INFORMATION ON PERSONAL DATA PROTECTION

Welcome to Talent Solutions, s.r.o. We look forward to working with you and helping you further develop your career. As
you would expect, in order to properly provide our services, we collect and use information about you.
Talent Solutions, s.r.o. is committed to protecting and respecting your privacy. This information document describes
your rights related to the personal data we process about you, as well as the steps we take to protect your privacy. We
understand that this document is long, but please read it carefully.

Explanation of terms
What personal data does the Company collect and use?
Why do we use your personal data (purpose)?
What is the legal basis for processing your personal data?
Are you obliged to provide us with your personal data when requested?
How long do we retain your personal data?
Do we disclose your personal data to third parties?
Do we transfer your personal data outside the European Union?
Do we make automated decisions, including profiling?
What are the main elements of the Joint Controller Agreement?
What rights do you have in relation to the processing of personal data?
How can you contact us?
How can we change the information in this document?

Explanation of Terms

First, we would like to explain the meaning of certain words in this document. It may seem obvious, but in this
document, you will be referred to as “You.” When we speak of “us” or the “Company,” we mean the following companies
acting as Joint Controllers:

Talent Solutions, s.r.o., registered office: Digital Park III, Einsteinova 19, 851 01 Bratislava, Company ID
No.: 44 077 866, registered with the Commercial Register of the Municipal Court Bratislava III, Section: Sro,
Insert No.: 51396/B,
Talent Business Solutions, s.r.o., registered office: Digital Park III, Einsteinova 19, 851 01 Bratislava,
Company ID No.: 47 570 679, registered with the Commercial Register of the Municipal Court Bratislava III,
Section: Sro, Insert No.: 95354/B, and
Talent Outsourcing Solutions, s.r.o., registered office: Digital Park III, Einsteinova 19, 851 01 Bratislava,
Company ID No.: 46 916 075, registered with the Commercial Register of the Municipal Court Bratislava III,
Section: Sro, Insert No.: 85844/B.

As a Company, we provide a range of HR services, such as employment mediation, temporary staff assignments, payroll
services, recruitment and selection, employee testing solutions, career transitions, talent development, training and
education, career changes, and international mobility (“our Services”).
When we refer to “GDPR” or the “Regulation,” we mean Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the
free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation).
To provide our Services, the Company uses several IT systems. One of these systems is an online portal (“Portal”),
through which the Company advertises job opportunities that applicants can select and respond to based on their
interests, skills, and/or experience, and in the location where they wish to work.
Finally, we would like to note that this document concerns information about people, including information about you. It
does not concern information about the Company (even though it may sometimes overlap). This type of information is
referred to as “Personal Data” or “Personally Identifiable Information.” In this document, we use the term “Personal
Data.”

What Personal Data Does the Company Collect and Use?

The Personal Data that the Company typically collects includes in particular:

your name, surname, contact details, and qualifications (education, training, internships), proof of work
authorization, and other information contained in your CV;
basic data from your profile if you registered on the Portal via your LinkedIn or other social network account;
during the recruitment process, data available on your public LinkedIn profile related to your professional life
that are relevant to the recruitment process;
records of communication with you if you have contacted us directly; and
for the purposes of the Employment Services Act, also data on nationality, gender, personal identification
number or other identifier, employer or user employer, type of employment relationship, title of the mediated
job, date of job mediation, and the date and expected duration of the employment relationship or temporary
assignment, depending on whether it is job mediation with our client or a temporary assignment. The detailed
scope of processed personal data in the case of job mediation is set out in Annex No. 1, Part J of the
Employment Services Act and, in the case of agency employment, in Annex No. 1, Part I of the same Act.

Why Do We Use Your Personal Data (Purpose)?

To be able to provide you with the service you expect from us. This service is to find suitable employment for you,
either through agency employment, where the Company acts as an employment agency, or directly with our client as your
future employer. This service includes communication with you, conducting the selection process, assisting you during
recruitment with a potential employer, transferring your personal data to potential employers, etc. Some of your data
are collected and processed to assess your experience and professional skills.
The service also includes your possible inclusion in the database of job applicants, so that if a relevant or
interesting job offer arises, we can contact you with information about it.
The service may also include direct marketing communication consisting of sending information about current job
opportunities, career events, employment possibilities, and other relevant updates of a similar nature.
If you successfully complete the selection process, you will be appropriately informed about further processing of
personal data before being employed. In the case of a successful selection, your personal data will be processed for
compatible purposes, namely for the purpose of performing the employment relationship.

What Is the Legal Basis for Processing Your Personal Data?

Each processing of Personal Data must be based on one of the permitted legal grounds.

Performance (or conclusion) of a contract (pre-contractual relations – Article 6(1)(b) GDPR). Processing of your
Personal Data for the purpose described above is necessary to take steps at your request prior to entering into
a contract. This means that we must process your Personal Data in order to provide you with the service that
results in the conclusion of a contract with you and entry into an employment relationship.
Consent (Article 6(1)(a) GDPR). Your consent is required for inclusion in the job applicant database as well as
for the sending of marketing communications.

