Payroll, Time & Benefits Senior Specialist (Supporting Poland and Austria)

CONSENT TO THE CURRENT RECRUITMENT PROCESS Your personal data will be processed solely for the purposes of the current recruitment process and, if you have given your consent, for future recruitment processes by companies of the LeasingTeam Group as joint controllers.

CONSENT TO FUTURE RECRUITMENT PROCESSES I agree to participate in future recruitment processes conducted by companies from the LeasingTeam Group and to the processing of my personal data in this regard.

Information clause for candidates applying for employment at the LeasingTeam Group required by the Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - GDPR PERSONAL DATA CONTROLLERS The companies forming the LeasingTeam Group, i.e.: 1. LeasingTeam sp. z o.o. ul. Taśmowa 7, 02-677 Warsaw, KRS 246710, NIP 1231069185; 2. LeasingTeam Professional sp. z o.o. - ul. Taśmowa 7, 02-677 Warsaw, KRS 397410, NIP 5361909208; 3. LeasingTeam Brand Management sp. z o.o. - ul. Taśmowa 7, 02-677 Warsaw, KRS 550844, NIP 9512390546; 4. LeasingTeam Outsourcing sp. z o.o. - ul. Taśmowa 7, 02-677 Warsaw, KRS 344462, NIP 9512302358; 5. IT LeasingTeam sp. z o.o. ul. Taśmowa 7, 02 677 Warsaw, KRS 570690, NIP 5213703573; 6. LeasingTeam International sp. z o.o. - ul. Taśmowa 7, 02-677 Warsaw, KRS 1010553, NIP 8992734079; 7. Talentpoint sp. z o.o. - ul. Taśmowa 7, 02-677 Warsaw, KRS 458891, NIP 5361913552; 8. LeasingTeam Oddział Północ sp. z o.o. ul. Jarosława Dąbrowskiego 15/3, 83-110 Tczew, KRS 948368, NIP 5932631032; 9. LeasingTeam GmbH with its registered office in Berlin - Potsdamer Platz 10, 10785 Berlin, entered in the German commercial register under the number: HRB 246021 B; 10. LeasingTeam s.r.o. with its registered office in Ostrava - Křížkovského 617/10, Muglinov, 712 00 Ostrava, ID number 17618321. have adopted a model of joint personal data control for the purpose of conducting recruitment processes. These companies are hereinafter referred to collectively as the Joint Controllers and individually as the Controller. The joint controllers operate in the field of employment services in the broadest sense (in particular, they offer their clients temporary employment, outsourcing or recruitment services). They therefore carry out recruitment processes both for themselves, in order to meet their own internal staffing needs, and in order to provide the aforementioned services to their clients. DATA PROTECTION OFFICER The joint controllers have appointed a single Data Protection Officer who can be contacted by telephone, email or post: tel. +48 698978143 2 email: iod@leasingteam.pl address: ul. Taśmowa 7, 02-677 Warsaw, with a note indicating the name of any Administrator. BASIC PRINCIPLES OF JOINT DATA ADMINISTRATION Each of the Joint Controllers processes data for the same purpose, i.e. for the purpose of recruitment. Within the framework of the concluded joint controllership agreement in accordance with Article 26 of the GDPR, each Controller is responsible for: a) fulfilling information obligations towards data subjects, b) responding to data subjects' requests, c) ensuring data confidentiality, d) ensuring access to data only to authorized persons, e) accepting and processing requests and demands submitted in connection with the GDPR in accordance with internal procedures, f) communicating with data subjects regarding their rights under the GDPR in accordance with internal procedures, g) proper implementation of the procedures established in connection with the GDPR, h) notifying the President of the Personal Data Protection Office and data subjects of personal data breaches in accordance with internal procedures. LeasingTeam sp. z o.o. is responsible for keeping records related to personal data protection. IT LeasingTeam sp. z o.o. deals with: a) the provision and maintenance of ICT infrastructure, b) the granting/withdrawal of authorizations to the systems used by the Administrators, c) data storage, d) the implementation of technical security measures, e) server support, and f) data backup. TalentPoint sp. z o.o. is responsible for operating the TalentPoint program, which is a proprietary system supporting the personnel and administrative management of employees and associates in the LeasingTeam Group. TalentPoint provides ongoing online access to employee and associate data and allows, among other things, for efficient handling of vacation requests, absence records, working time records, access to employment certificates, pay slips, and PIT declarations. LeasingTeam Brand Management sp. z o.o. is responsible for the marketing and promotion of the LeasingTeam Group's products and services, including the provision of direct marketing services. Regardless of the above division of responsibilities, each Joint Controller is responsible for the proper and lawful processing of personal data. All requests and demands related to data processing can be addressed to any of the Joint Controllers. PURPOSES, BASIS AND DURATION OF PROCESSING The personal data of CANDIDATES FOR EMPLOYMENT are processed on the basis of: 31. Article 6(1)(c) of the GDPR for the