Information about the controller of your personal data

Notch Software Solutions d.o.o.
Ulica Republike Austrije 33
PIN (OIB): 99895959831
You may contact the controller at any time at: [email protected].

How the controller collects, uses and shares your personal data

In this Privacy Policy you can find useful information about your rights according to GDPR, i.e. General Data Protection Regulation (REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on
the free movement of such data, and repealing Directive 95/46/EC).

This Policy applies to:

• individuals applying for a job with us,
• our business partners and external collaborators, and
• anyone contacting us in any capacity.

We are committed to protecting your personal data and ensuring transparency in all data processing activities.
Please read the following carefully to understand how we collect, use, and protect your personal data.
We keep your personal data confidential and handle it in accordance with the principles of the GDPR. This means we collect only the personal data that is necessary, retain it only for as long as needed (as specified in each category), and process it in a lawful, fair, and transparent manner. We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized access, including through cyberattacks, and to prevent accidental or unlawful disclosure in the event of a personal data breach. Personal data is stored in an identifiable form only for as long as necessary to fulfil the specific, explicitly stated and legitimate purpose for which it was collected, in line with the principle of storage limitation. If certain data ceases to be accurate, it will be rectified or erased without undue delay.

Processing your personal data

Here you can find legal grounds for your personal data processing, as well as examples of some typical situations:

1. Your Explicit Consent

We process your data when you have given us your clear and informed consent to do so.
Example: When you agree to be contacted for employment-related purposes or future events in accordance with this policy.

2. Contractual Necessity and Legal Obligations

We process your personal data when it is necessary:

• to perform a contract to which you are a party, or
• to take steps at your request prior to entering such a contract, or
• to comply with legal obligations

Example: Assessing your job application as part of a recruitment process or processing your inquiry regarding a potential collaboration that may lead to a contractual relationship.

3. Legitimate interest
We may process your data where it is necessary for our legitimate interests, provided those interests are not overridden by your rights and freedoms. Example: Contacting you for feedback, sending newsletters, informing you about follow-up projects or offers, or responding to your inquiry.
We use your personal data for the following purposes:
Managing client relationships and handling inquiries
If you submit a general inquiry, we will process your personal data for the purpose of responding to your request, based on our legitimate interest in ensuring effective communication and addressing requests from individuals who actively seek information about our services, business, or activities. Your data will be retained no longer than necessary to fully resolve your inquiry.
If your inquiry relates to a potential collaboration or business relationship, we will process your personal data for the purpose of initiating such cooperation, based on the legal ground of taking steps at your request prior to entering into a contract; Should a business relationship be established, we will process your personal data for the purpose of executing and maintaining that relationship, based on the performance of a contract. We will retain your data for the duration of the cooperation and, where necessary, for a longer period to comply with our legal obligations as a data controller.

In this case, we process the following personal data: first name, last name, phone number, email address, where provided, information about your project, as well as any other personal data you may choose to provide as part of your inquiry.

Promotion and marketing

We may use your personal data to send you newsletters and keep you informed about our latest services, offers, or updates that we believe may be useful or of interest to you. This processing is based on our legitimate interest in maintaining contact with our clients and contacts and in developing our business in a meaningful way. You can opt out of receiving these emails at any time by clicking the “unsubscribe” link in any message or by contacting us at [email protected]. Opting out will not affect the lawfulness of any communications or processing carried out prior to your withdrawal.
For this purpose, we process your first name, last name, and email address, until you opt out, but no longer than 2 years

Improving our services by conducting survey and gathering insights

We may occasionally contact you to take part in online surveys to share your feedback about your experience with Notch. The purpose of these surveys is to better understand your needs and continuously improve the quality and usefulness of our services.
Surveys are conducted by sending a link to your email address, which leads directly to the questionnaire.
Participation is completely voluntary, and you are never obliged to respond. You can opt out of receiving future survey invitations at any time via the same link used to
access the survey.
This processing is based on our legitimate interest in enhancing our products, services, and overall customer experience.
For this purpose, we process your first name, last name, and email address, until you opt out, but no longer than 2 years.

Recruiting staff
In principle, our job applicants apply via our Careers portal, but even in case they send a job application via e-mail or in another way, this policy shall apply accordingly.
When you submit your personal data for employment purposes, we will use them solely for the recruitment process.

