If you have any questions regarding this document, contact us: legal@CYBERHOUR.

Information about the Controller:

1. Name: CYBERHOUR Ltd.
2. Address: Blvd. Madrid 8 Sofia 1680, Bulgaria
3. E-mail: legal@cyberhour.com

Supervisory bodies:

Commission for Personal Data Protection, website: www.cpdp.bg

Reason for collecting, processing, and storing your personal data

"CYBERHOUR Ltd." collects and processes your personal data in connection with the conclusion and execution of contracts with the Company on the grounds of Art. 6, para. 1, Regulation (EC) 2016/679 (GDPR), and in particular on the following grounds:

• To take steps on your request to sign a contract if you are a candidate for work with us;
• Compliance with a statutory duty applicable to the Administrator;
• For the purposes of the legitimate interests of the Administrator or a third party.

Goals and principles of collecting, processing, and storing your personal data

We collect and process the personal data you provide to us by applying for work at CyberHour Ltd., including for the following purposes:

• individualization of the applicant;
• making contact with you and conducting communication;
• selection of candidates.

The contact details of the job applicant shall be official information and as such shall not be considered as personal data.

We keep your personal data you have provided to us for the entire duration of the job announcement, and in the event that we would like to continue storing your data after this period for the purpose of further communication with you, we will send you by email, to give your explicit consent that your data will continue to be stored.

We comply with the following principles when processing your personal information:

• lawfulness, good faith, and transparency;
• limitation of the purpose of the processing;
• relevance to processing goals and minimization of data collection;
• accuracy and timeliness of the data;
• integrity and confidentiality of the processing, and ensuring an adequate level of security of personal data.

When processing and storing personal data, CYBERHOUR Ltd. may process and store personal data to protect the following legitimate interests: fulfilling its obligations to the National Revenue Agency, the Ministry of Interior, and other state and municipal authorities.

What kind of personal data our company collects, processes, and stores

CYBERHOUR Ltd. performs the following operations with the personal data you provide as job applicants for the following purposes:

• Conclusion and performance of an employment or civil contract with a physical person: to process a selection of job applicants, we process the personal data you have sent us to your resume.

Conclusion of the Impact Assessment: Given the small volume of data subjects that are processed and given the limited amount of personal data collected, an impact assessment is not necessary for the current operation.

CYBERHOUR Ltd. does not collect or process any personal data related to the following:

• reveal racial or ethnic origin;
• reveal political, religious, or philosophical beliefs or membership of trade unions;
• genetic and biometric data, health data, or data on sexual life or sexual orientation.

The personal data are collected by CYBERHOUR Ltd. from the persons to whom they refer.

CYBERHOUR Ltd. does not make automated decision making with data.

Personal data storage period

CYBERHOUR Ltd. keeps your personal data as a candidate for work for a period no longer than the availability of a current job offer, published on our website or elsewhere. After the expiration of the notice or the completion of the selection, CYBERHOUR Ltd. takes the necessary care to erase and destroy all your data without undue delay or to anonymize them (i.e. to bring them in a form that does not reveal your personality) unless you expressly agree that your data will continue to be stored and processed for the future.

CYBERHOUR Ltd. shall notify you in case the period for storing the data needs to be extended in order to comply with a statutory obligation or in view of the legitimate interests of the company or otherwise.

Transfer of your personal data for processing

CYBERHOUR Ltd. may, at its own discretion, transmit all or part of your personal data to processor personal data for the fulfillment of the processing purposes you have agreed to, subject to the requirements of Regulation (EC) 2016/679 (GDPR).

CYBERHOUR Ltd. notifies you in case of intent to transfer some or all of your personal data to third countries or international organizations.

Your rights in collecting, processing, and storing your personal data
1. Withdrawal of consent to process your personal data

If you do not wish all or any of your personal data to continue to be processed by CYBERHOUR Ltd. for any or all processing purposes, you may at any time withdraw your consent to processing by sending a formal request to legal@CYBERHOUR

CYBERHOUR Ltd. may ask you to certify your identity and identity with the person to whom the data relate by requesting you to present an identity document on site of the official address of CYBERHOUR Ltd.

CYBERHOUR Ltd. may continue to process part or all of your data if there is a legal obligation for this or for the purpose of protecting its legitimate interests.

Withdrawal of consent does not affect the merits of processing the personal data you provide until the withdrawal of the consent.

2. Right of access

You have the right to request and obtain from CYBERHOUR Ltd. a confirmation that personal data relating to you is being processed.

You have the right to access the data relating to you as well as information relating to the collection, processing, and storage of your personal data.

CYBERHOUR Ltd. shall provide you, upon request, with a copy of the processed personal data relating to you in electronic or other appropriate forms.

