INFORMATION ON DATA PROCESSING

Diepeveen & Partners Korlátolt Felelősségű Társaság, seated at 1007 Budapest, Danubius Grand Hotel Margitsziget, (the "Company") is hereby giving you the following information concerning the processing of your personal data as is required under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR), and in particular in line with Article 13 and 14 of the GDPR. See for the official text:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32016R0679.

1. The legal basis for data processing, the personal data processed:

1.1 The processing of CVs: Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to the processing of your personal data based on the content of the present information. Your application can be considered and transferred by us only if you give consent to the processing of your data included in your CV related to the vacant position by the Company, and the transfer of such data. If we do not receive your CV directly from you, but from our principal as possible employer, we inform you about it.

The scope of the processed data: the personal data included in your CV, and if we received your CV from our contractual partner, your strengths and weaknesses, the reasons of the planned change of job, the expectations related to the preferred employment relationship, your wage demand, furthermore, if you provide it to us, the circumstances of your previous job change, information on the actual employment relationship relevant from the aspect of the new employment relationship (e.g. termination period, possible non-compete clause) as well, as personal data.

1.2 Undertaking job interviews: Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to the processing of your personal data based on the content of the present information. Can be considered and transferred by us only if you give consent to the processing of your data included in your CV related to the vacant position by the Company, and the transfer of such data. If we do not receive your CV directly from you, but from our principal as possible employer, we inform you about it.

The scope of the processed data: the personal data included in your CV, and if we received your CV from our contractual partner, your strengths and weaknesses, the reasons of the planned change of job, the expectations related to the preferred employment relationship, your wage demand, furthermore, if you provide it, the circumstances of your previous job change, information on the actual employment relevant from the aspect of the new employment relationship (e.g. termination period, possible non-compete clause) as well, as personal data.

1.3 Transferring job opportunities to you: Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to the processing of your personal data based on the content of the present information.

The scope of the processed data: the personal data included in your CV, and if you indicate such, your wage demand.

1.4 Processing of personal data of contractual contact persons: Pursuant to Article 6 (1) f) of the GDPR the processing of personal data shall be lawful exclusively if and to the extent that the processing is necessary for enforcement of the legitimate interest of the controller or a third party.

If the Company and your employer concluded a contract, the Company processes the following personal data of yours: full name, post, contact information (phone number, e-mail address).

1.5 Maintaining registration regarding jobseekers: Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to the processing of your personal data based on the content of the present information.

The scope of the processed data: your name, the name of your employer, your interest in potential positions, the reasons of the planned change of job, wage demand, furthermore, if you provide it, the circumstances of your previous job change, information on the actual employment relationship relevant from the aspect of the new employment relationship (e.g. termination period, possible non-compete clause).

1.6 Transfer of data to our contractual partners: Pursuant to Article 6 (1) a) of the GDPR the processing of personal data shall be lawful only if and to the extent that you have given consent to the processing of your personal data based on the content of the present information.

The scope of the processed data: the personal data included in your CV, and if we received your CV from our contractual partner, your strengths and weaknesses, the reasons of the planned job change, the expectations related to the preferred employment, and your wage demand, furthermore, if you provide it, the circumstances of your previous job change, information on the actual employment relevant from the aspect of the new employment (e.g. termination period, possible non-compete clause) as well, as personal data.

2. The data controller:

The Company acts as controller of your personal data as listed above.

3. The purpose of processing:

3.1 In respect of Point 1.1 the purpose of data processing is that the Company to be able to review your CV, and contact you related to the consideration and transferring of your application, in order to fill the empty position at our principal as potential employer.

3.2 In respect of Point 1.2 the purpose of the data processing is that we can carry out the job interview, and to transfer the result of it to our principal as the potential employer.

3.3 In respect of Point 1.3 the purpose of the data processing is that we can identify the job opportunities pursuant to the search criteria, and to contact with you in this respect.

3.4 In respect of Point 1.4 the purpose of the data processing is that the Company to be able to keep contact with your employer and perform its obligations pursuant to the contracts concluded with your employer.

