PERSONAL DATA PROCESSING POLICY

These Personal Data Processing Policy (hereinafter only “Policy”) explain how Jobiflow s. r. o. processes personal data of natural persons who use the Jobiflow electronic system or come into contact with Jobiflow in the provision of its services. The Policy is issued in accordance with Articles 12 to 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (GDPR) and Act No. 18/2018 Coll. on Personal Data Protection.

Please pay attention to the content of this Policy. If you have any questions or wish to exercise your rights as a data subject, please do not hesitate to contact us at any time using the contact details provided in Article 1 of the Policy.

1.              CONTROLLER AND CONTACT DETAILS

1.1.          The controller of your personal data is the company Jobiflow s. r. o., with registered office at Dlhé Nivy 420/90, 019 01 Ilava, Slovak Republic, Company ID No.: 57 430 501, registered in the Commercial Register of the District Court Trenčín, Section Sro, Insert 57450/R (hereinafter only “Jobiflow” or “we”).

1.2.          In matters relating to personal data protection, you may contact us:

a)        in writing: at the registered office address of Jobiflow stated in Article 1.1,

b)        by e-mail: info@jobiflow.com and

c)        general questions: info@jobiflow.com.

1.3.          Data Protection Officer. If Jobiflow appoints a Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, it will publish their contact details on its website and in this Policy. At present, Jobiflow does not have a designated Data Protection Officer, as its appointment is not mandatory for Jobiflow under Article 37(1) of the GDPR.

2.              DEFINITIONS OF USED TERMS

2.1.          The terms used in these Principles have the following meanings:

a)        Personal data. Means any information relating to an identified or identifiable natural person within the meaning of Article 4(1) GDPR;

b)        Data subject. Means a natural person whose personal data Jobiflow processes (in particular job applicants, platform users, influencers, employees of Clients, and website visitors);

c)        Client. Means an entrepreneur (employer or employment agency for remuneration) who has concluded an agreement with Jobiflow for the provision of the Services and uses the Jobiflow electronic system;

d)        User / Applicant. Means a natural person who uses the Jobiflow electronic system in the capacity of a job applicant, website visitor, or other recipient of the Service who is not a Client;

e)        Influencer. Means a natural person registered in the Jobiflow electronic system who, through the "Influencer package" Service, provides marketing services for Clients.

f)         Services. Means products and services provided by Jobiflow through the electronic system, in particular posting job advertisements, recruiting employees, and brokering marketing cooperation with influencers;

g)        Electronic system. Internet websites (including related databases) provided by Jobiflow through which the Services are provided; and

h)        Processing. Means any operation or set of operations with Personal data under Article 4(2) GDPR (e.g. collection, recording, storage, transfer, deletion).

3.              JOBIFLOW'S POSITION IN PROCESSING

3.1.          Jobiflow acts in different situations in different capacities with respect to Personal data:

3.2.          Jobiflow acts as an independent controller in particular in:

a)        registration of Clients, Users, Applicants and Influencers in the electronic system,

b) operation, security, statistical evaluation, and development of the electronic system,

c) fulfillment of contractual relations with Clients and Influencers (invoicing, recovery, communication),

d) handling requests, claims, and complaints,

e) marketing activities towards our own Clients and Applicants, and

f) fulfillment of Jobiflow's legal obligations (in particular tax, accounting, and AML).

3.3. When processing Personal Data of Applicants within recruitment carried out by the Client (in particular receiving responses to Advertisements, sending CVs to the Client, and conducting an AI Avatar Interview for the Client), Jobiflow acts as a processor under Art. 28 GDPR and the Client is the controller who determines the purposes and means of processing. The relationship between Jobiflow and the Client in this part is governed by the Personal Data Processing Terms, which form part of the contract with the Client.

3.4. For the Client's Career Pages on which the Client integrates its own tools (e.g. its own analytics or marketing cookies), Jobiflow and the Client act as separate controllers.

