Senior Software Engineer (Data)

Privacy Notice for Job Applicants This document serves to inform prospective candidates about how Cosmose Sp. z o.o (hereinafter referred to as "the Company") collects, uses, stores, and protects their personal data during the recruitment process, in compliance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679). 1. Data Controller Information Who we are: - Company Name: Cosmose Sp. z o. o. - Registered Address: Marszałkowska 89 Street, 00 - 693 Warsaw, Poland. - Contact Email for Data Protection Matters: hr@cosmose.co 2. Purpose and Lawful Basis for Processing Your Personal Data. We collect and process your personal data for the following purposes and on the following lawful bases: To manage and conduct the recruitment process for the specific position you have applied for Purpose: To assess your suitability for the role, verify your qualifications and experience, communicate with you regarding your application, arrange interviews, conduct background checks (where legally permissible and relevant), and ultimately make a hiring decision. Lawful Basis: - Article 6(1)(b) GDPR - Performance of a contract or steps prior to entering into a contract: Processing is necessary to take steps at your request prior to entering into an employment contract. This covers data directly related to assessing your fit for the role (e.g., CV details, experience, qualifications). - Article 6(1)(c) GDPR - Compliance with a legal obligation: Where we are required by law to process certain information (e.g., right to work checks, certain background checks for specific industries). - Article 6(1)(f) GDPR - Legitimate Interests: For certain processing activities that are not strictly necessary for contract formation but are fundamental to the recruitment process and do not override your rights and freedoms (e.g., ensuring internal consistency in hiring, preventing fraud). To maintain a talent pool for future recruitment opportunities (if you provide consent): Purpose: To consider your application for other suitable vacancies that may arise within the Company in the future. Lawful Basis: Article 6(1)(a) GDPR - Consent: This processing is based on your explicit and voluntary consent To comply with legal, regulatory, or ethical obligations: Purpose: To ensure compliance with relevant laws (e.g., anti-discrimination laws, health and safety regulations), respond to legal requests, or manage and defend legal claims. Lawful Basis: Article 6(1)(c) GDPR - Compliance with a legal obligation or Article 6(1)(f) GDPR - Legitimate Interests (for legal claims defense). 3. Categories of Personal Data We Collect We may collect and process various types of personal data about you during the recruitment process, including but not limited to: Identification and Contact Details: Name, address, email address, phone number. Application Information: CV/resume, cover letter, application form details, previous employment history, educational qualifications, skills, professional licenses/certifications. Interview and Assessment Data: Notes from interviews, results of skills tests, and presentations you provide. Background Check Information (where applicable and with your knowledge/consent): References (contact details of referees, feedback from referees), eligibility to work in the European Union, criminal record checks (only if legally required and relevant for the position). Publicly Available Information: Information from professional networking sites (e.g., LinkedIn) or other publicly accessible sources, if relevant to the role and for recruitment purposes. Special Categories of Personal Data (Sensitive Data): We generally do not seek sensitive personal data (e.g., racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life, sexual orientation). However, in some limited cases, and where permitted or required by law, we may collect such data for: Diversity and Equal Opportunities Monitoring: If collected, this data will be aggregated and anonymised for statistical purposes only, and your participation is entirely voluntary. Accommodations: Information about health or disability may be collected to assess reasonable accommodations for the recruitment process or for the role, with your explicit consent or where legally required. Lawful Basis for Special Categories of Data: Article 9(2)(a) GDPR - Explicit Consent or Article 9(2)(b) GDPR - Employment, social security and social protection law or Article 9(2)(g) GDPR - Reasons of substantial public interest. 4. Source of Your Personal Data We collect personal data directly from you when you apply for a position. We may also collect data from: Recruitment agencies or headhunters (if you apply through them). Former employers or referees (with your consent, typically after an offer is extended). Professional networking sites (e.g., LinkedIn) and other publicly accessible sources. 5. Recipients of Your Personal Data Your personal data may be shared with: Internal Personnel: Relevant employees within the Company involved in the recruitment process (e.g., HR team, hiring managers, interview panel members). Third-Party Service Providers: Recruitment software providers (Applicant Tracking Systems - ATS). Background check providers (if applicable). IT service providers (for data storage and system maintenance). Recruitment agencies (if you applied through one, or if we use them for sourcing). Legal and Regulatory Authorities: Where required by law or necessary to protect our legal rights (e.g., law enforcement, courts). Note: All third-party service providers acting as Data Processors are contractually bound by Data Processing Agreements (DPAs) to process your data securely and in accordance with GDPR. 6. International Data Transfers Your personal data may be transferred to and stored at a destination outside the European Economic Area (EEA) if any of our service providers or affiliates are located outside the EEA. In such cases, we ensure that appropriate safeguards are in place to protect your data, such as: Standard Contractual Clauses (SCCs) approved by the European Commission. Binding Corporate Rules (BCRs). Adequacy decisions by the European Commission. 7. Data Retention We will retain your personal data for no longer than is necessary for the purposes for which it was collected. For the current recruitment process: If your application is unsuccessful, we will typically retain your data for a period of 12 months after the recruitment process has concluded. This period allows us to handle any potential queries, demonstrate compliance, or consider you for similar roles that may open shortly after. For future recruitment opportunities (Talent Pool): If you have provided explicit consent for us to keep your data for future recruitment, we will retain your data for a period of 24 months from the date of your consent. You have the right to withdraw this consent at any time. Successful Candidates: If your application is successful, your recruitment data will become part of your employee record and will be processed according to our internal Employee Privacy Policy. 8. Your Rights as a Data Subject Under GDPR, you have the following rights concerning your personal data: Right to be informed: To know how your data is being processed (this Privacy Notice serves this purpose). Right of access: To request a copy of the personal data we hold about you. Right to rectification: To request that inaccurate or incomplete data be corrected. Right to erasure ("right to be forgotten"): To request the deletion of your personal data, under certain circumstances. Right to restriction of processing: To request that we limit the way we use your data, under certain circumstances. Right to data portability: To receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller. Right to object: To object to the processing of your personal data based on legitimate interests or for direct marketing. Right to withdraw consent: Where we rely on your consent for processing, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on consent before its withdrawal. Right to lodge a complaint: To lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes GDPR. The supervisory authority in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych - UODO), ul. Stawki 2, 00-193 Warszawa. To exercise any of these rights, please contact us using the details provided in Section 1. 9. Automated Decision-Making and Profiling We do not use automated decision-making processes, including profiling, that would produce legal effects concerning you or similarly significantly affect you during the recruitment process. 10. Changes to This Privacy Notice We may update this Privacy Notice from time to time. Any changes will be posted on our website, and where appropriate, notified to you directly.

I explicitly consent to Cosmose retaining my application documents and personal data for a period of 24 months from the date of this application. This is for the sole purpose of considering me for other future recruitment opportunities within Cosmose. I understand this consent is voluntary and does not impact my current application. I also understand that I can withdraw this consent at any time, as detailed in the Privacy Notice.