3.5 In respect of Point 1.5 the purpose of the data processing is that the Company can maintain an up-to-date registration regarding the jobseekers, and due to this it can provide services with sufficient quality to its clients. It is also the purpose of the data processing that in the case of a sufficient job opportunity, we can inform you about the job opportunity.

3.6 In respect of Point 1.6 the purpose of the data processing is that the Company can transfer your personal data to our contractual partners in order to be able to get to you as many job opportunities as possible.

Automated decision making does not take place.

4. The duration of the data processing:

4.1 In respect of Point 1.1 the data processing takes place until the application process for the given post is closed. If your application is successful and you fill the vacant position, the Company processes the personal data for the above purposes for maximum one year following the performance. If you fill the vacant position but you would like to remain in our registry for avoiding additional administration process in case of possible future job seeking, and you give your consent to process your personal data in respect of Point 1.5, Point 4.5 defines the duration of data processing. If your job application is not accepted, but you give further consent to process your personal data in respect of Point 1.3, Point 4.3 defines the duration of the data processing.

4.2 In respect of Point 1.2 the data processing takes place until the application process for the given position is closed. If your application is successful and you fill the vacant position, the Company processes the personal data for the above purposes for maximum one year following the performance. If you fill the vacant position but you would like to remain in our registry for avoiding additional administration process in case of possible future job seeking, and you give your consent to process your personal data in respect of Point 1.5, Point 4.5 defines the duration of data processing. If your job application is not accepted, but you give further consent to process your personal data in respect of Point 1.3, Point 4.3 defines the duration of the data processing.

4.3 In respect of Point 1.3 the data processing takes place until you withdraw your consent.

4.4 In respect of Point 1.4 we process your data for maximum one year following that you are not the contact person anymore.

4.5 In respect of Point 1.5 the data processing takes place until you withdraw your consent.

4.6. In respect of Point 1.6 the data processing takes place until you withdraw your consent.

5. Storing of data and description of technical and organizational measures applied in order to maintain data safety

Your personal data are stored at the Company's seat (1007 Budapest, Danubius Grand Hotel Margitsziget), and we store it on servers located at Budapest Internet Exchange H-1132 Budapest, Victor Hugo u. 18-22. and on a cloud-based storage.

The Company applies all technical safety measures that can be reasonably expected to store the data in a safe way, not accessible to third parties. The servers of the hosting service provider are protected by 24-hour personal security and are located on the Hungarian internet backbone network.

An IT description of the safety measures, the technical and organizational measures taken to ensure the safety of data follows below: The Company's IT system is protected by continuously maintained firewall protection secured by firewall, virus scanner and spam filter.

The Company protects its electronic devices by password.

We do not store the paper-based CVs.

6. Persons and companies having access to data, data transfers:

At the Company Mr. Frido Diepeveen, the assigned employees of the Company, as well as Teamtailor AB (Team Tailor AB, Östgötagatan 16 , 116 21 Stockholm, represented by Sarah Schuch, account manager) as data processor, IMEX Global Kft. , seat: 2360 Gyál, Vecsési út 94, represented by: Eisenberger Mihály, Managing Director) as system administrator, and UNIQUE IMG Bt. (seat: 9932 Viszák, Fő út 56., represented by: Mr. Adrián László Hajdu) as hosting provider, and Microsoft Inc. as cloud-base hosting provider.

We transfer your personal data in respect of Points 1.1, 1.2, 1.3 to other companies as our principals based on your consent.

We transfer your personal data in respect of Point 1.6 to our contractual partners as recipient based on your consent:

-Astrum Advisory Kft (seat: 1172 Budapest, Forrásmajori utca 138525/135), represented by: Iván Kolb, Managing Director, as sole controller.

-Dr. Éva Tiszeker, sole proprietor, (seat: 1025 Budapest, ŐZGIDA UTCA 15. 9. ajtó), as sole controller.

