PROPORTIONALITY TEST

Assessment of legitimate interest as the legal basis for the processing of personal data pursuant to Art. 6(1)(f) GDPR

Controller: Jobiflow s. r. o., Company ID: 57 430 501, Dlhé Nivy 420/90, 019 01 Ilava

Date of preparation: 24/4/2026

Version: 1.2

Responsible: Bc. Matúš Jackulík, MBA

Purpose of the document

This document documents the assessment of legitimate interest (legitimate interest assessment, LIA) pursuant to Art. 6(1)(f) of Regulation (EU) 2016/679 (hereinafter only „GDPR“) as the legal basis for the processing of personal data by the controller Jobiflow s. r. o. The document serves to demonstrate compliance with GDPR requirements in the event of a request by the data subject pursuant to Art. 21 GDPR (objection) or an inspection by the Office for Personal Data Protection of the Slovak Republic.

The document is an internal document of Jobiflow. It is disclosed only to the extent necessary to handle the request of the data subject or at the request of the supervisory authority. The document is subject to regular review at least once a year and whenever there is any change in the processing activity.

Test methodology

In accordance with the guidelines of the European Data Protection Board (EDPB) and the WP29 Working Party (Opinion No. 06/2014), the proportionality test is carried out for each processing activity based on legitimate interest in three steps:

• Step 1 – Purpose test: Is Jobiflow's interest genuinely legitimate? Is it specifically articulated, lawful, and real?
• Step 2 – Necessity test: Is the processing necessary to achieve the purpose? Is there a less intrusive way?
• Step 3 – Balancing test: Does Jobiflow's legitimate interest outweigh the interests, rights, and freedoms of the data subjects?

If the test passes all three steps, the legitimate interest is a valid legal basis for processing. If any step fails, another legal basis must be chosen (especially consent) or the processing must be abandoned.

List of assessed processing activities

Based on Art. 5 of the Principles of Personal Data Processing, Jobiflow carries out the proportionality test for the following processing activities, for which the legal basis is legitimate interest pursuant to Art. 6(1)(f) GDPR:

• Test No. 1 – Making the Candidate's profile available to the Client and managing responses to Ads
• Test No. 2 – Operation, security, and protection of the electronic system against attacks
• Test No. 3 – Statistics and usage analysis (aggregated data)
• Test No. 4 – Marketing communication towards Clients (soft opt-in)
• Test No. 5 – Assertion and defence of legal claims.

The AI Avatar Interview is not the subject of this test, because it is not based on a legitimate interest under Article 6(1)(f) GDPR, but on the applicant's explicit consent under Article 6(1)(a) and Article 22(2)(c) GDPR. A separate data protection impact assessment (DPIA) under Article 35 GDPR was carried out for the AI Avatar Interview, which forms a separate Jobiflow document

Test No. 1 – Making the Applicant's profile available to the Client

STEP 1: Purpose test

What is the interest of Jobiflow and the Client? The interest is to enable the Client, as a potential employer, to assess the Applicant's response to a specific Advertisement and decide on the next steps in the selection process. Without access to the profile, the Client would not be able to consider the Applicant's response, and the entire recruitment process would be impossible.

Is the interest lawful? Yes. Intermediation of job offers is a legitimate economic activity regulated in particular by Act No. 5/2004 Coll. on Employment Services. At the same time, it is an exercise of the freedom to conduct a business under Article 16 of the EU Charter of Fundamental Rights.

Is the interest specific and real? Yes. It is an identifiable activity carried out with each response of the Applicant to an Advertisement. It is not a hypothetical or speculative interest.

Conclusion of step 1: The purpose test is satisfied.

STEP 2: Necessity test

Is making the profile available necessary to achieve the purpose? Yes. Without making at least basic data from the profile and CV available, the Client cannot assess the Applicant's suitability. This is the minimum necessary scope of data for fulfilling the platform's function as an intermediary of job offers.

Is there a less intrusive alternative? Not practically. An alternative would be to ask the Applicant for separate consent each time they respond. However, this approach: (a) would not correspond to the Applicant's expectations, as they created the profile precisely for the purpose of applying for jobs, (b) would be unnecessarily complicated and would create unnecessary friction in the recruitment process, (c) would not gain anything additional from a data protection perspective — the same data would still be made available.

Data minimisation: Only the data that the Applicant voluntarily provided in their profile or CV are made available to the Client. The Applicant has full control over which data they disclose in the profile.

