INFORMATION REGARDING DATA PROCESSING
IN THE RECRUITMENT PROCESS

Thank you for your interest in our company, and we are pleased that you are part of our recruitment process.
Since you have decided to participate in the recruitment process at Expur SA, we present this information which describes how we collect and use personal data collected during the recruitment process.
If you do not wish for your information to be collected, used, and transferred as described by this policy, or if you no longer agree with the processing of your information, you can request the removal of this data from our database in writing by sending an email to dpo@expur.ro.

Information We Collect

We collect information about you when you send us your CV, but also directly from you, such as:

• Your contact information, CV, certifications, qualification diplomas, and information about the desired job position.
• Name, address, email address, phone number, and other contact information; CV or cover letter, previous work experience and/or relevance, or other experiences, education, transcripts, or other information you provide in support of an application and/or the application and recruitment process;
• Information from interviews and telephone discussions you may have, if applicable;
• Details regarding the type of job you are looking for, current and/or desired salary, and other terms regarding compensation and benefits packages, willingness to relocate, or other job preferences and the type of preferred organization.
• Any sensitive and/or demographic information obtained during the application or recruitment process, such as gender, citizenship information, medical or health information, candidate communication, and/or data regarding racial or ethnic origin, religious beliefs.
• Information from references and/or information received from background checks (if applicable), including information provided by third parties and/or recommendation letters;
• Information regarding any history from previous employment relationships;
• Other information provided by your direct supervisor if you are already an employee of our company.
• Also, if you participate in an interview at our company's headquarters, images of you will be captured and recorded on the premises of Expur SA, which will be kept for a maximum of 30 days for security reasons.

A Note About Your CV

The CV you send us SHOULD NOT contain sensitive data related to:

• racial or ethnic origin
• political beliefs
• philosophical or religious beliefs;
• membership in a union or political party;
• criminal history or criminal proceedings and associated sanctions or fines;
• the commission of any illegal or inappropriate behavior and associated sanctions;
• any national identification number.

If your CV or other documents you send contain this information, you agree that the processing of this data is done at your own risk.

To ensure that the people invited to join Expur SA are qualified and have strong potential to be productive and successful employees, the company reserves the right to investigate the work history and employment references of applicants. Additionally, the company may conduct research when employees are considered for promotions or transfers, or to promote an internal investigation into alleged misconduct. Background checks will be carried out at the company's discretion and in accordance with applicable law.

The company relies on the accuracy of the information contained in job applications, as well as the accuracy of other data presented during the hiring process and during employment. Any false statements, falsifications, or material omissions in any of this information or data may lead to the exclusion of an applicant from consideration for employment or, if a person has already been hired, the termination of the employment contract.

Some candidates who are employed by the company will be subject to a reference check. Employment offers are contingent upon successful completion of these checks and a technical skills assessment test, if applicable, conducted in accordance with company policy and applicable law.

Current employees being considered for promotion or transfer may be subject to a background investigation. Background investigations may also be conducted as part of an internal investigation into alleged employee misconduct.

How We Use the Information We Collect

Your information will be used by Expur SA for the purpose of conducting the selection and recruitment process, which includes:

• Assessing skills, qualifications, and interests regarding career opportunities;
• Verifying your information and conducting reference checks and/or background checks (if applicable);
• Communicating with you about the recruitment process and/or your application(s), including informing you of other potential career opportunities at Expur SA, if applicable;
• Creating and/or transmitting reports in accordance with local laws and/or regulations, as applicable;
• Improving Expur SA's application and/or recruitment process, including enhancing diversity in recruitment practices;
• Complying with applicable laws, regulations, legal processes, or governmental requests.

In some situations, we will also use your information to protect the rights and property of Expur SA, the rights of users, candidates, employees, or other interested parties as required by law.
Upon acceptance of your application for the recruitment process, Expur SA will collect, process, and store the information from your applicant/candidate file in the company's database.

Who May Have Access to Your Information

We will only disclose your personal data to the extent necessary to achieve the intended purpose. We have taken and will continue to take all necessary measures to ensure that external service providers or our business partners authorized to process data on our behalf have implemented physical, electronic, and managerial security measures to protect this data.

Where necessary, we will assign other companies and individuals to perform certain tasks that contribute to our services on our behalf under data processing agreements for which you have given explicit consent, such as psychological assessment services.
We have identified the following categories of recipients who will have access to this data:

• Recruitment companies contracted for this recruitment process;
• Our IT service provider (data storage) and technical support for the company's IT&C systems;
• Regulatory authorities and other state authorities if required by legal or statutory requirements;
• Legal service providers or consultants in various fields (e.g., IT, data protection), external auditors.

