Candidate Privacy Notice

1. INTRODUCTION

This Candidate Privacy Notice (“Notice“) describes how the Zoolatech Group (collectively, “Zoolatech,” “we,” “us,” or “our“) collects, uses, stores, and shares the Personal Data of individuals applying for employment, contracting, or internship opportunities with us (“Candidates” or “you“).

This Notice applies to all recruitment activities undertaken by Zoolatech globally. It does not create a contractual relationship or guarantee employment. If you are successfully hired, your data will subsequently be processed in accordance with our Employee Privacy Notice or other relevant document.

2. IDENTITY OF THE DATA CONTROLLER

For the purposes of data protection laws (including the GDPR and CCPA), the Data Controller of your Personal Data is the specific Zoolatech Group entity to which you are applying or which has posted the position. Where recruitment decisions involve global leadership, Zoolatech entities may act as Joint Controllers.

A full list of Zoolatech Group entities and their locations is provided at the end of this Notice.

3. CATEGORIES OF PERSONAL DATA WE COLLECT

We collect specific categories of data reasonably necessary to evaluate your candidacy.

A. Information You Provide Voluntarily

• Identity & Contact Data: Name, address, email address, telephone number, and LinkedIn profile URL.
• Professional Experience Data: Curriculum Vitae (CV), resume, cover letter, employment history, educational background, qualifications, certifications, and languages spoken.
• Recruitment Data: Desired salary/rate, notice period, work authorization status (visa/permit), and answers to screening questions.
• Interview Data: Notes taken by interviewers, results of technical assessments, coding challenges, and recordings of video interviews (where applicable and with notice).

B. Information Collected Automatically

If you apply via our website or use our recruitment portal:

• Technical Data: IP address, login data, browser type, and usage data regarding your interaction with our career site (collected via cookies/pixels).

C. Information from Third Parties

• Recruitment Agencies: Data provided by headhunters or staffing agencies representing you.
• References: Opinions and confirmation of history provided by your nominated referees.
• Publicly Available Sources: We may review professional social media profiles (e.g., LinkedIn, GitHub, Stack Overflow) to validate experience, to the extent permitted by local law.
• Background Checks: Criminal, credit, or education checks. Note: We only conduct these checks here explicitly required by the role, permitted by local la, and usually only at the “conditional offer” stage.

D. Special Categories of Personal Data (Sensitive Data)

We generally do not require “Sensitive Data” (e.g., race, religion, health, trade union membership) during the application process. However, we may process it in limited circumstances:

• Health Data: To make reasonable accommodations for a disability during the interview process.
• Diversity Data: Anonymized data for equal opportunity monitoring (only where legally permissible and provided voluntarily).

4. PURPOSES AND LEGAL BASES FOR PROCESSING

We process your data based on the following legal grounds (aligned with GDPR and global standards):

5. DATA SHARING AND DISCLOSURE

Your Personal Data is treated with strict confidentiality. We share it only with:

1. Zoolatech Group Entities: Your data is accessible to HR teams, hiring managers, and interviewers across our global offices (e.g., a hiring manager in the USA interviewing a candidate in Poland) for administrative and decision-making purposes.
2. Service Providers: Third parties who process data on our behalf, including:
   Applicant Tracking Systems (ATS) providers.
   Technical testing platforms (e.g., coding assessment tools).
   Background check agencies.
3. Clients: In limited scenarios, where you are being hired to provide specific consultancy services to a Zoolatech client, we may share a blind/anonymized profile with that client to confirm suitability.
4. Legal Authorities: Government bodies, regulators, or law enforcement where required by law (e.g., tax or immigration authorities).

6. INTERNATIONAL DATA TRANSFERS

As a global organization, your data may be transferred to countries outside your country of residence.

Safeguards:
Where we transfer data originating from the EEA, UK, or Switzerland to countries without an “adequacy” decision, we implement:

• Standard Contractual Clauses (SCCs): Approved by the European Commission (and the UK Addendum) to ensure your data remains protected.
• Intra-Group Data Transfer Agreements: Binding all Zoolatech entities to high privacy standards.

7. DATA RETENTION

We retain your personal data only as long as necessary.

• Active Application: For the duration of the recruitment process.
• Unsuccessful Candidates (Standard): We retain data for 6 months after the rejection decision to defend against legal claims (statute of limitations) and to address any immediate queries.
• Talent Pool (Consent): If you consent to join our Talent Pool, we may retain your data for up to 24 months to contact you about future opportunities. You may opt-out at any time.
• Successful Candidates: Your application data will transfer to your personnel file and be retained in accordance with our Employee Privacy Notice.

8. DATA SECURITY

We employ enterprise-grade security measures (encryption, access controls, audit logs) to protect your data from loss, misuse, or unauthorized access. Access is restricted to HR personnel and hiring managers involved in your specific recruitment process.

9. YOUR RIGHTS

Subject to your local laws, you have the following rights:

• Access & Portability: Request a copy of your data.
• Correction: Update inaccurate information.
• Deletion: Request removal of your data (subject to our legal retention obligations).
• Restriction & Objection: Object to processing based on legitimate interest.
• Withdraw Consent: If you agreed to join our Talent Pool, you can withdraw consent at any time.

To exercise these rights: Contact [email protected].

JURISDICTION-SPECIFIC ADDENDUMS

A. EUROPEAN ECONOMIC AREA (EEA), UK, AND SWITZERLAND

• Automated Decision Making: We do not use fully automated decision-making or profiling (e.g., resume-filtering bots) to make hiring decisions without human intervention.
• Complaints: You have the right to lodge a complaint with your local Data Protection Authority (DPA).

B. CALIFORNIA RESIDENTS (CCPA/CPRA)

Notice at Collection:

• Categories Collected: Identifiers, Professional/Employment Information, Education Information.
• Purposes: Recruitment, security, and legal compliance.
• Selling/Sharing: Zoolatech does not sell candidate data. We do not “share” candidate data for cross-context behavioral advertising.
• Sensitive Personal Information: We limit the use of Sensitive PI (e.g., social security number, health data for accommodations) to that which is necessary for the recruitment process and legal compliance.
• Retention: As outlined in Section 7 above.

C. UKRAINE

• Legal Basis: We process your data in accordance with the Law of Ukraine “On Personal Data Protection.”
• Consent: By submitting your application, you grant consent for the processing of your personal data for recruitment purposes.
• Rights: You possess all rights under Article 8 of the Law, including the right to know the location of the database containing your personal data.

D. MEXICO

• ARCO Rights: You may exercise your rights of Access, Rectification, Cancellation, and Opposition by contacting our DPO.
• Transfers: By submitting your application, you consent to the transfer of your data to Zoolatech Group entities in the USA and Europe for the purpose of evaluating your application.

CONTACT DETAILS

Data Protection Officer: [email protected]

Zoolatech Group Entities (Data Controllers):

• USA:
  Zoolatech Inc.,
  Zoolatech LLC
• Ukraine: Zoola Tech Ukraine LLC
• Mexico: Zoolatech Mexico, S. de R.L. de C.V.
• Poland: Zoola Tech Poland Sp. z o.o