Conclusion of step 2: The necessity test is satisfied.

STEP 3: Balancing test

Nature of the data

Common personal data (contact and identification data, CV). It does not include special categories under Article 9 GDPR (unless the Applicant themselves includes them in the profile/CV, which they do voluntarily and at their own responsibility under Article 4.7 of the Processing Principles).

Reasonable expectations of the data subject

High. The applicant registers on the platform with the explicit purpose of applying for a job and knows that when responding to an Advertisement, their profile will be made available to the employer. This fact is transparently stated in the Data Processing Principles, during registration, and when submitting the response itself. The processing fully corresponds to the expectations of a reasonably informed person.

Potential impact on data subjects

Positive or neutral. The applicant gains the opportunity to apply for the offered position, which is their primary goal on the platform. Negative impact (e.g., disclosure of data that the Applicant did not want to share) is minimized by the fact that the Applicant has full control over the content of their profile.

Safeguards implemented by Jobiflow

• Access to the Applicant's profile is granted exclusively to the Client who owns the Advertisement to which the Applicant responded (not all Clients).
• The Applicant may modify, deactivate, or delete their profile at any time.
• The Applicant has the right to object under Art. 21 GDPR — in such a case, Jobiflow shall, without undue delay, assess the grounds for the objection and terminate the processing unless it demonstrates compelling legitimate grounds.
• Clients are contractually bound (through the Terms and Conditions and the Personal Data Processing Terms) to the same level of protection.
• Pseudonymization and encryption of data in accordance with Art. 32 GDPR.
• The retention period is limited to 3 years from the Applicant's last activity.

TEST RESULT 1: The legitimate interest of Jobiflow and the Client outweighs the interests, rights, and freedoms of the data subjects. Processing on the basis of legitimate interest under Art. 6(1)(f) GDPR is permissible.

Test No. 2 – Operation, security, and protection of the system

STEP 1: Purpose test

Jobiflow's interest: To ensure network and information security of the Electronic System, protect the data of all users against attacks, ensure the continuous availability of the Service, and fulfill obligations under Art. 32 GDPR (“security of processing”). Processing of data for these purposes is expressly identified as a legitimate interest in Recital 49 of the GDPR.

Conclusion of step 1: The purpose test is satisfied.

STEP 2: Necessity test

Without processing these data it is not possible to: (a) identify the source of attacks and block them, (b) respond to security incidents in real time, (c) fulfill the obligation to notify personal data breaches to the supervisory authority within 72 hours under Art. 33 GDPR, (d) investigate suspicious activity on accounts. The alternative — not processing these data at all — would make it impossible to protect the data subjects themselves.

Conclusion of step 2: The necessity test is satisfied.

STEP 3: Balancing Test

Reasonable expectations

High. Every informed user expects the platform to implement basic security measures, including logging and monitoring.

Safeguards

• Access to logs is restricted to selected IT / security team employees.
• Retention period maximum 12 months.
• Logs are not used for other purposes (marketing, profiling) — only for security and operations.
• Pseudonymization, encryption at rest and in transit.

RESULT OF TEST 3: The legitimate interest in security clearly prevails. Processing is permissible.

Test No. 3 – Statistics and usage analysis

STEP 1: Purpose test

Jobiflow's interest: To improve the product based on data, make informed decisions about development, and eliminate user experience issues.

Conclusion of step 1: Met.

STEP 2: Necessity test

Necessity: For aggregated statistics, processing is necessary, but with an emphasis on minimization. Where possible, anonymization is used (IP masking, shortening identifiers).

Conclusion of step 2: Met with emphasis on anonymization.

STEP 3: Balancing Test

Impact on data subjects: Minimal. Data are processed in aggregated form, individual persons are not identifiable.

Guarantees

• IP masking / anonymization, where possible.
• For analytical cookies (Google Analytics, Microsoft Clarity) — processing only with the user's consent.
• Retention period of up to 13 months in accordance with industry standards.

TEST RESULT 4: For internal aggregated statistics, legitimate interest prevails. For third-party cookies, consent is used.

Test No. 4 – Marketing communication towards Clients (soft opt-in)

STEP 1: Purpose test

Jobiflow's interest: Maintaining a business relationship with existing Clients, informing them about new features and improvements to the platform that they can use in their HR process, and increasing their engagement and loyalty (upselling and cross-selling).

