Privacy Policy for applicants

We are delighted that you would like to submit an application to us. We explain below how we process personal data
when you submit an application and provide further information relevant to this topic.

1. Who is responsible for the processing of your personal data?

The controller (hereinafter referred to as "StepStone" or "we") for the purposes of the General Data Protection
Regulation and other Polish national data protection laws, as well as other data protection regulations related to
applications is StepStone Services Sp, z o.o. located in Warsaw at, Domaniewska 50.

2. Data protection officer & Contact Information.

You can contact our data protection as follows:
Data Protection Officer: sebastian.creutz@stepstone.de
Recruitment Team: recruitment.team@stepstone.com

3. For what purposes and on what legal basis do we process personal data?

We process personal data concerning you for the purpose of your application for an employment relationship
provided that this is necessary in order to make a decision regarding the establishment of such an employment
relationship. The legal basis is Art. 6 (1) (b) GDPR.
In the event that an employment relationship is established between you and us, we may process the personal
data already received from you for the purpose of such employment relation if necessary for the performance or
termination of such employment relationship or for exercising or fulfilling the rights and obligations of the lobby
group or employees resulting from a law or a collective agreement.

4. Which categories of personal data do we process?

We process data in connection with your application. This may include general information about you (such as
your name, address and contact details), information about your professional qualifications and education or
information about professional training or other information you provide us in connection with your application. In
addition, we may process job-related information made publicly available by you, such as a profile on
professional social media networks.

5. What are the sources of personal data if we do not collect them from you?

As a rule, we collect personal data from you. In connection with an application, however, we may also collect
personal data about you on professional social networks (e.g. LinkedIn, GoldenLine), insofar as this is required
as part of the hiring process.

6. What categories of recipients of data are there?

6.1 Affiliated companies
We may transfer your personal data to companies affiliated with us, insofar as this is permissible within
the scope of the purposes and legal bases set out in Section 3 because it is possible that you may
likewise work for these companies within the scope of your employment relationship. An overview of
these affiliated companies can be found in Annex 1 at the end of this Privacy Policy.

6.2 Data processors
We also use contract data processors, i.e. companies that process personal data on our behalf and in
accordance with our instructions, within the scope of contracts concluded with us. These contract data
processors are:
– StepStone GmbH, Axel-Springer-Str.65, 10969, which administers applications for us in an
applicant management system
– eArcu Ltd, Mardall House, 9-11 Vaughan Road, Harpenden, Hertfordshire, AL5 4HU, which
provides the application management system as a subcontractor of StepStone GmbH, the owner
of StepStone Services.
– Rackspace Limited, Hyde Park Hayes, 5 Millington Rd, Hayes UB3 4AZ, United Kingdom, which
hosts the candidate management system as a subcontractor for eArcu Ltd
– On Direct Business Services Limited, 1 London Street, Reading RG1 4QW, United Kingdom,
which performs backups of the candidate management system as a subcontractor for eArcu Ltd

7. Is data intended to be transferred to a third country?

We do not intend to transfer to a third country.

8. How long will your data be retained?

We store your personal data for as long as it is necessary to make a decision concerning your application. In
the event that your application does not result in an employment relationship between you and us, we may
continue to retain your data insofar as this is necessary to defend against possible legal claims. Application
documents will be deleted after one year after notification the decision to reject your application, unless
retention for a longer period is required in connection with legal disputes.

9. What are your rights?

Depending on the situation applicable to a specific case, as an applicant you have the data protection rights
described below which you may exercise by contacting us or our data protection officer at any time using the
contact details provided in Section 1 and 0 :

a. Information
You have the right to request confirmation from us whether we process personal data concerning you. If
this is the case, you have a right to receive information about this personal data free of charge, including
the right to receive a copy of this data and to receive the following information:
– the processing purposes;
– the categories of personal data being processed;
– the recipients or categories of recipients to whom the personal data have been or will be disclosed, in
particular recipients in third countries or international organisations;
– if possible, the planned duration for which the personal data will be stored or, if this is not possible, the
criteria for determining this period;
– the existence of a right to rectification or erasure of personal data concerning you or to restrict
processing by the controller or a right to object to such processing;
– the existence of a right to lodge a complaint with a supervisory authority;
– if the personal data is not collected from the data subject: all available information about the origin of
the data;
– the existence of automated decision-making including profiling in accordance with Art. 22 (1) and (4)
GDPR and – at least in these cases – meaningful information about the logic involved and the scope
and the intended effects of such processing for the data subject.

b. Rectification
You have the right to request us to rectify any inaccurate personal data concerning you without undue
delay. Taking into account the purposes of the processing, you have the right to request the completion of
incomplete personal data – also by means of a supplementary statement.