3.5. These Principles apply only to processing for which Jobiflow acts as an independent controller. For processing for which Jobiflow is a processor of the Client, the data processing principles issued by the respective Client apply.

4.              CATEGORIES OF DATA SUBJECTS AND PROCESSED PERSONAL DATA

4.1. Jobiflow processes Personal Data of the following categories of Data Subjects;

4.2. Applicants and Users: To the extent of name and surname, date of birth, address, contact details (telephone, e-mail), education and work experience data, CV, cover letter, photograph (if the User adds one), data on work preferences, history of responses to Advertisements, login details, device data and interaction with the system;

4.3. Website visitors: To the extent of IP address, browser and device identifiers, cookie data (according to the set consent), traffic data, time and duration of visit, navigation data;

4.4. Employees and representatives of the Client: To the extent of name and surname, job position, e-mail, telephone, activities performed in the electronic system (logs), login details;

4.5. Influencers: To the extent of name and surname, social media username (handle), e-mail, telephone, address, data on the influencer's profile and audience (audience size, demographics, topic coverage), price for cooperation, portfolio and presentation materials, data necessary for payment of remuneration (bank account, or Company ID/Tax ID), evaluations and outputs of collaborations; and

4.6. Persons exercising the rights of a data subject, persons submitting notifications under the DSA, and persons communicating with Jobiflow. To the extent of: identification and contact details necessary for handling the request, the content of the communication, evidence submitted to support the request.

4.7. Jobiflow does not knowingly process special categories of personal data under Art. 9 GDPR (data on health, race, political opinions, religion, sexual orientation, etc.) or data relating to convictions for criminal offenses under Art. 10 GDPR. If an Applicant or User voluntarily enters such data into their profile, CV, or message (e.g. a health restriction relevant to a job position), they do so at their own responsibility. Jobiflow handles such data with the same level of protection as other Personal Data and does not provide it to third parties beyond the scope of the purpose for which it was provided.

4.8. For applicants, Jobiflow processes personal data mainly on the basis of legitimate interest under Art. 6(1)(f) GDPR, in particular in operating the platform, making the profile available to the client after a response to an advertisement, system security, and logging. Performance of a contract under Art. 6(1)(b) GDPR applies only to the extent that a contractual relationship arises between Jobiflow and the applicant for the use of the platform and the provision of explicitly requested services. Making the applicant's profile available to the client after a response to an advertisement is based on the legitimate interest of Jobiflow and the relevant client in ensuring the recruitment process; the applicant has the right to object to such processing under Art. 21 GDPR.

5.              PURPOSES OF PROCESSING, LEGAL BASES, AND RETENTION PERIOD

5.1. Below we provide an overview of the individual purposes for which Jobiflow processes Personal Data, the legal bases under Art. 6(1) GDPR, and the retention period:

Note: Within the legitimate interest, Jobiflow applies a standard proportionality test (balancing test). The result of this test is available upon request through the contact details listed in Art. 1.2 of these Terms.

5.2. When the user account is canceled, Jobiflow shall without undue delay, no later than 30 days from the cancellation of the account, delete the account data, profile, uploaded documents, and responses to Advertisements, in accordance with Art. 12.4 of the Terms of Use. Exceptions are data that Jobiflow must retain by law: invoices and accounting documents are retained for 10 years. If the user is the sole owner of a company account, before canceling their account they must transfer ownership to another team member. Deleted data may remain in secure backups for up to 6 months, used exclusively for recovery after an incident; older backups are automatically deleted.

6.              SOURCES OF PERSONAL DATA

6.1.          We primarily obtain Personal Data directly from Data Subjects, especially during registration, profile completion, responding to an Advertisement, ordering a Service, or communicating with Jobiflow.

