At Tesco we are looking after the personal data you share with us is hugely important. We want you to be confident that your data is safe and secure with us, and understand how we use it. 1. What this policy covers The Data Controller of your personal data is TESCO-BST Üzleti és Technológiai Szolgáltatások Zrt, Address: 1138 Budapest, Váci út 187., Company tax ID: 26641494-2-41 Company register number: 01-10-140160 referred to in this policy as “we", “us" or “TBS"). We are committed to doing the right thing when it comes to how we collect, use and protect your personal data. That’s why we’ve developed this privacy policy (“Policy"), which: • sets out the types of personal data that we collect; • explains how and why we collect and use your personal data; • explains how long we keep your personal data for; • explains when and why we will share personal data within Tesco Group and with other organisations; • sets out the legal basis we have for using your personal data; • explains the rights and choices you have when it comes to your personal data; and • explains how we may contact you and how you can contact us. We process your personal data in accordance with the EU (2016/679) General Data Protection Regulation (“GDPR") as well as with other applicable data protection regulations that supplements and/or implements GDPR. 2. What personal data do we collect about you? We collect the information necessary to be able to find available opportunities and further information needed to assess your eligibility through the various stages of the recruitment process. This includes personal information such as name, title, addresses, telephone numbers and personal email addresses, date of birth, recruitment information (including copies of work permission documentation, references and other information included in a CV or cover letter or as part of the recruitment process), details contained in letters of application and resume/CV (including previous employment or work background; education history; professional qualifications; professional memberships; interests; language and other relevant skills; certificates and certification expiration dates) project assignments and time spent on assignments; skills and experience; development programmes planned and attended; willingness to relocate, current salary information, educational records, work history references, results of any tests, including psychometric tests we carry out during the recruitment process), feedback from interviewers and assessors and notes taken during interview. does not routinely require a photograph during the application process; should you choose to include a photograph on your CV, TBS will process this on the same basis as your CV. All personal data will be stored in our recruitment system HR Link. 3. How and why we use your personal data? We use your personal data to match your skills, experience and education with a potential position within TBS. 4. How long do we keep your personal data for? We will not keep your personal data longer than we need to, how long this is depend on several factors, including: 1. Why we collected it in the first place; 2. How old it is; 3. Whether there is a legal/regulatory reason for us to keep it; 4. Whether we need it to protect you or us. Your personal data is shared with the hiring manager who initiates a search for personnel, to ascertain if you are a good fit for the available position. 5. Who we will share your personal data with? We may share your personal data with: • Suppliers, service providers and partners who work with us and provide administration and support services. For example in conducting right to work checks, candidate screening/assessment and, if applicable criminal background checks; • Other group companies, who provide us with administration and support services; including TESCO-GLOBAL Áruházak Zrt., as data processor; • Government agencies, regulatory bodies and law enforcement agencies where we are obliged to by law; • Any third party who may acquire our business. 6. What is the purpose and legal basis for processing your personal data by TBS? TBS collects your personal data when you apply for a job at TBS, which is collected mainly via CVs and / or forms sent to TBS. We also collect additional personal data as part of the on-boarding process after presenting you job offer. a) the necessity to take action on your request before the conclusion of the employment contract (Article 6 (1) (b) of the GDPR), in particular as regards negotiating working conditions b) a legitimate interest (Article 6 (1) (f) of the GDPR) and c) consent (Article 6 (1) (a) of the GDPR), for example, when personal data that go beyond the scope of data, which the obligation to provide results from the provisions of applicable law, will be processed as part of the recruitment processes. 7. TBS may process your personal data for the following purposes: a) conducting the recruitment process, including negotiating working conditions b) combating discrimination in the employment process c) organization of travel and accommodation of the candidate during the recruitment process d) handling complaints, requests and applications in connection with the ongoing recruitment process e) providing physical security in TBS, in particular in the field of video monitoring f) running a recruitment recommendation program g) in case it finds application, for internal reporting within TBS, including management reporting h) performance of obligations resulting from legal provisions, including tax and accounting regulations (i) in the event of its application, for purposes related to the conduct of court, arbitration or mediation proceedings j) statistical k) archive l) ensure accountability. 8. What rights do you have in relation to the data we hold on you? Subject Access rights You have the right to see the personal data we hold about you. This is called a Subject Access Request. If you would like a copy of the personal data we hold about you, please contact us at ComplianceOffice_TBS_CE@tesco.com . Other Data Protection rights In relation to your personal data, you also have the right to: Have inaccurate information corrected: Summary of the right: If you believe we hold inaccurate or missing information about you, please contact us and we will correct it. Object to our use of it: Summary of the right: General objection - We will then consider your objection to our use of your personal data. If on balance, your rights outweigh our interests in using your personal data, then we will at your request either restrict our use of it (see section 3 below) or delete it (see section 4 below). Objection in relation to direct marketing – If you make such an objection, we will stop using your personal data for direct marketing purposes. Restrict our use of it: Summary of the right: There are several situations when you can restrict our use of your personal data, this includes (but is not limited to): -you have successfully made a general objection (listed in section 2 above). -you are challenging the accuracy of the personal data we hold. -we have used your personal data unlawfully, but you do not want us to delete it. Have us delete it: Summary of the right: There are several situations when you can have us delete your personal data, this includes (but is not limited to): - we no longer need to keep your personal data; -you have successfully made a general objection (listed in section 2 above) -you have withdrawn your consent to us using your personal data (and we do not have any other grounds to use it) -we have unlawfully processed your personal data. Have us transfer or “port" a copy of it: Summary of the right: Data Portability is a new right to enable anyone within the EU to transfer their data between organisations. This is free of charge, allowing customers to switch between service providers. It works by transmitting and delivering data electronically in a structured, commonly used and machine-readable format such as JSON used by TBS. You can make your data request by contacting us at ce.dpo@tesco.com. You can either request a data report to be sent to yourself or ask for it to be sent to a third party. Complain to the data protection regulator: We’d like the chance to resolve any complaints you have, however you also have the right to complain to the data protection regulator about how we have used your personal data. Please see below for how you can contact the regulator. 1125 Budapest, Szilágyi Erzsébet fasor 22/c Tel: +36 (1) 391-1400 Fax: +36 (1) 391-1410 weboldal: https://www.naih.hu/ The right to withdraw consent If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). We usually act on requests and provide information free of charge, but may charge a reasonable fee to cover our administrative costs of providing the information for: • baseless or excessive/repeated requests, or • further copies of the same information. Alternatively, we may be entitled to refuse to act on the request. Please consider your request responsibly before submitting it. We'll respond as soon as we can. Generally, this will be within one month from when we receive your request but, if the request is going to take longer to deal with, we'll come back to you and let you know. 9. How will we contact you? We may contact you by phone, email or social media. If you prefer us to contact you in a particular way, please let us know via email on jobs.tbs@tesco.com 10. How can you contact us? If you have any further questions, comments or requests regarding the privacy notice or the processing of your personal data, please contact us at jobs.tbs@tesco.com IIn case you would need further information on how we handle your personal data, please contact the Data Controller at its headquarters, or approach the Data Protection Officer of the Data Controller via ComplianceOffice_TBS_CE@tesco.com.