If you submit your personal data in response to a job posting, the processing is based on the legal ground of taking steps at your request before entering into a contract.
If you submit an open application, we process your personal data based on your consent, as you are voluntarily providing this information.
In both cases, the purpose of processing is the execution of the recruitment and selection process.
If your profile does not fully match the role you applied for, we may also assess whether your qualifications are suitable for other positions within our organization.
We will retain your personal data until the recruitment process is completed, after which it will be deleted.
If you submitted an open application, your data will be retained for a maximum of six months, as there is no active job opening at the time of submission. We will review your application to see whether a position matching your qualifications can be identified, even if we are not officially recruiting at the time. While we will do our best to consider your application, we cannot guarantee that a suitable position will be available.
To carry out the recruitment process, we will collect your identification and contact data (first name, last name, email address) and the content of your application, including information from your CV and, if provided, your cover letter. This may include details about your education, work experience, qualifications, and a photo if attached.
If you provide your explicit consent, we may retain your data for up to two years after the recruitment process concludes. If a career opportunity that matches your profile opens during that period, we’ll inform you.
You can withdraw your consent at any time by sending an email to [email protected].
Withdrawing consent does not affect the lawfulness of processing carried out prior to your withdrawal.

Event organization
If you are not selected for a current job opportunity, we may ask for your explicit consent to retain your personal data, specifically your first name, last name, email address, and CV, for the purpose of inviting you to future events such as workshops, networking sessions, or employer branding activities.
We will retain and use this data for a maximum period of two years and solely for this purpose, if you have given your clear and informed consent. You may withdraw your consent at any time by sending an email to [email protected], in which case we will no longer use your data for this purpose.

Where we store your data and who do we share your data with

Your personal data is disclosed to our employees and associates only on a need-to- know basis who require it for the performance of their job duties, including but not limited to areas such as human resources, legal and finance, IT and network security, internal administration, and compliance.
To provide our services at the highest possible level, we also collaborate with carefully selected external partners and make use of their tools and platforms. As a result, your personal data may be shared with the following categories of external recipients:

• Service providers – including companies that offer website hosting, IT support, communication tools, marketing platforms, analytics services, and other technology solutions essential for operating, maintaining, and improving our services.
• Professional advisors – such as accountants, auditors, legal counsel, and other consultants engaged by us, all of whom are bound by professional and contractual confidentiality obligations.
• Public authorities and regulatory bodies – where disclosure is required by applicable laws, regulations, or as part of legal proceedings.

Data transfers to third countries

We pay a lot of attention to localizing most of our data processing within EU territory, as in respect of the dominant role of the EU-based company entity regarding data processing operations, but also in respect to the choice of entities we collaborate with.
However, some of our third-party tools are provided by service providers based outside the EU or EU-based companies that share data with their affiliates seated outside of the EU. According to GDPR, a transfer of personal data to a third country or an international organization may take place where that third country, or the international organization in question, ensures an adequate level of protection. Also, there are countries that are still not covered with adequacy decisions. In such cases, according to GDPR, we transfer your data providing appropriate additional safeguards, such as standard contractual clauses.

Upon request, you can obtain information about data transfers performed to any third country. We have considered all elements of such relationships and took care that our partners implement appropriate safeguards including appropriate technical and organizational measures.

For more information about data transfers, including the specific recipients of personal data, please contact us at [email protected].

Your rights
1. GDPR Article 15 – Right of access: you have the right to obtain confirmation as to whether personal data concerning you is being processed. If such data is being processed, you have the right to access it and receive the following information: purposes of the processing; categories of personal data concerned; recipients or categories of recipients to whom your personal data has been or will be disclosed, etc.
2. GDPR Article 16 – Right to rectification: you have the right to have incorrect personal information rectified and incomplete personal information amended, in which case we are under obligation to fulfil your request without unnecessary delay
3. GDPR Article 17 – Right to Erasure: This is also known as the ‘right to be forgotten’ and allows you to request the deletion or removal of your personal data when there is no compelling reason for us to continue processing it.
Please note that this is not an absolute right, and certain legal exceptions may apply.
4. GDPR Article 18 – Right to restriction of processing: You have the right to request that we limit the way we use your personal data. When processing is restricted, we may continue to store your data, but we will not use it for any other purposes.
5. GDPR Article 20 – Right to data portability: you have the right to request the transfer of your personal data to another data controller, where the processing is based on your consent or on the performance of a contract to which you are a party, and where the processing is carried out by automated means. This right applies only where the transfer is technically feasible.

6. GDPR Article 21 – Right to object: in certain circumstances, you can object to the processing of your personal data. E.g., if you don’t agree with processing for the purposes of direct marketing based on our legitimate interest, let us know.
7. GDPR Article 22 – Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects
on you: this is just a legal possibility – we won’t be deciding on your rights based on automated processing.
If data was collected based on your consent, you can withdraw consent at any

time without affecting the lawfulness of processing based on consent before its withdrawal.
For more information and for executing your rights, please contact us at [email protected].
Although the provision of your personal data is not required by law, it is necessary for us to take certain actions at your request (e.g. entering into an employment contract
following your open application) or to fulfill our contractual obligations. You are not legally obliged to provide this data. However, if you choose not to, we may be unable
to proceed with the intended services or agreement.