Legality: Section 116(16) of Act No. 452/2021 Coll. expressly permits “soft opt-in” direct marketing to existing customers without their consent, if the statutory conditions are met. Recital 47 of the GDPR expressly identifies direct marketing as a legitimate interest.

Conclusion of step 1: Met.

STEP 2: Necessity test

Alternative: An alternative is explicit opt-in consent. The soft opt-in regime is justified because: (a) when concluding the contract, the Client had a reasonable expectation that they would be informed about their product, (b) it is a direct extension of contract performance, (c) a simple unsubscribe in every e-mail ensures the data subject's control.

Conclusion of step 2: Met.

STEP 3: Balancing test

Cumulative conditions of soft opt-in that Jobiflow must comply with

• The e-mail was obtained in connection with the sale of the Service to the Client.
• The marketing communication relates exclusively to Jobiflow's own similar products/services.
• When the e-mail was obtained, the Client was informed about marketing use and was given the option to refuse.
• In each individual message there is a simple and free unsubscribe option (unsubscribe link).

Impact on data subjects

Low. This is B2B communication to persons who already have an active business relationship with Jobiflow. It does not come into contact with sensitive data or sensitive aspects of private life.

Safeguards

• Unsubscribe link in every e-mail.
• Maintaining a suppression list — after unsubscribing, the Client is no longer contacted.
• Segmentation by Client type — the newsletter concerns relevant topics.
• No marketing towards Clients who explicitly رفض marketing communication when registering.
• Maximum frequency — 2 e-mail notifications per month.

RESULT OF TEST 5: Provided that all cumulative soft opt-in conditions are met, legitimate interest prevails. Warning: soft opt-in does not apply to Applicants (natural persons who do not have a contract with Jobiflow) — explicit consent under Article 6(1)(a) GDPR is required for marketing outreach to them.

Test no. 5 – Exercising and defending legal claims

STEP 1: Purpose test

Interest: The ability to defend against unjustified claims by third parties and to enforce its own claims. Without the ability to retain evidentiary materials, Jobiflow could not effectively protect its rights or the rights of its customers.

Conclusion of step 1: Met.

STEP 2: Necessity test

Necessity: Without retaining relevant data, Jobiflow would not be able to prove its position in the event of a dispute. An alternative would be immediate deletion of data after the contract ends, which, however, would make defence within the limitation period impossible.

Conclusion of step 2: Met.

STEP 3: Balancing test

Reasonable expectations: Medium-high. The informed user expects that contractual data and communication are retained for a certain time even after the contract ends.

Guarantees

• Data in this mode are processed in a limited manner — only for assertion/defense, not for other purposes (not marketing, not profiling).
• The retention period is limited to the limitation period for specific claims (in commercial relations usually 4 years under Section 397 of the Commercial Code; for general claims 3 years under Section 101 of the Civil Code).
• After the final conclusion of the dispute and expiry of the limitation period, the data are securely destroyed.
• Access to data in this mode is limited to a restricted group of persons (legal department, management, authorized legal advisers).

TEST RESULT 6: The legitimate interest in defending legal claims prevails. Processing is permissible within the limitation period for specific claims.

Overall conclusion of the proportionality test

Based on the proportionality tests performed, it is concluded that the legitimate interest under Article 6(1)(f) GDPR is a valid and appropriate legal basis for the following Jobiflow processing activities:

• Test 1 – making the Candidate's profile available to the Client — PASSED
• Test 2 – operation and security of the system — PASSED
• Test 3 – statistics and analysis — PASSED for internal metrics; consent for third-party cookies
• Test 4 – marketing towards Clients (soft opt-in) — PASSED subject to compliance with cumulative conditions
• Test 5 – defense of legal claims — PASSED

Jobiflow obligations in connection with this test

• Disclose in the Personal Data Processing Policy all relevant information about processing based on legitimate interest, including the possibility to object under Article 21 GDPR. Fulfilled (Art. 11.6 of the Policy).
• Allow data subjects to easily object to processing. Fulfilled via contact emails.
• Retain this document and provide it upon request of the supervisory authority or the data subject (to the relevant extent).
• Review this document at least once a year and whenever there is any change in the processing activity, any expansion of AI functions, any change in legislation, or any EDPB/UOOU decision relevant to any of the tests.
• Upon a request to object under Article 21 GDPR, without undue delay assess the grounds of the objection and either cease processing or provide written evidence of compelling legitimate grounds that override the interests of the data subject.

Revision history

Jobiflow s. r. o.