1. Data Controller

The controller of your personal data is: Thaumatec Sp. z o.o. ul. Joachima Lelewela 8 53-505 Wrocław, Poland

2. Data Protection Officer

We have appointed a Data Protection Officer (DPO). You may contact the DPO at: maciej.stachura@thaumatec.com

3. Purpose and Legal Basis for Processing

Your personal data will be processed for the following purposes: a) Current recruitment process Legal basis: Article 6(1)(b) GDPR – taking steps prior to entering into a contract Article 6(1)(c) GDPR – compliance with legal obligations under Polish labour law b) Processing of additional data provided voluntarily (e.g., photo, interests) Legal basis: Article 6(1)(a) GDPR – your consent c) Future recruitment processes (if you provide consent) Legal basis: Article 6(1)(a) GDPR – your consent d) Establishment, exercise or defence of legal claims Legal basis: Article 6(1)(f) GDPR – legitimate interest of the controller

4. Scope of Processed Data

We process personal data included in your CV and application documents, including: Identification data (name, surname) Contact details Education and professional qualifications Employment history Any additional data voluntarily provided

5. Data Retention Period

For the purpose of the current recruitment process – until its completion and for up to 3 months thereafter. If you consent to future recruitment – for a period of 12 months from the date of application or until consent is withdrawn. In case of legal claims – for the period required by applicable law.

6. Data Recipients

Your data may be shared with: IT service providers supporting our infrastructure, Authorized employees involved in the recruitment process. Your data will not be transferred outside the European Economic Area (EEA).

7. Your Rights

You have the right to: Access your personal data Rectify inaccurate data Erase your data (“right to be forgotten”) Restrict processing Object to processing Withdraw consent at any time (without affecting the lawfulness of processing based on consent before withdrawal) Lodge a complaint with the Polish Data Protection Authority (UODO) Providing your data is voluntary but necessary to participate in the recruitment process. We do not use automated decision-making or profiling in recruitment processes.