In line with provisions of Article 23 of the Serbian Data Protection Law ("Of. Gazzette RS", no. 87/2018) (hereinafter referred to as “Data Protection Law”), CITRUS SYSTEMS DOO BEOGRAD-NOVI BEOGRAD, Mihajla Pupina 115, floor 7, New Belgrade, Republic of Serbia, statistic number: 21378402, TIN: 110711127, issued the following act:

NOTICE ON PERSONAL DATA PROCESSING FOR JOB CANDIDATES

I Definitions

Data Controller - the natural or legal person, i.e. public authority which, independently or jointly with others, determines the purposes and means of the processing.

Data subject -the natural person whose personal data is being processed.

Data processing - any operation or set of operations which is performed on personal data or on collections of personal data, whether or not by automated means, such as collection, recording, classification, grouping i.e. structuring, storage, adaptation or alteration, disclosure, inspection, use, disclosure by transmission i.e. by delivery, multiplication, dissemination or otherwise making available, comparison, restriction, erasure or destruction (hereinafter: “processing”);

Personal data - means every information relating to an identified or identifiable natural person, directly or intermediary, especially based on mark of identity, such as name and ID number, data about location, identificators in electronic communications or one or more marks of his physical, physiological, genetic, mental, economic, cultural and social identity.

II Purpose of the processing of personal data

Personal data of the job candidates will be processed for the purpose of recruitment (such as: review of received applications, contacting of candidates in order to invite for testing and job interview). If we invite you for the job interview or/and testing, we will make an evidence in our files. Furthermore, we will mark a result of performed interview/testing.

We will process your personal data only for the purpose of recruitment. If we offer you employment, we will ask you for additional personal data and we will inform you about it in particular.

III Legal basis for the processing of personal data

Legal basis for the processing of personal data for the purposes of employment is consent (Article 12 paragraph 1 point 1 of the Data Protection Law). Legal basis for the evidence of performance of job interview or/and testing is our legitimate interest (Article 12 paragraph 1 point 6of the Data Protection Law). Our legitimate interest is based on increase of efficiency of the recruitment process.

IV Providing of personal data

Personal data, data about the education and professional experience are mandatory fields, due to the fact that completion of application form for employment could not be completed without filling in these fileds.

Please note that you shall provide only personal data which are relevant and sufficient for the recruitment of candidates, and in order to protect your personal data, do not provide personal data that are irelevant and unnecessary. On the other hand, if you decide to provide such additional data, such as your photograph or personal data about your interests and hobbies, it will be considered that you gave your consent for processing of such personal data.

V Period of storage of personal data

We will storage personal data that is collected on the basis of your consent, until you withdraw your consent. You can withdraw your consent anytime, by deleting of provided documents (or your profile), or you can contact our Data Protection Officer.

We will storage personal data that we collected on the basis of legitimate interest (the fact that you were invited for testing and/or interview, and the accompanying results) for 3 (three) month.

VI Recipients of personal data

We will not share you personal data with third parties, unless when necessary for our legitimate professional and business needs, in order to act upon your request, and/or such sharing is necessary under applicable law or professional standards. Kindly note that your data could be accessed by persons that are in charge for maintenance of IT applications.

VII Your rights

With respect to performance of your rights, you have the following rights:

- right to access your personal data, including the right to receive its copy(e.g. the right to receive information on which of your personal data is being processed by us and to be advised of the details of such processing);

- right to rectification of incorrect personal data and addition of incomplete personal data;

- right to request erasure of personal data;

- right to lodge a complaint to the Commissioner for Information of Public Importance and Personal Data Protection;

- right to restrict the processing of personal data;

- right to object to processing of personal data/right to lodge a complaint about the processing of personal data which is based on our legitimate interest;

- right to transfer of personal data.

- right to object to automated decision-making processes regarding natural persons, including profiling;

When personal data is processed on the basis of consent, you have the right to withdraw the consent. Consent can be withdrawn anytime, while such withdrawal does not impact lawfulness of processing before its withdrawal.