CANDIDATE PRIVACY NOTICE

Version 1.0 · Effective 2 November 2026

Who is responsible for your data

The controller of your personal data is ECOFACTOR Sp. z o.o., ul. Składowa 30, 41-500 Chorzów, Poland, KRS 0000962167, NIP 8792738397.

Contact for data protection matters: info@ecofactor.eu or by post to the address above, marked “Data protection — recruitment”. We have not appointed a data protection officer, because the law does not require it for our activities.

This notice applies to recruitment for roles at ECOFACTOR Sp. z o.o. If a job advertisement states that the employer is ECOFACTOR TECH UK LIMITED (United Kingdom) or ТОВ «ЗАРЯДНІ МЕРЕЖІ» (Ukraine), that company is the controller and its own candidate notice applies.

What data we process and why

Purpose	Data	Legal basis
Recruitment for employment under an employment contract	Name(s) and surname, date of birth, contact details you provide, and — where necessary for the role — education, professional qualifications and employment history	Art. 6(1)(c) GDPR in connection with art. 22¹ § 1 of the Polish Labour Code (Act of 26 June 1974 — Kodeks pracy)
Recruitment for employment — other data you provide in your CV or application (for example photo, interests, links to professional profiles)	Data you decide to provide beyond the list above	Art. 6(1)(a) GDPR in connection with art. 22¹ᵃ of the Labour Code — your consent, which you express by sending such data
Special categories of data you provide on your own initiative (for example health information relevant to workplace adjustments)	Data you decide to provide	Art. 9(2)(a) GDPR in connection with art. 22¹ᵇ of the Labour Code — your explicit consent
Recruitment for cooperation under a civil-law or B2B contract	Data needed to assess your application and prepare the contract	Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract
Future recruitment processes (optional)	Data in your application	Art. 6(1)(a) GDPR — your separate consent
Establishing, exercising or defending legal claims connected with the recruitment	Data from the recruitment process	Art. 6(1)(f) GDPR — our legitimate interest in protecting our rights

Please do not include in your application data about criminal convictions or offences, and do not include special categories of data (for example health, religion, political views) unless you consider it necessary. Data about third persons (for example referees) should be provided only with their knowledge.

Optional consents

Consents are voluntary. Not giving them, or withdrawing them, does not affect your participation in the current recruitment. If you apply through a form, each consent is a separate, unticked checkbox. If you apply by e-mail, you may include the relevant wording in your application.

Consent to processing for future recruitment processes: “I consent to ECOFACTOR Sp. z o.o., with its registered office in Chorzów, processing my personal data contained in my application documents for the purposes of future recruitment processes for a period of 12 months.”

Consent to processing of data beyond the statutory scope (where you provide such data): “I consent to ECOFACTOR Sp. z o.o., with its registered office in Chorzów, processing personal data contained in my application documents beyond the scope set out in art. 22¹ § 1 of the Labour Code, for the purposes of the current recruitment process.”

Explicit consent to processing of special categories of data (only if you provide them on your own initiative): “I give my explicit consent to ECOFACTOR Sp. z o.o., with its registered office in Chorzów, processing the special categories of personal data I have included in my application documents on my own initiative, for the purposes of the current recruitment process.”

You may withdraw any consent at any time by writing to info@ecofactor.eu. Withdrawal does not affect the lawfulness of processing before it.

Pay transparency and fair recruitment

• We inform candidates of the starting salary or its range for the role, in the job advertisement or before the interview, and in any case before an employment contract is concluded, in line with art. 18³ᶜᵃ of the Labour Code, which applies from 24.12.2025.
• We do not ask candidates about their current or previous pay.
• Our job advertisements and job titles are gender-neutral, and our recruitment is carried out in a non-discriminatory way.

Who we share your data with

Your data is accessible only to persons involved in the recruitment. We may share it with:

• service providers acting on our behalf under data processing agreements: Microsoft Ireland Operations Limited (e-mail, documents and video meetings — Microsoft 365) and IT support providers;
• a recruitment agency, where we use one for a given recruitment;
• other companies operating under the ECOFACTOR brand, where managers or specialists from those companies take part in the recruitment (for example ТОВ «ЗАРЯДНІ МЕРЕЖІ» for roles in research and development);
• public authorities, where required by law.

If you apply through a job portal (for example LinkedIn or a Polish job board), the portal operator processes your account data as a separate controller under its own policy.

Transfers outside the European Economic Area

Where a recipient is located outside the EEA, we ensure appropriate safeguards: for the United Kingdom, the European Commission’s adequacy decision (art. 45 GDPR); for Ukraine, which has no adequacy decision, standard contractual clauses adopted by the European Commission (art. 46(2)(c) GDPR); for other countries, an adequacy decision or standard contractual clauses. You can obtain a copy of the safeguards by writing to info@ecofactor.eu.

How long we keep your data

• Data processed for the current recruitment: until the end of the recruitment process (selection of a candidate or closure of the process), after which it is deleted, unless it is needed for legal claims.
• Data processed with your consent for future recruitments: for 12 months or until you withdraw consent, whichever is earlier.
• Data needed for legal claims: until the claims are finally resolved or time-barred.
• If you are hired, your application documents become part of your personnel records and are kept in accordance with labour law.

Your rights

You have the right to access your data, to rectification, erasure, restriction of processing and data portability (arts. 15–18 and 20 GDPR), and to withdraw consent at any time. Where we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation (art. 21 GDPR).

To exercise your rights, write to info@ecofactor.eu. We will respond within one month; in complex cases this period may be extended by up to two further months.

Right to lodge a complaint

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, Prezes UODO), ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl, or with the supervisory authority in the EU country where you live or work.

Is providing data required

For employment, providing the data listed in art. 22¹ § 1 of the Labour Code is required for you to take part in the recruitment. Providing other data is voluntary. For civil-law or B2B cooperation, providing data is voluntary but necessary to consider your application.

Automated decision-making

We do not make recruitment decisions based solely on automated processing, including profiling. Every decision is taken by people.

Changes to this notice

We may update this notice. The current version and its effective date are available at the address above.

Language versions

This notice is published in English and Polish. For candidates in Poland the Polish version prevails.

Document control

Version 1.0 · Effective 2 November 2026 · Owner: Legal (in-house) · Approved by: Management Board of ECOFACTOR Sp. z o.o.