You Obliged to Provide Us with Your Personal Data When Requested?

You are not obliged to provide us with your Personal Data, but if you do not, we will not be able to properly offer you
the service described above.

How Long Do We Retain Your Personal Data?

We will store your Personal Data for as long as we provide you with the service described above. This means we will
process your Personal Data for the stated purpose until you enter into an employment relationship with us or our client,
or until your application is definitively rejected by us or our client.
After the completion of the selection process, we retain your personal data only if it is necessary to achieve the
stated purpose or for the duration of your consent if you have given consent for the processing of personal data for the
purposes of maintaining a record of job applicants or marketing. Consent is granted for 2 years.

Do we transfer your Personal Data to third parties?

We may transfer or make your Personal Data available to third parties. We do so in the following situations:

Transfer to our suppliers (external service providers). For example, we may engage our supplier to perform
administrative and operational activities in the course of providing our services. This supplier will have both
a contractual and legal obligation to maintain the confidentiality of your Personal Data and to respect your
privacy and will have access only to the data necessary for their activities. Such suppliers typically include
IT providers (who provide IT systems where information about you is stored) or providers of legal, accounting,
and financial services (who need to know candidate data to issue and record invoices correctly).
Transfer to our clients (potential employers). We will share your Personal Data with our clients who offer jobs
you have shown interest in or which we find suitable for you. Our clients have a contractual obligation to us
and to you to maintain confidentiality regarding your Personal Data.
Transfer to the Central Office of Labour, Social Affairs, and Family. Under § 28(a) and § 31(1)(f) of the
Employment Services Act, we are required to keep records of individuals to whom we have mediated employment or
who have been temporarily assigned, and to provide this data to the Central Office of Labour, Social Affairs,
and Family.
Transfer to other authorized entities. Your data may be provided to government authorities, public authorities,
courts, and law enforcement agencies.

Do we transfer your Personal Data outside the European Union?

Your data is transferred outside the European Union only to countries that are considered by the European Commission to
have an adequate level of protection under Article 45 of the GDPR, or where the conditions set out in Article 46 of the
GDPR are met. Such transfers occur primarily when using the services of our cloud and software solution providers.
Data transfers may take place, for example, to the United States, which is currently protected by the EU-US Data Privacy
Framework, approved by the European Commission. This framework represents an adequacy decision under Article 45 of the
GDPR, meaning that data transfers to the U.S. are considered safe and do not require additional safeguards.
In the case of transfers to other third countries, we use other specific safeguards to protect your data, such as the
Standard Contractual Clauses (SCC) approved by the European Commission.
All data transfers are therefore carried out in accordance with the relevant provisions of the GDPR to ensure maximum
protection of your rights and freedoms.

Do we carry out automated decision-making, including profiling?

To make our recruitment process more efficient and effective, we use tools and features based on artificial intelligence
(AI). The goal is to provide our team with more accurate and faster information to help them decide who is the most
suitable candidate for a given position.

If you participate in our recruitment process, your data may be processed automatically. This includes profiling, which
is based on the following steps:

AI-led interview: You may take part in an interview conducted by a virtual AI recruitment assistant. This system
is designed to have a voice conversation with you, ask questions relevant to the position, and respond
dynamically to your answers.
Recording and transcription of the interview: Your voice interview is recorded and then automatically
transcribed into text form.
AI-based analysis and evaluation: The text transcription of the interview, and if you provide your CV, its
content as well, are analyzed by AI algorithms. This analysis is used to:
- Identify and evaluate your skills, experience, language proficiency, and other competencies relevant to
  the job.
- Create summaries of your interview and profile.
- Possibly calculate scores or ratings indicating your suitability for the position or company culture.
- Identify your strengths and areas for development.

Important information about automated decision-making and profiling
Under Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing
(including profiling) that has legal effects on you or similarly significantly affects you.

It is therefore important to emphasize that while profiling occurs, the final decision on whether you are hired is never
based solely on the results of AI analysis. AI outputs are provided to our team as a supporting tool to aid their
decision-making process, but they do not decide on their own. The final hiring decision is always made by a human who
reviews all information, including that provided by AI.

Purpose and expected consequences of such processing: Processing your data through AI aims to speed up and objectively
assess a large number of applicants. The expected outcome is a more efficient and transparent recruitment process.

What are the main elements of the Joint Controller Agreement?

The agreement between the joint controllers includes the following basic provisions, which are provided to the data
subjects in accordance with Article 26(2) of the Regulation:
For the purposes of the Agreement:

Controller 1 is Talent Solutions, s.r.o., registered office at Digital Park III, Einsteinova 19, 851 01
Bratislava, Company ID: 44 077 866, registered with the Commercial Register of the Bratislava III District
Court, Section: Sro, Insert No.: 51396/B,
Controller 2 is Talent Business Solutions, s.r.o., registered office at Digital Park III, Einsteinova 19, 851 01
Bratislava, Company ID: 47 570 679, registered with the Commercial Register of the Bratislava III District
Court, Section: Sro, Insert No.: 95354/B, and
Controller 3 is Talent Outsourcing Solutions, s.r.o., registered office at Digital Park III, Einsteinova 19, 851
01 Bratislava, Company ID: 46 916 075, registered with the Commercial Register of the Bratislava III District
Court, Section: Sro, Insert No.: 85844/B.