c. Right to object

To the extent that data concerning you is processed on the basis of Art. 6 (1) () GDPR, you have the right
to object, on grounds relating to your particular situation, at any time to processing of such personal data. In
such cases, we will no longer process your personal data unless we can demonstrate compelling legitimate
grounds for the processing which override your interests, rights and freedoms or for the establishment,
exercise or defence of legal claims.
d. Right of revocation
If processing is based on consent, you have the right to revoke such consent at any time without affecting
the legality of the processing carried out on the basis of the consent prior to its revocation. You can contact
us or our data protection officer at any time using the contact details provided above.
e. Right to erasure
You have the right to request the erasure of personal data concerning you without undue delay and we
shall have the obligation to erase personal data without undue delay where one of the following grounds
applies:
– The personal data are no longer necessary for the purposes for which they were collected or otherwise
processed
– You subject an objection to processing pursuant to Section 9 . c and there are no overriding legitimate
grounds for the processing.
– The personal data have been processed unlawfully.
– The personal data have to be erased for compliance with a legal obligation in Union or Member State
law to which we are subject.
This does not apply if processing is necessary:
– to fulfil a legal obligation which processing requires under the law of the Union or of the Member States
to which we are subject.
– to establish, exercise, or defend legal claims.
f. Right to restriction of processing
You have the right to obtain from us restriction of processing where one of the following applies:
– the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of
the personal data;
– the processing is unlawful and you oppose the erasure of the personal data and instead request a
restriction of the use of the personal data;
– we no longer need the personal data for the purposes of the processing, but they are required by you
for the establishment, exercise or defence of legal claims; or
– You have objected to processing pursuant to number 9 . c above pending the verification whether our
legitimate grounds override yours.
If processing has been limited pursuant to Section f , such personal data shall, with the exception of
storage, only be processed with your consent or for the establishment, exercise or defence of legal claims
or for the protection of the rights of another natural or legal person or for reasons of important public
interest of the Union or of a Member State.
If you have obtained a restriction on processing, we will inform you before the restriction is lifted.
g. Right to lodge a complaint
Without prejudice to any other administrative or judicial remedy, Art. 77 GDPR provides you the right to
lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence,
place of work or place of the alleged infringement if you consider that the processing of personal data
relating to you infringes the GDPR. The competent supervisory authority for us is Generalny Inspektor
Ochrony Danych Osobowych.

10. The requirement to provide personal data

The provision of personal data is neither required by law nor by contract, nor are you obliged to provide the
personal data. However, the provision of personal data is required for a contract of employment with us. This
means that we will not enter into an employment relationship with you if you do not provide us with the data we
have marked as required for an application.
Annex 1 – Overview of affiliated companies comprising potential recipients of your data in accordance with Section 6
StepStone GmbH, Völklinger Str. 1, 40219 Düsseldorf, Germany
StepStone Deutschland GmbH, Völklinger Str. 1, 40219 Düsseldorf, Germany
StepStone Continental Europe GmbH, Völklinger Str. 1, 40219 Düsseldorf, Germany
YOURCAREERGROUP GmbH, Kaiserswerther Strasse 282, 40474 Düsseldorf, Germany
YOURCAREERGROUP Schweiz GmbH, Industriestrasse 30, 8032 Kloten, Switzerland
StepStone Austria GmbH, Frankenberggasse 13/17, 1040 Vienna, Austria
YOURCAREERGROUP Österreich GmbH, Frankenberggasse 13/17, 1040 Vienna, Austria
StepStone UK Holding Ltd, 9th floor Blue Fin building; 110 Southwark Street SE105A, London, United Kingdom
Jobsite UK (Worldwide) Ltd, 6000 Langstone Technology Park Langstone Road PO91SA, Havant Hamphire, United
Kingdom
Totaljobs Group Ltd. 9th floor Blue Fin building; 110 Southwark Street SE105A, London, United Kingdom
NIJobs.com Ltd, 3rd Floor, Rose House 2 Derryvolgie Avenue BG96FL Belfast, United Kingdom
Jobmagnet Ltd, Ltd, 6000 Langstone Technology Park Langstone Road PO91SA, Havant Hamphire, United Kingdom
Saongroup Ltd, Clonskeagh Square Orchard House 14 Dublin, Ireland
Jobs.ie Ltd, Orchard House Clonskeagh Square 14 Dublin, Ireland
Jobs.lu Ltd. Orchard House Clonskeagh Square 14 Dublin, Ireland
Candidate Manager Ltd. Orchard House Clonskeagh Square 14 Dublin, Ireland
StepStone France SAS, 78 Ter 80 rue Laugier, 75017 Paris, France
ICI Formations SAS, 29 boulevard de Reuilly 75012 Paris, France
ICI Jobs SAS, 3 boulevard Pasteur 75015 Paris, France
StepStone N.V., Koningsstraat 47 rue Royale 1000 Brussels, Belgium
Ictjob SPRL, Clos de la Brise 2 1410 Waterloo, Belgium
Tourijobs Tourism Services S.L., número 1 C/Estació 08630 Abreara, Spain
StepStone Services Sp. z o.o., Saturn Office Building Ul. Dmaniewska 50 02-672 Warsaw

Wchodzimy w nadświetlną