-S&K Human-Logistics Korlátolt Felelősségű Társaság (seat: 1161 Budapest, Szent Korona utca 16-18. 2. em. 12, represented by: Kiss Attila Zsolt, Managing Director), as sole controller.

In respect of Point 1.4 your data are not transferred to other companies.

7. Your rights in connection with data processing:

In connection with data processing related to employment, you have the following rights:

a) right of access (Article 15 GDPR): You are entitled to obtain from the Company confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the information contained herein.

Per your request, the Company provides a copy of the personal data undergoing processing. For any further copies you request, the Company may charge a reasonable fee based on administrative costs. Where you make the request by electronic means, and unless you request otherwise, the information will be provided in a commonly used electronic form.

b) right to rectification (Article 16 GDPR): You have the right to obtain from the Company without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

c) right to erasure (Article 17 GDPR): You have the right to obtain from the Company the erasure of personal data concerning you without undue delay and the Company shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;

- You object to the processing and there are no overriding legitimate grounds for the processing;

- the personal data have been unlawfully processed;

- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject.

d) right to restriction of processing (Article 18 GDPR): You have the right to obtain from the Company restriction of processing where one of the following applies:

- You contest the accuracy of the personal data, for a period enabling the Company to verify the accuracy of the personal data;

- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;

- the Company no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims or

- You have objected to processing.

e) right to object (Article 21 GDPR): You are entitled to object against the processing of your personal data based on Article 6 (1) f) at any time for reason related to your own position. Considering that the purpose of the data controlling is to keep contact with the contractual contact person (i.e. the performance of the agreement), your personal data will not be deleted as a result of your objection.

f) right to receive information on the above rights (Article 12 GDPR): the Company provides you with information on action taken on your request as per clauses a)-e) above without undue delay and in any event within one month of receipt of your request. The information is provided in a concise, transparent, intelligible and easily accessible form. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. The Company informs you of any such extension within one month of receipt of the request, together with the reasons for the delay.

The information is given free of charge. Where your request is manifestly unfounded or excessive, in particular because of its repetitive character, the Company may either i) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or ii) refuse to act on the request. The Company bears the burden of demonstrating the manifestly unfounded or excessive character of the request.

g) right to lodge a complaint (Article 77 GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of your personal data infringes the GDPR. The complaint can be filed with the National Data Protection and Freedom of Information Authority (NAIH) (address: 1055 Budapest, Falk Miksa utca 9-11; telephone: +36 1 391 1400; fax: +36 1 391 1410; www.naih.hu; ugyfelszolgalat@naih.hu).

h) right to judicial remedy (Article 79 GDPR): You have the right to judicial remedy where you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR. Proceedings against the Company can be brought before the courts of the Member State where the Company has an establishment. Such proceedings may be brought before the courts of the Member State where you have your habitual residence.

i) right to data portability (Article 20 GDPR): You have the right to receive personal data which are processed for the purposes defined in the above Points 3.1-3.3, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Company. Furthermore, you have the right to have the personal data transmitted directly from the Company to another data controller, where technically feasible.

j) right to withdraw consent: you may withdraw your consent provided in respect of the above Points 1.1, 1.2, 1.3, 1.5 and 1.6 at any time, in which case we do not further process your personal data.

8. You may request information on the processing of your personal data via the channels and from the person below:

You may request further information in connection with the processing of your personal data from Mr. Frido Diepeveen, via mail 1007 Budapest, Danubius Grand Hotel Margitsziget) or email (frido.diepeveen@diepeveenpartners.com). Per your request, verbal information may also be given in which case, minutes have to be taken. If you request verbal information (e.g. via phone), you are required to prove your identity towards the Company. If you wish to exercise your rights above, you have to contact Mr. Frido Diepeveen.

I understood the present information and I give my consent to the data processing as defined herein in respect of Points 1.1, 1.2, 1.3, 1.5 and 1.6 in the form attached hereto as Annex.

Dated: Budapest, 29th August 2023

_________________

Diepeveen & Partners Korlátolt Felelősségű Társaság

represented by: Frido Diepeveen Managing Director