6.2.          To a limited extent, we also obtain Personal Data from the following indirect sources:

a)        from Clients (e.g., contact details of the Client's employees that the Client adds to their team in the electronic system),

b)        from publicly available sources (especially for Influencers — their public profiles on social networks, if the Influencer does not upload them directly to the platform),

c)        from service providers for identity and creditworthiness verification when concluding a contract with the Client,

d)        from commercial and public registers (for Clients — entrepreneurs, especially the Commercial Register of the Slovak Republic, the Slovak Trade Register, the VAT payers register) and

e) from providers of analytics and advertising tools listed in the Cookies Policy (to the extent stated there and according to cookie consent).

7. RECIPIENTS OF PERSONAL DATA

7.1. We may provide personal data to the following categories of recipients, where necessary to achieve the purposes of processing set out in Article 5 of these Policy:

The current list of intermediaries (sub-processors) pursuant to Article 28 of the GDPR is available in the Jobiflow Electronic System and/or upon request through the contact details in Article 1.2 of these Principles. Each intermediary is contractually bound to the same level of protection of Personal Data as set out in these Principles.

8.              TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

8.1.          Some recipients of Personal Data listed in Article 7 of the Principles are located outside the European Union and the European Economic Area, in particular in the United States of America (for example cloud providers, analytics tools, AI tools, or advertising providers). In such cases, Personal Data may be transferred to third countries.

8.2.          Jobiflow ensures that transfers of Personal Data to third countries are carried out exclusively on the basis of appropriate safeguards under Chapter V of the GDPR, through:

a)        adequacy decisions of the European Commission (in particular the Data Privacy Framework — for the USA),

b)        standard contractual clauses approved by the European Commission under Decision (EU) 2021/914,

c)        binding corporate rules (BCRs), if accepted by the recipient,

d)        additional technical and organizational measures, if necessary to achieve a level of protection corresponding to the GDPR.

8.3.          More detailed information about the safeguards applied in a specific transfer will be provided upon request via the contact details stated in Article 1.2 of the Principles.

9.              AUTOMATED PROCESSING, PROFILING AND AI FUNCTIONS

9.1.          Jobiflow uses automated processing in the Electronic System, including profiling within the meaning of Article 4(4) GDPR, and high-risk artificial intelligence systems within the meaning of Annex III of the AI Act.

9.2.          Jobiflow operates an AI functionality that may affect the processing of Candidates' Personal Data - AI Avatar Interview.

9.3.          If a candidate decides to take part in the first round of the selection process in the form of an AI Avatar Interview, a virtual avatar will ask questions predefined by the Client, the response will be audiovisually recorded and transcribed, and the system will compare solely the content of the transcript with the Client's model answer, resulting in a percentage match score. The system does not analyze the candidate's face, voice, facial expressions, speech tone, fluency of expression, or other biometric or behavioral characteristics and does not perform emotion recognition. This processing takes place exclusively on the basis of the candidate's explicit consent, and an equivalent alternative form of interview without the use of AI is always available; refusal to consent has no negative consequences for the candidate's participation in the selection process. The candidate has the right to human review of the result by an authorized person of the Client, the right to express their own point of view, and the right to challenge the result. A data protection impact assessment pursuant to Article 35 GDPR has been carried out for this processing.

9.4.          Except for the AI Avatar Interview, no AI Function of Jobiflow makes a decision within the meaning of Article 22 GDPR. The evaluation of answers within the AI Avatar Interview may constitute automated processing with a significant impact on the candidate within the meaning of Article 22(1) GDPR; therefore, it is carried out exclusively on the basis of the candidate's explicit consent pursuant to Article 22(2)(c) GDPR and with safeguards pursuant to Article 22(3) GDPR — the right to human intervention by the Client, the right to express one's own point of view, and the right to challenge the result.

9.5.          Candidate rights in relation to AI processing. The candidate has the right to:

a)        object to profiling under Article 21 GDPR and, in such case, Jobiflow will without undue delay assess the grounds for the objection and either terminate the profiling processing or inform the Candidate in writing of compelling legitimate grounds that override it,

b)        request human intervention; if the Candidate believes that the result of the selection process was negatively affected by an AI output, they may request the Client to have the result reviewed by a human worker,

c)        request an explanation of the logic of the output of the AI Function that affected them, through contact at info@jobiflow.com.

