1. Categories of personal data

The personal data to be processed by the Company for the aforementioned purposes are obtained directly from the job applicant, through the Curriculum Vitae and other supporting documents.

2. Collection of personal data

The Company has collected personal data from the following sources: directly from the data subject or their delegates.

3. Recipients of personal data

To fulfill the purposes mentioned above, the Company uses the services of several contractual partners. Some of them are authorized by the data controller to process personal data, as follows:

• Occupational health service
• Medical services
• Health and Safety at Work Service

These companies may be provided with your personal data to be used within the limits of the obligations they have assumed towards the Company. The personal data disclosed by the Company to the authorized persons for processing are limited to the minimum necessary personal data for the provision of the respective services, and we also request them not to use the personal data for any other purpose. We make every effort to ensure that all entities we work with store your personal data in safe and secure conditions.

The personal data mentioned above may be made available or transmitted to public authorities, auditors, or institutions with competencies in activities or assets of the Company, which request the Company to provide information, based on the legal obligations of the Company. Such public authorities or institutions may include: the Territorial Labor Inspectorate, the National Tax Administration Authority, as well as other authorities, as the case may be.

4. Transfer of personal data outside the country

In the context of the operations described above, your personal data may be transferred outside the country to states within the European Union (“EU”) or the European Economic Area (“EEA”), although this is not usually used. Thus, we inform you that any transfer made by the Company to a member state of the EU or EEA will comply with the legal provisions of the General Data Protection Regulation no. 2016/679 adopted by the European Parliament (“GDPR”). The personal data mentioned in this notice are not transferred to states that do not provide adequate protection regarding the processing of personal data.

5. Duration of processing

We will store your personal data only for the period necessary to achieve the purposes of processing, as mentioned above, and in compliance with the current legal regulations. In the event that the Company determines that it has a legitimate interest or a legal obligation to continue processing your personal data for other purposes, you will be informed accordingly.

We estimate that the processing activities detailed above will require the storage of your personal data for the following periods:

6. Automated decision-making and profiling

The personal data mentioned in this document are not subject to automated decision-making processes, including profiling.

7. Refusal of processing and its consequences

Our personal data is necessary for the purposes mentioned above. In the event that you do not provide personal data for the purpose mentioned above, this will result in the impossibility of participating in the recruitment procedures and, as applicable, the impossibility of the Company to fulfill certain legal obligations.

8. Security of personal data processing

The Company informs you that it constantly evaluates and improves the security measures implemented to ensure the processing of personal data under safe and secure conditions.

Your rights regarding the processing of personal data

In the context of the processing of your personal data, you have the following rights:

• The right to access the processed personal data: you have the right to obtain confirmation of whether your personal data is being processed or not, and if so, you have access to the type of personal data and the conditions of their processing, by submitting a request in this regard to the data controller;
• The right to request rectification or deletion of personal data: you have the possibility to request, by sending a request to the data controller, the rectification of personal data that are inaccurate, the supplementation of personal data if they are incomplete or the deletion of your personal data in situations where (i) the personal data are no longer necessary for their initial purpose (and there is no new legal purpose for processing), (ii) the legal basis for processing is the consent of the data subject, and the data subject withdraws the consent, and there is no other legal basis for processing, (iii) the data subject exercises the right to object, and the controller has no legitimate grounds for continuing processing, (iv) the personal data have been processed unlawfully, (v) deletion is necessary to comply with EU or Romanian law, or (vi) the personal data have been collected in connection with the provision of information society services offered to children (if applicable), for which consent is governed by special rules;
• The right to request restriction of processing: you have the right to obtain restriction of processing in situations where: (i) you consider that personal data are inaccurate, for a period that allows the controller to verify the accuracy of your personal data; (ii) processing is unlawful, but you do not want to delete your personal data, requesting only the restriction of their use; (iii) in the situation where the controller no longer needs your personal data for processing in the above-mentioned purposes, but you request the data for the establishment, exercise, or defense of a right in court; or (iv) you have objected to processing pending verification whether the legitimate grounds of the controller override those of the data subject.
• The right to withdraw consent for processing, when processing is based on your consent, without affecting the legality of processing carried out before the withdrawal of consent.
• The right to object to the processing of personal data for reasons related to your particular situation, when processing is based on a legitimate interest, and to object at any time to the processing of personal data for direct marketing purposes, including profiling.
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
• The right to data portability, namely the right to receive your personal data, which you provided to the controller, in a structured, commonly used, and machine-readable format, and the right to transmit this data to another controller where the processing is based on your consent or the performance of a contract and is carried out by automated means.
• The right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP) and the right to address competent courts.

You can exercise the above-mentioned rights at any time. To exercise these rights, please send a written, dated, and signed notification or in electronic format to the following email address: office@rap-group.ro

Data Protection Officer

For any questions regarding this document, you can contact the Data Protection Officer, Attila Albu, who can be reached via email at office@rap-group.ro