Candidate Privacy Policy

Careers Portal

Last updated: July 2024 · Version: v1, public document

1. Introduction

This Candidate Privacy Policy relates to collection and processing of your personal data when you register your profile or apply to job positions at Rimac Group d.o.o., Rimac Technology d.o.o. and Bugatti-Rimac d.o.o., all registered at Ljubljanska 7, 10431 Sveta Nedelja, Croatia ("we", "us", "our", "Rimac group").

For the purposes of the General Data Protection Regulation ("GDPR"), Rimac Group d.o.o., as the parent company, is the data controller with respect to processing of personal data from your candidate profile. In addition, depending on which company you apply for a job position, that company is a data controller with respect to processing of personal data from your candidate application.

We are committed to protecting and respecting your privacy. This policy sets out the basis on which we will process your personal data when you apply to our open job positions posted at https://www.rimac-group.com/careers/rimac-technology/ (the "Careers portal").

In principle you will apply via our Careers portal, but even in case you send a job application via email or in another way this policy shall apply accordingly. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By applying to our open job positions, you acknowledge and agree to the practices described in this policy.

If you have any questions or concerns about this policy, please contact our DPO at:

2. The Types of Personal Data We Receive

We will receive and process the following information about you:

• Information you provide as part of your application. You will provide us information about you by using our Careers portal to apply for a job or by corresponding with us by phone, e-mail or otherwise. This includes information you provide when you register for and use the Careers portal, such as your name, contact information, work experience, educational qualifications, ability to work in the country for which you are applying for employment and any information you choose to submit on or upload to the Careers portal (such as information from a CV). When you want to apply to a job via Careers portal for the first time you will be asked to open a Candidate profile. Candidate profile will require information about your name, last name, e-mail address, CV, country of origin, etc.
• Sensitive information you can provide. You have the option of providing certain sensitive information (so-called special categories of personal data from GDPR) with your consent, such as whether you have a disability for the purposes of acquiring some additional benefits. If you decide not to provide this data, your application will not be prejudiced.
• Information we collect about your usage of the Careers portal. We automatically collect certain data from you when you use our Careers portal, including IP address or other unique device identifiers, information collected by cookies on your usage of the Careers portal, mobile carrier (if applicable), time zone setting, operating system and platform and information regarding your use of the Careers portal ("Usage Information").
• Information from third parties. We may receive information from third parties in connection with your application, such as referees, including former employer, and/or recruiters.

We use cookies to enhance your experience using the Careers portal. Cookies are small files which, when placed on your device, enable us to provide certain features and functionality. The Careers portal will detect and use your IP address or domain name for internal traffic monitoring and capacity purposes or to otherwise administer the Careers portal. For cookies, please see our Cookie Policy.

3. How We Use Your Personal Data

The table in Appendix 1 sets out how we use your personal data and the legal basis for processing relied upon by us to process your personal data. We use it to:

• identify and evaluate you for employment positions;
• determine and validate your qualifications for employment;
• conduct background checks including, to the extent permitted under applicable law (including checking references, qualifications);
• if you are a successful candidate, create an employment record;
• provide you with user support of the Careers portal;
• communicate with you;
• send you notifications about new positions that match your profile;
• improve the Career portal and to ensure content from the Career portal is presented in the most effective manner for you and your device;
• administer the Career portal and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
• keep the Career portal safe and secure;
• develop the Career portal and improve our recruitment processes.

4. How We Share Your Personal Data

In case you have applied for a job position, Rimac Group d.o.o. will share information about your Candidate profile with the Rimac group company to which you have applied for the job position.

We may share your personal data within Rimac group of companies in case you have consented to inform you about the job positions in Rimac group which might be interesting to you.

We share your information with external service providers. We ensure that such external providers protect your personal data with appropriate security measures and prohibit them from using your data other than as instructed by us. In case such external service provider is located outside of the European Economic Area ("EEA"), appropriate safeguards such as Standard Contractual Clauses will be implemented to ensure the same level of data protection as if data was processed in the European Union. We use external service providers for managing our Careers portal, for IT support, and for employee assessments which might be conducted in relation to your job application (e.g. for assessing leadership potential). For information about our external service providers, you may contact DPO.

