RECRUITMENT PRIVACY POLICY

II. WHAT PERSONAL DATA DO WE COLLECT AND WHAT IS THE PURPOSE AND THE LEGAL BASIS FOR WHAT WE DO?

The extent of your Personal Data we process depends on what information you provide in your application – this includes the content of your documents, information on how you submitted them, and the content of our possible further communication and conclusions from the recruitment process.

Remember that if the position you are applying for involves entering into an employment contract, you are not obliged to provide any data other than specified in Article 221 of the Labour Code, namely: a) your full name, b) date of birth, c) contact details, d) education, e) professional qualifications, f) employment history, g) other information necessary to fulfil an entitlement or perform an obligation under a law or regulation.

You do not have to provide any other Personal Data to participate in the recruitment process. Provision of any data is voluntary, but if you fail to provide information sufficient for us to assess your application or to contact you, you will not be able to participate in the recruitment process effectively.

If you have consented to participate in a specific recruitment process or in future recruitment processes, the legal basis for us to process your Personal Data will be your consent (Article 6(1)(a) of the GDPR). In some cases, we may process your Personal Data for future recruitment purposes also on the basis of our legitimate interests (Article 6(1)(f) of the GDPR), e.g. to make you an offer for a position consistent with your qualifications and our needs, which is compatible with the original purpose for which your Personal Data was collected (so-called 'compatible purpose' within the meaning of Article 6(4) of the GDPR).

In each case, our processing objective is: a) to assess your application against the requirements for the position listed in the job advertisement in response to which you submitted your recruitment application, or to carry out future recruitment for similar positions, as appropriate; b) provided you meet the requirements for the position – to make you an offer to work with us and to enter into a contract; c) to demonstrate that the recruitment procedure complies with the law.

In the case of the processing of your Personal Data on the basis of consent, we would like to remind you that you may withdraw your previously given consent at any time, without affecting the lawfulness of the processing already carried out on its basis. In the event your Personal Data is processed on the basis of our legitimate interests, you are entitled to object to such processing. Description of your rights is provided in part VI below.

III. HOW LONG DO WE PROCESS YOUR PERSONAL DATA?

The duration of the processing of your Personal Data varies depending on whether the data was collected only for the current recruitment process, whether it can also be used for future processes (only on the basis of your consent), or whether it is necessary for the establishment, investigation or defence of claims in any judicial, administrative or other out-of-court proceedings.

If we process your Personal Data in connection with a single recruitment, it will be deleted 6 months after the end of the recruitment process deemed as the conclusion of a contract with another candidate. This time allows the probationary period to be completed and confirms that the position has actually been successfully filled.

We will process your Personal Data on the basis of your consent to future recruitment until you withdraw your consent or the purpose for which you gave the consent is achieved (you are employed), however, usually not longer than for 2 years from the date of consent.

Those periods may be appropriately extended as necessary in case of claims and judicial proceedings, if any, by the duration of such proceedings and their settlement; and also if we are obliged by the law to process them for longer periods.

IV. WHO HAS ACTUAL ACCESS TO YOUR PERSONAL DATA?

Your Personal Data will only be accessed by:

• Duly authorised employees or associates of Oktawave who are obliged to keep it confidential and not to use it for any purposes other than those for which Oktawave obtained your data;
• Entities that support us in the provision of services on the basis of appropriate data processing contracts, such as e-mailing platforms, colocation service providers, providers of ICT services or contacting tools (communication platforms);
• Providers of legal, advisory, accounting and tax services;
• Audit service providers;
• Postal operators and couriers;
• Insurers, providers of archiving services;
• Companies in the group that includes Oktawave.

All these entities have access only to the information they need to carry out their specific activities.

Sometimes some of those entities providing solutions to us may be established outside the European Economic Area (EEA). Each time when personal data is transferred outside EEA we apply the required safeguards, including standard data protection clauses adopted under the European Commission decision. In addition, in order to protect personal data, both during transmission and after receipt, we apply generally accepted standards that meet the requirements of the GDPR and the case-law of the Court of Justice of the European Union.