9.6.          In accordance with Article 26 of the AI Act, Jobiflow informs Candidates that a high-risk AI system in the field of human resources pursuant to Annex III of the AI Act is deployed within the Electronic System. This system, AI Avatar Interview, serves exclusively to support the decision-making process of Clients and does not produce a binding decision vis-à-vis Candidates. It applies the regime under Article 9.3 of these Principles.

10.           SECURITY OF PERSONAL DATA

10.1.       Jobiflow implements appropriate technical and organizational measures under Article 32 GDPR to protect Personal Data against unauthorized or unlawful processing, accidental loss, destruction, or damage. The measures include in particular:

a)        encryption of data transmission (HTTPS/TLS) and encryption of sensitive data at rest,

b) pseudonymization of data, where appropriate given the nature of the processing,

c) multi-factor authentication for administrative access,

d) management of access rights based on the principle of least privilege,

e) regular backup of data and an incident recovery plan,

f) logging of access and auditing of security events,

g) employee training and a contractual confidentiality obligation,

h) regular testing and evaluation of the effectiveness of the measures taken and

i) contractual commitment of processors to the same level of protection.

10.2. Notwithstanding all measures, no system is absolutely secure. In the event of a breach of Personal Data protection that may lead to a high risk to the rights and freedoms of Data Subjects, Jobiflow shall inform them without undue delay in accordance with Art. 34 GDPR.

11. RIGHTS OF THE DATA SUBJECT

11.1. In connection with the processing of Personal Data, the Data Subject has the following rights under the GDPR:

11.2. Right of access to Personal Data (Art. 15 GDPR) — The Data Subject has the right to confirmation as to whether Jobiflow processes their Personal Data, and if so, to access it and to information about the purposes of processing, categories of data, recipients, planned retention period, and other circumstances. Upon request, Jobiflow shall provide the Data Subject with a copy of the processed data;

11.3. Right to rectification (Art. 16 GDPR) — The Data Subject has the right to have Jobiflow without undue delay correct inaccurate or complete incomplete Personal Data concerning them. The Data Subject may also correct most data themselves directly in their profile in the electronic system;

11.4. Right to erasure ("right to be forgotten") (Art. 17 GDPR) — The Data Subject has the right to have Jobiflow without undue delay erase Personal Data concerning them if any of the grounds set out in Art. 17 GDPR is met (e.g., the data are no longer necessary for the purpose for which they were obtained, or the Data Subject has withdrawn consent and no other lawful basis exists). This right is not absolute — Jobiflow may continue to process the data if required by law (especially accounting and tax regulations) or if they are necessary for the establishment, exercise, or defense of legal claims;

11.5. Right to restriction of processing (Art. 18 GDPR) — The Data Subject has the right to have Jobiflow restrict the processing of their Personal Data in the cases set out in Art. 18 GDPR (e.g., the Data Subject contests the accuracy of the data — during verification of accuracy);

11.6. Right to data portability (Art. 20 GDPR) — The Data Subject has the right to obtain Personal Data concerning them, which Jobiflow processes on the basis of consent or a contract by automated means, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another controller. Jobiflow undertakes to provide the data in a structured, commonly used and machine-readable format (in particular JSON or CSV) within 30 days from the date of submission of the request;

11.7. Right to object (Art. 21 GDPR) — If Jobiflow processes Personal Data on the basis of a legitimate interest, the Data Subject has the right, on grounds relating to their particular situation, to object at any time to such processing, including profiling. Upon objection, Jobiflow shall cease processing the Personal Data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject. The Data Subject has the right to object at any time to processing for direct marketing purposes, and after such objection Jobiflow shall immediately cease processing Personal Data for marketing purposes;

11.8. Right to withdraw consent (Art. 7(3) GDPR) — If the processing is based on consent, the Data Subject has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent given before its withdrawal. Consent may be withdrawn as easily as it was given — in particular by clicking the link in each marketing e-mail ("unsubscribe") or by contacting Jobiflow;