The provision of access to the data is free of charge, but CYBERHOUR Ltd. reserves the right to impose an administrative fee in case of repeatability or excessive demand.

3. Right to delete ("to be forgotten")

You have the right to ask CYBERHOUR Ltd. to delete any or all personal data related to you and CYBERHOUR Ltd. has the obligation to delete them without undue delay when any of the following reasons exists:

• personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• you withdraw your consent on which the processing of the data is based and there is no other legal basis for the processing;
• you object to the processing of your related personal data;
• personal data has been tampered with;
• personal data must be deleted in order to comply with a legal obligation under EU law or the law of a Member State that applies to CYBERHOUR Ltd.;
• personal data have been collected in connection with the provision of information society services.

CYBERHOUR Ltd. is not obliged to delete the personal data if CYBERHOUR Ltd keeps them and processes them:

• for the exercise of the right to freedom of expression and the right to information;
• for reasons of public interest in the field of public health;
• for compliance with a legal obligation which requires processing by the EU or Member State law to which CYBERHOUR Ltd. is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in CYBERHOUR Ltd.;
• for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes;
• for the establishment, exercise, or protection of legal claims.

In the event that you exercise your right to be forgotten, CYBERHOUR Ltd. will delete all your data, except your three names as a candidate for employment, for reporting purposes.

In order to exercise your right to be forgotten, it is necessary to send a formal request to legal@CYBERHOUR and to identify yourself with an identity document on site of the official address of CYBERHOUR Ltd.

4. Right of correction or completion

You have the right to ask CYBERHOUR Ltd. to:

• correct inaccurate personal data associated with you;
• to fill in the incomplete personal data associated with you.

In order to exercise your right of correction or completion, it is necessary to send a formal request to legal@CYBERHOUR and to identify yourself with an identity document on site of the official address of CYBERHOUR Ltd.

5. Right of portability

If you have consented to the processing of your personal data or the processing is necessary for the performance of the agreement with CYBERHOUR Ltd., or if your data is processed in an automated manner, you may, after you have been identified by CYBERHOUR Ltd.:

• ask CYBERHOUR Ltd. to provide you with your personal data in a readable format and transfer it to another Administrator;
• ask CYBERHOUR Ltd. to directly transfer your personal data to an administrator you provide when it is technically feasible.

You may exercise your right of portability by sending a formal request to legal@CYBERHOUR

6. Right of limitation

You have the right to require CYBERHOUR Ltd. to restrict the processing of your related data when:

• contest the accuracy of personal data for a period that allows CYBERHOUR Ltd. to verify the accuracy of personal data;
• processing is illegal, but you do not want personal data to be erased but only to be limited;
• CYBERHOUR Ltd. no longer requires personal data for the purpose of processing, but you require them to establish, exercise, or protect your legal claims;
• You have objected to the processing pending verification that the legal grounds of CYBERHOUR Ltd. have an advantage over your interests.

7. Right to receive information

You may ask CYBERHOUR Ltd. to inform you of all recipients to whom the personal data for which correction, deletion, or limitation of the processing has been requested has been disclosed. CYBERHOUR Ltd. may refuse to provide this information if this would not be possible or would require a disproportionate effort.

8. Right of objection

You may object at any time to the processing of personal data by CYBERHOUR Ltd. that relates to you, including if it is being processed for profiling.

9. Your rights in the case of personal data breach

If CYBERHOUR Ltd. detects a breach of security of your personal data that may pose a high risk to your rights and freedoms, CYBERHOUR Ltd. shall notify you without undue delay of the breach and of the measures taken or to be taken.

CYBERHOUR Ltd. is not obliged to notify you if:

• has taken appropriate technical and organizational protection measures with respect to the data affected by the security breach;
• has subsequently taken measures to ensure that the violation will not lead to a high risk for your rights;
• a notification would require disproportionate efforts.

Persons provided with your personal data

For the purposes of processing your personal data and executing the concluded contract, CYBERHOUR Ltd. may provide your data to third parties - personal data processors that comply with all the legality and security requirements for the processing and storage of your personal data.

CYBERHOUR Ltd. does not transfer your data to third countries.

Other provisions

In case of a violation of your rights under the above or applicable data protection laws, you have the right to file a complaint with the Personal Data Protection Commission. You may exercise all of your rights to protect your personal data by sending a formal request to legal@CYBERHOUR that contains a statement about it and identifies you as the data holder.

CYBERHOUR Ltd. ensures that it will refer to this Mandatory Information with a link to its website, by indicating it or by other appropriate means, ensuring that you have the opportunity to get acquainted with its content.

CYBERHOUR Ltd. reserves the right to update this Policy as often as needed at any time with no prior notification.

Contact Information

You may contact us on-site at the following address:
CYBERHOUR Ltd.
or at the following email: legal@cyberhour.com

Last updated: 21.04.2022