You may contact us at to receive a copy of the safeguards used by us concerning the personal data transfer to countries outside EEA. Oktawave may also be obliged to disclose certain information to public authorities as required by the proceedings conducted by them. In such case, information will only be disclosed if there is an appropriate legal basis to do so.

V. DATA PROTECTION OFFICER AND OKTAWAVE CONTACT DETAILS

The Controller of your Personal Data is Oktawave S.A. based in Warsaw. Oktawave's registered office address: ul. Poleczki 13, 02-822 Warsaw. Contact adress: Puławska 464, 02-884 Warsaw. General contact email address:

Email address for contacting the Data Protection Officer:

VI. WHAT RIGHTS DO YOU HAVE IN RELATION TO THE PROCESSING OF YOUR PERSONAL DATA BY OKTAWAVE?

In order to ensure the efficient exercise of your rights, please send all requests to or , write ‘GDPR Request’ in the subject line and specify which right you wish to exercise in the body of the email. You have the following rights:

Access to your Personal Data

You can always ask us to access your Personal Data for the following details:

• whether we process your Personal Data,
• for what purpose,
• what categories of data we process,
• who is their recipient,
• if possible – what is the planned period of data storage, and when it is not possible, the criteria used to determine such period,
• if your Personal Data has not been collected from you – all information available on the source of that data.

You can also obtain an overview of all your data that is processed (data copy).

Right to rectify your Personal Data

If in your opinion the information about you is incorrect or incomplete, you have the right to request that it be updated.

Consent withdrawal

You may withdraw your consent to the processing of your Personal Data at any time, however, it will not affect the legality of the processing prior to the withdrawal.

Right to erase your Personal Data

In certain circumstances, the GDPR grants you the so-called 'right to be forgotten'. Circumstances that justify you making such a request include:

• Personal Data is not necessary any longer for the purposes for which it was collected or otherwise processed;
• you withdraw your consent to the processing of your Personal Data where there is no other legal basis for further processing;
• you submit an objection to the processing of your Personal Data where there are no overriding legal and legitimate grounds for the processing;
• you object to the processing of Personal Data for marketing purposes;
• your Personal Data is processed unlawfully,
• there is an obligation to delete your Personal Data under the EU law or the law of a Member State to which Oktawave is subject.

Right to restrict processing

You may request the restriction of the processing of your Personal Data where:

• you contest the accuracy of your Personal Data processing by us – for a period enabling us to verify the accuracy of the data;
• the processing of your Personal Data is unlawful, but you prefer to restrict the processing instead of deleting it,
• Oktawave no longer needs your Personal Data for the purposes of processing, but you need it to establish, assert or defend your claims,
• you have objected to the processing of your Personal Data – only until the dispute is resolved. Successful submission of a request for restriction of processing will result in the restriction of the activities undertaken by us on the data you have specified and in respect of the specified processing operations/purposes to the minimum that is necessary – in principle, to storage only.

Right to transfer data

You have the right to receive your Personal Data in commonly used and machine-readable format, and also to transmit them to another controller. You can exercise it if:

• processing is based on your consent or a contract, and
• processing is carried out by automated means.

Right to object

For reasons related to your particular situation, you have the right to object to some of our processing activities, in particular in the following circumstances:

• where the basis for processing your Personal Data is our legitimate interest;
• where we process your Personal Data for direct marketing purposes;
• where we process your Personal Data for scientific or historical research purposes or for statistical purposes.

However, please note that when despite your objection we find that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or basis for the establishment, exercise or defence of legal claims, we will continue to process your Personal Data covered by the objection.

Right to lodge a complaint with a supervisory authority

As we are the controller of your Personal Data, you have the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office.

A detailed description of the procedure for lodging a complaint with the President of the Office is available on the website of the President of the Office at: https://uodo.gov.pl/pl/83/155.

For a list of local data protection authorities in the European Union and their contact details visit: https://edpb.europa.eu/about-edpb/board/members_en.

Should you have any concerns as to anything we do, please feel free to first contact us at .