Regarding the processing of personal data for the jointly determined purpose, the joint controllers agreed as follows:

Controller 1 is responsible for the proper performance of information obligations under Articles 13 and/or 14 of
the Regulation and for informing data subjects about the main parts of the Agreement, except in cases where the
personal data is collected directly by Controller 2 or Controller 3.
The provision or sharing of personal data between joint controllers is carried out electronically or in writing.
The joint controllers have mutually agreed on the content of the information provided to data subjects regarding
the joint purposes of processing personal data, including information about the purpose of processing,
recipients, retention period, and legal basis.
The joint controllers have agreed that the contact point for data subjects to exercise their rights is
Controller 1. Data subjects may contact Controller 1 in the manner specified in this information.
Notwithstanding the above, the data subject may, under Article 26(3) of the Regulation, exercise their rights
under the Regulation with any of the controllers.
A request by a data subject to exercise their rights under the Regulation will be handled by the controller to
whom the request was submitted. The controller that received the request will record it and promptly inform the
other controller(s), providing the content of the request. Based on the request, the joint controllers will
cooperate as needed to ensure that the data subject’s request is duly and timely fulfilled.
Each controller is responsible for the secure storage of original documents containing personal data that it
holds, as well as for protecting the personal data contained in its information systems. Upon request, the joint
controllers will mutually provide originals or copies of documents containing personal data.

What are your rights regarding the processing of Personal Data?

Right of access to your Personal Data and the right to obtain a copy. You have the right to obtain confirmation
from the Company as to whether it processes any of your Personal Data (confirmation of the purpose of
processing, the categories of processed data, recipients to whom data were or will be disclosed, the retention
period, the right to request rectification, erasure, or restriction of processing, the right to file a
complaint, the source of data, and the existence of automated decision-making including profiling). If so, you
have the right to access this data (e.g., via the Portal) and obtain a copy.
Right to data portability. If your data is processed automatically, you have the right to obtain the Personal
Data you have provided to us in a structured, commonly used, and machine-readable format, and, where technically
feasible, to request that we transfer this data to another entity.
Right to rectification. If you demonstrate that your Personal Data is incorrect, you can request an update or
correction. In some cases, you can update your data yourself via the Portal. You also have the right to complete
incomplete data.
Right to erasure (“right to be forgotten”). In certain legally defined cases (e.g., data no longer needed for
the purpose it was collected, consent withdrawn, unlawful processing, etc.), you have the right to have your
Personal Data erased. If we determine that the reasons for deletion are met, we will delete your data without
undue delay. Please note that if your data is deleted, we may no longer be able to provide the expected service.
If you later wish to use our services again, you will need to provide your data anew.
Right to restrict processing. In certain legally defined cases, you have the right to request restriction of
processing (e.g., contesting accuracy, unlawful processing, data no longer needed, or objection pending
verification). Please note that restriction may limit the services we can provide.
Withdrawal of consent. You have the right to withdraw your consent at any time if the processing is based on it.
Withdrawal does not affect the lawfulness of processing before withdrawal. You can withdraw your consent
electronically at gdpr.sk@talent-solutions.sk or in writing to
Digital Park III, Einsteinova 19, 851 01 Bratislava.
Right to object. If processing is based on our legitimate interest, you may object for reasons relating to your
specific situation. We may then continue processing only if we demonstrate compelling legitimate grounds that
override your interests, rights, and freedoms, or if necessary for legal claims.

If you wish to exercise any of these rights, please do so via the Portal or by email at gdpr.sk@talent-solutions.sk. You can also contact us at +421 (2) 5363
0223 or at our registered office. Please note that for email requests, we will need to verify your identity.

If you believe that the processing of your Personal Data violates legal regulations, you also have the right to lodge a
complaint with a supervisory authority, in particular in the state of your habitual residence, place of employment, or
the place of the alleged violation. The supervisory authority for the Slovak Republic is the Office for Personal Data
Protection of the Slovak Republic, located at Námestie 1. mája, 811 06 Bratislava, Slovak Republic, Company ID: 36 064
220, www.dataprotection.gov.sk.

How can you contact us?

If you have any further questions regarding the information provided here or need additional details about the
processing and protection of your Personal Data, please contact us at gdpr.sk@talent-solutions.sk, by phone at +421 (2) 5363 0223, or at our
registered office.
The Company has appointed a Data Protection Officer who can be contacted at gdpr.sk@talent-solutions.sk or +421 910 460 991.

How can we change the information provided in this document?

The information provided here may change from time to time. New versions of this document will be published on the
Company’s website and/or you will be informed in another appropriate manner.

Information on the processing of personal data