We may share your personal data with third parties such as referees to verify the information that you provided as part of your job application and/or reference.

5. Where We Store Your Personal Data

Personal data that we collect about you will be stored in our database, i.e., recruitment platform provided to us by our external service provider SAP. Your personal data are collected and stored on servers maintained by SAP in data centres located in the EEA. Your personal data will be processed by our recruitment team and hiring managers. However, in case of a problem with the platform, SAP support team and/or our IT may also have access to your personal data.

If we would need to transfer personal data outside the European Economic Area ("EEA") we would do so only subject to the so-called Standard Contractual Clauses, and supplementary measures in case necessary to ensure the same level of data protection as if data was processed in the European Union.

6. The Security of Your Personal Data

Although we will do our best to protect your personal data, we cannot guarantee the security of your information transmitted through the Careers portal; any transmission is at your own risk. Once we have received your personal data, we will take appropriate technical and organisational measures to safeguard your personal data against loss, theft and unauthorised use, access or modification.

7. Data Retention

We will retain your Candidate profile for 2 years from your last log-in into your Candidate profile, whereas the personal data you have provided in relation to a particular job application we will retain for 18 months after the job application has been closed. After that your personal data will be anonymized.

Even prior to the end of these retention periods you have a right to anonymize your Candidate profile any time by clicking the Revoke button. Anonymizing your Candidate profile will anonymize all other personal data relating to any job application within 48 hours. After anonymization the remaining information cannot be linked to you anymore.

Your information will be retained for longer if required by law or a court order and/or as needed to defend or pursue legal claims.

8. Your Rights

You have certain rights in relation to the personal data we hold about you. To exercise any of your rights, please contact DPO. We shall require you to verify your identity before responding to any requests. You have the following rights:

1. Access: You have the right to know whether we process personal data about you, and if we do, to access data we hold about you and certain information about how we use it and who we share it with.
2. Portability: In certain circumstances, you have the right to receive or ask us to provide your personal data to a third party in a structured, commonly used and machine-readable format. We are not responsible for the security of the personal data or its processing once received by the third party.
3. Correction: To correct any personal data held about you that is inaccurate and have incomplete data completed directly in the Career portal. Where you request correction, please explain in detail why you believe the personal data we hold about you to be inaccurate or incomplete so that we can assess whether a correction is required.
4. Erasure: To erase the personal data we hold about you directly on the Careers portal by anonymizing your account ("Revoke button") at any time. You also have a right to require us to anonymize personal data in the following circumstances:
   1. you believe that it is no longer necessary for us to hold the personal data we hold about you;
   2. we are processing the personal data on the basis of your consent and you wish to withdraw your consent;
   3. we are processing the personal data on the basis of our legitimate interest and you object to such processing;
   4. you believe the personal data we hold about you is being unlawfully processed by us.
5. Restriction of Processing to Storage Only: To require us to stop processing the personal data we hold about you other than for storage purposes in certain circumstances.
6. Objection: In certain circumstances, the right to restrict or object to our processing of your personal data (e.g. where you request correction or erasure, you also have a right to restrict processing of your applicable data while your request is considered).
7. Withdrawal of Consent: Where you have consented to use of personal data, the right to withdraw your consent.
8. Complaint: The right to complain to the relevant supervisory authority.

You may exercise the rights set out at items (a) through (g) above by contacting hrops@rimac-technology.com or DPO. We must respond to a request without undue delay and at least within one (1) month (although this may be extended by a further two (2) months in certain circumstances).

9. Contact

For all data privacy inquiries and any questions or concerns you have about this Policy, please contact our DPO at dpo@rimac-group.com, or postal address: Ljubljanska ulica 7, Sveta Nedelja, Croatia.

10. Changes

This Policy may be amended from time to time at our discretion. You will be notified of any such changes.

Appendix 1

Purposes for Processing Personal Data of Job Candidates