11.9. Right not to be subject to automated decision-making (Art. 22 GDPR) — The Data Subject has the right not to be subject to a decision based solely on automated processing, including profiling, which would have legal effects or similarly significantly affect them. With the exception of the AI Avatar Interview, which is carried out on the basis of explicit consent with safeguards pursuant to Art. 22(3) GDPR (Art. 9 of the Principles), Jobiflow does not make such decisions against Data Subjects; and

11.10. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — The Data Subject has the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Galvaniho Business Centrum II, Galvaniho 7/B, Bratislava Bratislava, website - https://dataprotection.gov.sk, if they believe that the processing of their Personal Data violates the GDPR or other personal data protection regulations.

12. HOW TO EXERCISE YOUR RIGHTS

12.1. The Data Subject may exercise their rights free of charge:

a) by email at info@jobiflow.com,

b) in writing to the registered office address of Jobiflow specified in Art. 1.1 of the Principles, and

c) through the functionality of the electronic system, if available for the given right (e.g., profile editing, account deletion, unsubscribing from the newsletter).

12.2. Jobiflow will handle the Data Subject's request without undue delay, no later than one (1) month from its receipt. This period may be extended by an additional two (2) months if necessary, taking into account the complexity and number of requests. Jobiflow will inform the Data Subject of any extension and the reasons for it within one month of receiving the request.

12.3. Jobiflow is entitled to request additional information from the Data Subject necessary to verify their identity if there are reasonable doubts about their identity. In the case of manifestly unfounded or excessive requests (especially if repeated), Jobiflow may charge a reasonable fee or refuse the request.

12.4. If the Data Subject was dissatisfied with the handling of the request, they may обратиться to the supervisory authority specified in Art. 11.9 of the Principles.

13. COOKIES AND SIMILAR TECHNOLOGIES

13.1. When using the Jobiflow electronic system, cookies are stored on the Data Subject's device and other similar technologies may also be used. More detailed information about the cookies used, their categories, validity period, providers, and options for granting and withdrawing consent is set out in a separate Cookies Policy document, which forms an integral part of these Principles.

14. OBLIGATION TO PROVIDE PERSONAL DATA

14.1. Providing Personal Data is voluntary in most cases. However, without providing certain data, it is not possible to:

a) create and manage a user account in the electronic system,

b) respond to Advertisements and participate in the Client's selection process,

c) conclude and perform the Service Agreement (for Clients and Influencers), and

d) issue a tax document and fulfill other legal obligations.

14.2. In such cases, providing the data is necessary either for concluding and performing the contract or for fulfilling a legal obligation of Jobiflow. Failure to provide the data will result in the inability to use the affected Services.

14.3. Providing data for marketing purposes and for non-essential cookies is always voluntary and based on the consent of the Data Subject, which may be withdrawn at any time without any negative consequences for the use of the Services.

15. CHANGES AND FINAL PROVISIONS

15.1.       Jobiflow reserves the right to update these Policies at any time, especially in the event of changes to the applicable legal regulations, changes to the Services provided, or changes to the processing activities carried out. We will inform the Data Subjects of material changes to these Policies in an appropriate manner, especially via email or a notice in the electronic system, no later than 14 days before they take effect.

15.2.       Minor adjustments, such as correcting typos, formatting, or clarifying the text without changing its substance, may be made without prior notice.

15.3.       The current version of the Policies is always available in the Jobiflow electronic system.

15.4.       If any provision of these Policies is declared invalid, ineffective, or unenforceable by the competent court or other authority, this shall not affect the validity, effectiveness, and enforceability of the other provisions of the Policies.

15.5.       These Policies are governed by the legal order of the Slovak Republic, in particular Regulation (EU) 2016/679 (GDPR) and Act No. 18/2018 Coll. on the Protection of Personal Data, as amended.

15.6. These Policies are valid and effective as of 25.10.2026.

Jobiflow s. r. o.