All external service providers of Expur SA are contractually obligated to maintain the confidentiality of personal data.

INTERNATIONAL DATA TRANSFER

Certain categories of personal data may be stored and processed in any country where we engage service providers. We may transfer personal data that we hold about you to recipients in countries other than the country in which the personal data was originally collected. These countries may have data protection rules that are different from those in your country. However, we will take steps to ensure that any such transfers comply with applicable data protection laws and that your personal data remains protected according to European standards.

In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your personal data.

Where applicable law requires us to ensure that an international data transfer is governed by a data transfer mechanism, we use one or more of the following mechanisms:

• EU standard contractual clauses with a data recipient outside the EEA or the UK
• Verification that the recipient has implemented binding corporate rules

We will also ensure that all our international partners have adopted additional measures to provide adequate guarantees, enforceable rights, and effective legal remedies. The role of these measures is to provide guarantees to data subjects that the data transfer based on standard contractual clauses or binding corporate rules provides a level of protection equivalent to that guaranteed within the European Union.

How Long Will We Keep Personal Data?

Unless you object to the processing of your personal data by us and/or request the deletion of your personal data, the following retention periods apply in accordance with our data retention policy:

• We do not store your personal data longer than necessary for the purpose for which we retained it or to comply with a legal or statutory requirement.
• Recruitment data: for 3 years, except in the case of claims or complaints or ultimately legal actions that need to be resolved.

Your Legal Rights

As a data subject, you have specific legal rights regarding the personal data we collect and process. Expur SA respects your rights and ensures that your interests are properly taken into account.

• Withdrawal of Consent: If the processing is based on your consent, you can withdraw your consent for that processing at any time.
• Data Rectification: If you notice that we hold incorrect personal data, you can request the rectification of your personal data at any time. We make reasonable efforts to keep personal data - which is continuously used and which is in our possession or control - accurate, complete, current, and relevant based on the most recent information available to us.
• Restriction of Processing: If you are in one of the situations below, you can request that we restrict the processing of your data:
  • You contest the accuracy of personal data for the period in which we need to verify the accuracy
  • The processing is illegal, and you request the restriction of processing rather than the deletion of personal data
  • We no longer need your personal data, but you request it for the establishment, exercise, or defense of a legal right
  • You object to processing during the period in which we verify whether the processing is based on our legitimate interest.
• Access to Your Data: You can request information about the personal data we hold about you, including information about what categories of data are used, where we collected it from if not collected directly from you, and to whom it has been disclosed, if applicable. You can obtain a copy from us for free containing the personal data we hold about you. We reserve the right to charge a reasonable fee for abusive requests.
• Right to Portability: Upon request, we will transfer personal data to another operator where technically possible, provided that the processing is based on consent or the execution of a contract and the processing is carried out by automated means.
• Right to Deletion: You can obtain from us the deletion of personal data if:
  • Your data is no longer necessary for the purposes for which it was collected;
  • You have withdrawn your consent based on which the processing takes place;
  • You object to the processing of personal data, if the processing is based on a legitimate interest, and there are no legitimate interests to justify the processing;
  • The processing is illegal;
  • Data must be deleted to comply with a legal obligation.

Unless the processing is necessary:

• for fulfilling a legal obligation that requires the processing of those data by us;
• specifically for legal requirements regarding data retention periods;
• for establishing, exercising, or defending a legal claim.

• Right to Object: You can object to the processing of personal data at any time. In this case, we will no longer process personal data unless we can demonstrate compelling, legitimate grounds for the processing or for establishing, exercising, or defending a legal claim. When you object to the processing, please specify whether you wish for the personal data to be deleted or the processing to be restricted.

   

• Right to Lodge a Complaint: In the case of an alleged violation of the applicable privacy legislation, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing by filling out the online form available at: dataprotection.ro/?page=Plangeri_pagina_principala.

Note:

• Time Period: We will try to resolve your request regarding the exercise of a right within 30 days. However, the period may be extended due to the specific right or the complexity of the request.
• Restriction of Access: In certain situations, we may not be able to grant you access to all or part of your personal data due to legal restrictions. If we deny your access request, we will inform you of the reason for the refusal.
• Inability to Identify: In some cases, we may not be able to identify personal data due to the lack of identification details provided in the request you send us. In such cases, if you do not provide additional information that allows your identification, we will not be able to fulfill your request to exercise your legal rights as described in this section.

Additional Information and Exercising Rights

For any further information regarding the processing of Personal Data (including to exercise the above-mentioned rights), please contact our Data Protection Officer in writing via email at dpo@expur.ro or by sending a letter to our registered office in Romania at Sos. Amara nr. 3, Mun. Slobozia, Judetul Ialomita.