The purpose of the Privacy Notice is to provide appropriate information to the data subjects regarding their rights and obligations related to the processing of their personal data. The Notice informs the data subjects regarding circumstances of the processing of their personal data, based on which information they can make an informed decision regarding whether they wish to consent to the processing.

This Privacy Notice is based on Section 20(2) of the Act on Informational Self-Determination and the Freedom of Information (hereinafter referred to as: "Information Act"), which provides that data subjects must be informed regarding all circumstances of the processing in a clear and detailed manner - including in particular the purpose and legal basis of the processing, the persons entitled to process the data (the controller and the processor), the duration of the processing, the fact that the data subject's personal data are processed by the controller based on Section 6(5) of the Information Act (when applicable) and the scope of persons entitled to access the data - prior to commencement of the processing. The information must also cover the data subject's rights and remedies related to the processing.

Pursuant to Section 4(1) of the Information Act, personal data may only be processed for a specific purpose, in order for the exercising of rights or the fulfilment of obligations. The processing must be in line with its purpose in every phase thereof, and the recording and processing of the data must take place in a lawful and fair manner. Pursuant to Section 4(2) of the Information Act, only personal data that are strictly necessary and appropriate for fulfilling the purpose of the processing may be processed. The personal data may only be processed to the extent and for the time necessary for fulfilling the purpose.

This Privacy Notice relates to personal data collected and processed by PBS International Kft regarding its clients, employees and partners (hereinafter jointly referred to as: "data subjects").

PBS International Kft informs the data subjects regarding the facts related to the processing of the data via this Privacy Notice prior to commencement of the processing. The information set out in the Privacy Notice covers the data subjects' rights and remedies related to the processing, as well as whether a data processor is involved in the processing.

PBS International Kft qualifies as the data controller regarding all data processing activities covered by this Notice.

Data and contact details of the controller:

PBS International Kft

• registered office: H-2016 Leányfalu, Körte utca 4.
• branch office: H-1036 Budapest, Nagyszombat utca 4. 3. emelet 13.
• company registration number: 13-09-106819
• VAT number: 12937293-2-13
• represented by: Renáta Restás, Managing Director

Relevant contact details:

• PBS International Kft
• Address: H-1036 Budapest, Nagyszombat utca 4. 3. emelet 13.
• Phone number: +36 1/786-5666
• Email address: info@pbs-job.hu
• Address of the controller's website: www.pbs-job.hu

The Privacy Notice is also available at the www.pbs-job.hu website, under the menu item "Privacy Notice" ("Adatkezelési tájékoztató"). PBS International Kft (hereinafter referred to as: the "Company") processes the data of the natural persons applying for any of the vacancies announced by the Company upon registering on the online platform on the website specified above or by other electronic means in accordance with is job placement activity, in accordance with its own Privacy and Data Processing Policy to be construed together with this Privacy Notice. The voluntary consent of the data subjects, expressed by the data subjects sending their CV and the associated documents (e.g. documents certifying qualifications, education, the lack of criminal record) to PBS International Kft. [Section 5(1)(a) of the Information Act] PBS International Kft only processes the personal data contained in the CVs and other attached documents received by it directly or via its online systems in order to notify the data subject regarding the vacancies that are best suited to their qualifications and interests, to set up meetings with the data subject, to conduct the selection procedure and, after matching the data subject with the preliminary preferences determined by its own contractual partners, to transmit the personal data of the selected data subject. In relation to performance of the contract associated with the services specified in Section II.2 and based on the data subjects' consent, the personal data of the data subjects are stored and processed for an indefinite term.

In accordance with the purpose specified in Section II.2. and the activity of the controller, and having regard to the interests of the data subjects, the data processed are stored for an indefinite term, which indefinite-term storage will in all cases be terminated upon the data subject's request for deletion of their data, in which case the controller will remove the personal data of the data subject concerned from its database.

Pursuant to Section 6(5)(a) of the Information Act, if processing of the data is required for fulfilment of a legal obligation, our company will process the data for the duration of the existence of this legal obligation.

The applicant may request the deletion of their data and/or revoke their consent by writing to H-1036 Budapest, Nagyszombat utca 4. 3. emelet 13. or the info@pbs-job.hu email address. First name, last name, sex, date of birth, citizenship, native language, highest educational qualification, language skills, email address, phone number, certificates of educational qualifications and any other data/information voluntarily disclosed by the data subject in their CV The following company provides for the technical conditions of digital data storage as a hosting provider engaged by the company:

• Krehnyay Gergely EV
• Registered office: H-1119 Budapest, Major u. 40.