purpose of conducting the recruitment process, based on the employer's authorization under Article 22¹(1) of the Labor Code; 2. Article 6(1)(a) or Article 9( 2(a) of the GDPR for the purpose of conducting the recruitment process, based on consent to the processing of personal data in the scope of data provided voluntarily (other than those resulting from Article 22¹ § 1 of the Labor Code) and, possibly, for the purpose of conducting future recruitments with your participation; 3. Article 6( 1(f) of the GDPR, i.e. in the legitimate interest of the Co-Administrators, which should be considered: a) the processing of data obtained during the recruitment process in connection with the verification of your skills and abilities needed to work in the position specified in the advertisement, b) data processing in the event of a legal need to assert claims or defend against claims. The data processed for the purposes indicated in points 1, 2 and 3(a) will be stored for the time necessary to carry out the recruitment process, but no longer than for 1 year. When consent has been given to participate in future recruitments conducted by the Joint Controllers, the data will be processed for the period for which consent has been given, not longer than for 3 years. Data processed for the purpose indicated in point 3 letter b) will be stored until the expiry of the limitation period, but not longer than 7 years. The personal data of CANDIDATES FOR CLIENTS is processed on the basis of: 1. Article 6(1)(b) of the GDPR for the purpose of conducting the recruitment process, in respect of data whose acquisition is necessary for the conclusion of a contract of mandate; 2. Article 6(1)(a) or Article 9(2)(a) of the GDPR for the purpose of conducting the recruitment process, or possibly also future recruitment processes, based on the candidate's consent to the processing of voluntarily provided data (other than those resulting from point 1 above); 3. Article 6( 1(f) of the GDPR, i.e. in the legitimate interest of the Joint Controllers, which should be considered: a) processing of data obtained during the recruitment process in connection with checking your skills and abilities needed to work in the position specified in the advertisement, b) data processing in the event of a legal need to assert claims or defend against claims. The data processed for the purposes indicated in points 1, 2 and 3(a) will be stored for the time necessary to carry out the recruitment process, but no longer than for 1 year. If consent has been given to participate in future recruitment processes carried out by the Joint Controllers, the data will be processed for the duration of the consent period, but no longer than 3 years. Data processed for the purpose indicated in point 3(b) will be stored until the expiry of the limitation period, but no longer than 7 years. DATA RECIPIENTS The processed personal data may be transferred to: authorized state offices and authorities and other entities based on a justified request; processors that provide services to the Joint Controllers, e.g. IT, marketing, legal service providers; as well as to customers for whom the given Controller provides a service related to the employment of the data subject. RIGHTS OF DATA SUBJECTS In accordance with the GDPR, everyone whose data is processed has the right to: a) access their data and receive a copy of it; b) rectify (correct) their data if it is incorrect or out of date; c) the right to request the deletion of data in cases specified by law; d) the right to withdraw the consent given to process the data, whereby the withdrawal of consent does not affect the lawfulness of the processing of personal data which was carried out on the basis of consent prior to its withdrawal; e) the right to request restriction of processing in cases specified by law; f) the right to object to the processing of data processed on the basis of the legitimate interest of the Controllers, which does not affect the legality of the processing until the objection is taken into account; g) the right to lodge a complaint with the President of the Personal Data Protection Office (at the address of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw). PROFILING AND AUTOMATED PROCESSING The joint controllers do not envisage profiling or automated decision-making based on the collected data. TRANSFER OF DATA OUTSIDE THE EEA As a rule, your personal data will not be transferred to countries outside the European Economic Area (EEA). An exception may be the transfer of data outside the EEA if the potential employer (the Administrator's client) is an entity based outside the EEA, as well as in the case of cooperation with IT solution providers located outside the EEA. In this case, the personal data safeguards referred to in Articles 46-49 of the GDPR will be applied, e.g. in the form of standard contractual clauses adopted by the European Commission. In the case of data transfer to the United Kingdom of Great Britain and Northern Ireland, the transfer is based on the decision of June 28, 2021, issued by the European Commission, stating an adequate level of personal data protection.