you in the future with job offers within the CTP Group. In such cases, we will ask for your consent (Article 6(1)(a) GDPR), either before you submit an official application or after submitting it. Providing consent is voluntary. The personal data provided in this way will be stored for a maximum period of two (2) years from the granting of consent.

3.2 Scope of Processing

We process your personal data to the following extent: the data you provide during the recruitment process in your resume, possibly in your cover letter, or in other communications related to the recruitment process, including but not limited to your name and surname, address, email address, phone number, education, work history, skills and qualifications, photographs, and any other personal data contained in your resume (CV) or otherwise provided or obtained, such as data collected during background checks of candidates, e.g., references.

4 Sharing And Transfer of Personal Data (Recipients of Personal Data)

4.1 Recipients of Personal Data

Certain categories of personal data collected through the methods mentioned above may be shared with third parties who are either independent controllers or provide us with specific services related to the recruitment process, particularly as our processors:

• Within the CTP Group for recruitment and employee hiring purposes;
• With entities managing our IT and HR systems and providing IT services used for the administration and organization of the recruitment process;
• With entities providing recruitment services and job advertisements (typically independent controllers);
• With public authorities or other third parties in order to fulfill obligations in compliance with legal regulations.

4.2 Data processing agreements

In accordance with Article 28 of the GDPR, we ensure that when personal data is processed on our behalf by third-party service providers (data processors), such processing is governed by a written data processing agreement.

These agreements are designed to ensure that processors:

• Process personal data only on documented instructions from us;
• Implement appropriate technical and organizational security measures;
• Ensure that persons authorized to process personal data are committed to confidentiality;
• Assist us in fulfilling our obligations related to data subject rights;
• Support us in ensuring compliance with data security, breach notification, and data protection impact assessments;
• Return or delete personal data upon termination of the processing activities unless otherwise required by law.

We have entered into such agreements with all relevant processors to guarantee that your personal data is handled with the highest level of security and in compliance with GDPR requirements.

4.3 Transfer of personal data to a third country or international organization

We do not transfer your personal data to third countries or international organization.

5 Data Security

We have implemented and maintain appropriate technical and organizational measures, internal controls, and information security processes in compliance with legal requirements and market standards corresponding to the potential risks to you as a data subject. We also take into account the state of technological development to protect your personal data from accidental loss, destruction, alteration, unauthorized disclosure, or access. Such measures may include, among other things, taking appropriate steps to ensure the accountability of employees who have access to your data, employee training, regular backups, data recovery procedures, incident management, software protection of devices where personal data is stored, etc.

6 Data Protection Impact Assessment (DPIA)

In cases where the processing of personal data is likely to result in a high risk to the rights and freedoms of data subjects, we will conduct a Data Protection Impact Assessment (DPIA) in accordance with Article 35 of the GDPR.

The purpose of the DPIA is to identify potential risks associated with personal data processing activities and to implement appropriate measures to mitigate those risks. A DPIA will be carried out, in particular, when introducing new technologies, processes, or systems that involve the large-scale processing of sensitive data or systematic monitoring of individuals.

The DPIA will include:

• A description of the processing operations and the purposes of the processing;
• An assessment of the necessity and proportionality of the processing in relation to its purpose;
• An evaluation of the risks to the rights and freedoms of data subjects; and
• The measures envisaged to address the risks, including safeguards, security measures, and mechanisms to ensure the protection of personal data and demonstrate compliance with GDPR.

7 Your Rights as a Data Subject

If you wish to exercise any of your rights under this section or under applicable laws, please contact us via email at privacy@ctp.eu or in writing to the address of the relevant CTP entity – see Section 2.1 above. To ensure the protection of your personal data, we may request additional information to verify your identity before processing your request.

We will respond to your request without undue delay and no later than one (1) month from the date of receipt. This period may be extended by an additional two (2) months if necessary, taking into account the complexity and number of requests. In such cases, we will inform you of the extension and the reasons for the delay within the initial one-month period.

We will also inform any recipient to whom your data has been provided, as outlined in Article 4 of this Privacy Policy of the measures taken, or the deletion of your personal data, or the restriction of processing in accordance with your request, if such notification is possible and does not require disproportionate effort.

7.1 Access to Your Personal Data and Data Portability

You have the right to request information about whether and to what extent we process your personal data. You also have the right to obtain personal data that you have provided to us, as well as other personal data that pertains to you (if we have not erased your data prior to your request).

If you request it, we may send some of your personal data (specifically, the data we process based on fulfilling a contract and/or your consent, and in an automated manner) directly to a third party (another data controller) that you specify in your request, provided that such a request does not affect the rights and freedoms of others and is technically feasible.

7.2 Withdrawal of Consent

You can withdraw your consent (if you have provided it) at any time without stating a reason. In that case, we will delete your personal data as soon as it is reasonable and feasible, but no later than 30 days after your consent is withdrawn.

Please note that withdrawing consent does not affect the lawfulness of processing carried out based on consent before its withdrawal.

7.3 Correction of Your Personal Data

You have the right to correct any inaccurate or incomplete personal data that we process about you.

7.4 Deletion of Your Personal Data

You can request the deletion of your personal data at any time (for example, if you decide not to continue participating in the recruitment process). If you contact us with such a request, we will erase all your personal data we have without undue delay, unless we need your personal data to fulfill contractual or legal obligations.

We will also delete all your personal data (and ensure it is deleted by processors we have engaged) if you withdraw your consent.

7.5 Objection to Processing

If we process some of your personal data based on our legitimate interest, you have the right to object to the processing of your personal data at any time. If we cannot demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if further processing is not necessary for the establishment, exercise, or defense of legal claims, we will stop processing your personal data.

7.6 Restriction of Processing

If you request the restriction of processing of your personal data, for example, if you contest the accuracy, lawfulness, or our need to process your personal data, we will limit the processing of your personal data to the minimum necessary (storage) and may only process it for the purpose of establishing, exercising, or defending legal claims, protecting the rights of another individual or legal entity, or for other restricted reasons defined by applicable law. If the restriction of processing is lifted and we continue processing your personal data, we will inform you without undue delay.

7.7 Complaint to the Data Protection Authority

You have the right to file a complaint regarding our data processing with the relevant local data protection authority.

8 Updates to the Privacy Policy

We may modify or update this Privacy Policy from time to time. Any changes to this Privacy Policy shall become effective with publication of the updated Privacy Policy at our website www.ctp.eu.