PBS International Kft only uses the data for the purpose of recruiting workforce. The purpose of online application is to allow data subjects to apply for positions offered by the company through the www.pbs-job.hu quickly or to be recorded in a database not accessible to third parties. We would like to note that persons in employment or agency relationship with the company may access the personal data of the data subjects solely for the purposes of the processing. PBS International Kft (hereinafter referred to as: the "Company") processes the data of the natural persons in employment relationship with the Company acting as employer, in accordance with its own Privacy and Data Processing Policy to be construed together with this Privacy Notice. The employees' personal data are processed based on the employment contract concluded between the data subjects and the Company. [Article 6(1)(b) of the GDPR] PBS International Kft processes the personal data of the data subjects in employment relationship with it (i.e. its employees) specified in a separate law in order for performance of the employer's reporting obligations both for the benefit of the Company and of the employees, and in order so that the data be accessible during a possible authority audit. The personal data of the data subjects are processed for the term of storage specified in a separate law after termination of the contractual employment relationship for each data subject.

Pursuant to Section 6(5)(a) of the Information Act, if processing of the data is required for fulfilment of a legal obligation, our company will process the data for the duration of the existence of this legal obligation. First name, last name, sex, birth date, VAT number, personal ID number, social security number, data of certificate attesting residence; as well as any other data whose processing is strictly necessary for establishing the employment relationship based on a separate law. The following company provides for the technical conditions of digital data storage as a hosting provider engaged by the company:

• Krehnyay Gergely EV
• Registered office: H-1119 Budapest, Major u. 40.

PBS International Kft only processes the data for the purpose of maintaining the employment in a lawful manner, in relation to which the Managing Director of the Company and employees in employment relationship with the Company may access the personal data referred to in this Chapter. Rights of the data subject:

• requesting information
• requesting rectification of the data
• requesting deletion or blocking of the data
• objecting against the processing

The request for information, rectification, blocking or deletion of the personal data or the objection against the processing may be reported at any time at the following contact points:

• via postal mail: H-1036 Budapest, Nagyszombat utca 4. 3. emelet 13.,
• via email: info@pbs-job.hu, or
• via phone: +36 1/786-5666, stating your name and address,
• in person, at PBS International Kft's address: H-1036 Budapest, Nagyszombat utca 4. 3. emelet 13.

The data subject (hereinafter referred to as: "User") may request PBS International Kft (hereinafter referred to as: "Controller") to inform them regarding the processing of their personal data. Upon the written request of the data subject, the Controller must provide the information in writing within the shortest time possible, but at the latest within 25 days as of the date of submission of the request.

The User may send the request for information to the Controller in writing, via post, fax or email. In their request, the User must indicate their identification data by which the Controller can establish the User's right to access the personal data. In the request, the User must specify their electronic or postal contact points where the Controller can send the information.

The User may request information regarding the scope of personal data processed, the source of the personal data, the purpose of processing of the personal data, on what legislation the processing of the personal data takes place, the duration of the processing of the personal data by the Controller, as well as the Controller's activities related to the processing of the personal data.

Upon request, the Controller will provide information regarding to which of its contractual partners it transmitted the personal data, as well as the legal basis of the transmission of the data.

If a personal data breach takes place in the course of the processing, the User may also request information regarding its circumstances and effects, as well as the measures taken by the Controller to avert it. Personal data breach means that the personal data are processed in an unlawful manner. This includes in particular when an unauthorised person accesses the personal data or when the personal data are altered, transmitted, disclosed, deleted or destroyed in an unlawful manner. The accidental destruction or loss of personal data also qualify as a personal data breach.

The Controller must provide the information at the maximum within 25 days as of the date of receipt of the User's request, in email. If the User submitting the request did not indicate their electronic contact details in the request or if they expressly request postal delivery, the Controller will provide the information in writing, via postal mail. The Controller will provide information regarding the scope of personal data indicated in the request free of charge once per year.

There are only two cases in which the Controller may refuse to provide information to the data subject:

• If, in the case of transmission of the data, the Controller receives the personal data from the transferor and at the same time is notified by the transferor regarding that a domestic or international legislation limits the data subject's right to information.
• If the data subjects right to information is limited by law in order to protect the internal and external security of the state (e.g. for defense, national security, crime prevention or law enforcement purposes), for the purposes of the economic or financial interests of a state or municipality, for the purposes of the significant material or financial interests of the European Union or in order for preventing or detecting disciplinary and ethical violations related to occupation or labour law and labour protection violations - including monitoring and supervision in each case -, as well as in order to protect the rights of the data subject or other persons.

If the request for information is rejected in accordance with this Section, the Controller must notify the Data Subject in writing regarding the reason why it refused to provide information, specifying the exact legal basis thereof. In this case, the Controller will also notify the Data Subject regarding the possibility of judicial remedy or turning to the Authority (see Section IV of this Notice for more information on remedies). The Data Subject may request the Controller to rectify their personal data at any time if the data are incorrect. If the personal data is incorrect and the correct personal data is available to the Controller, the Controller will rectify the personal data. The Data Subject may send the request for rectification to the Controller in writing, via post or email.

If the Controller does not fulfil the Data Subject's request for rectification within 25 days as of the date of receipt of the request, it must notify the Data Subject regarding the reasons thereof in writing or - if the Data Subject consents to it - by electronic means, indicating the legislative basis of its refusal to fulfil the request. In this case, the Controller will also notify the Data Subject regarding the possibility of judicial remedy or turning to the Authority. The Data Subject may request the Controller to delete or block their personal data at any time. The Data Subject may send the request for deletion or blocking to the Controller in writing, via post or email.

The Controller will delete the personal data if:

• it was processing it unlawfully,
• the data subject requests deletion or blocking of their personal data,
• the processing is deficient or false, and this cannot be remedied by lawful means, provided that the law does not prohibit deletion,
• the purpose of the processing has ceased or the duration of the storage of data specified in law has expired,
• if a court or the Authority ordered deletion of the data.

If the Controller does not fulfil the Data Subject's request for deletion or blocking within 25 days as of the date of receipt of the request, it must notify the Data Subject regarding the reasons thereof in writing or - if the Data Subject consents to it - by electronic means, indicating the legislative basis of its refusal to fulfil the request. In this case, the Controller will also notify the Data Subject regarding the possibility of judicial remedy or turning to the Authority.

The Controller will block the personal data instead of deleting it if the Data Subject requests this or if based on the information available it, it can be assumed that deletion would harm the Data Subject's legitimate interests. The personal data stored in this manner may only be processed as long as the legislative or factual circumstance preventing the deletion exists. The Data Subject may object against the processing against its personal data in the following cases:

• if the processing of the personal data is only necessary for performance of a legal obligation applicable to the Controller or enforcement of the legitimate interests of the Controller or a third party,
• if the purpose of processing of the personal data is direct marketing, or conducting public opinion polls or scientific research,
• if a law provides the option for this to the Data Subject.

The Data Subject may send the objection to the Controller in writing, via post or email. The Controller must inspect the objection and decide regarding whether it is justified within 15 days as of the submission thereof. The Controller will notify the Data Subject regarding its decision in writing. If the Data Subject's objection is justified, the Controller must terminate the processing and transmission, block the personal data and notify regarding the objection and the measures taken based thereon all persons to whom it previously transmitted the personal data concerned by the objection, which persons will also be obliged to take measures in order to enforce the right to objection. If the Data Subject does not agree to the decisions of the Processor or if the Processor misses the 15-day deadline set out for assessing the Data Subject's objection, the Data Subject may turn to a court for remedy within 30 days after notification of the decision or the date of expiry of the deadline.

The Data Subject may turn to the Hungarian National Authority for Data Protection and Freedom of Information for remedy or file suit at the competent court for breach of its rights related to the processing of personal data.

The Data Subject may contact the Hungarian National Authority for Data Protection and Freedom of Information at the following contact points:

• address: H-1125 Budapest, Szilágyi Erzsébet fasor 22/c
• postal address: H-1530 Budapest, Pf.: 5.
• phone: +36 (1) 391-1400
• fax: +36 (1) 391-1410
• email: ugyfelszolgalat@naih.hu
• website: www.naih.hu
• Registration number of the processing: NAIH-50358/2012

The Data Subject may also file suit against the Controller at the Regional Court with territorial competence over their permanent place of residence or temporary residence.

The Data Controller is only entitled to consent to processing by the Controller after they have familiarised themselves with the foregoing provisions governing data protection and processing and if they are aware of their rights and obligations related to the processing of their personal data.

Effective from: 25 May 2018