Hi,

Candidate data processing notice

As you are applying for a job with Detectify, personal data contained in your application will be collected
and processed by Detectify AB (Swedish reg. nr. 556985-9084, “Controller”), which is located at Mäster
Samuelsgatan 56, 111 21, Stockholm, Sweden, and can be contacted by emailing [email protected],
for the purposes of managing the recruitment process and related activities. The legal basis for the
processing is the legitimate interest pursued by the Controller for the purpose of solicitation, evaluation,
and selection of applicants for employment. We will comply with applicable data protection law and
principles, including the General Data Protection Regulation ((EU) 2016/679) (GDPR) in the processing
of your personal data.

How will we use your personal data?
We will use the personal information we collect about you to assess your skills, qualifications,
personality, and suitability for the role, carry out background and reference checks (where applicable),
communicate with you about the recruitment process, keep records related to our hiring processes and
comply with legal or regulatory requirements.

Will we share your personal data with third parties?
We will share your personal information with our subcontractors for the purposes of processing your
application. The subcontractors may be subject to change, but currently these are: Jobylon, Inc., an
application tracking management service provider located in the USA and DocuSign, Inc. a contract
management service provider located in the USA. Accordingly, your personal data will be transferred
outside the EU/EES once you submit such data through this site. We rely on standard data protection
clauses adopted by the European Commission as safeguards for any such transfer, and all our third-party
service providers and other entities in the group are required to take appropriate security measures to
protect your personal information in line with our policies. We do not allow our third-party service
providers to use your personal data for their own purposes. We only permit them to process your personal
data for specified purposes and in accordance with our instructions.

For how long will we keep personal data about you?
We will retain your personal information for a period of two years, if the job is located within the EU, and
one year if the job is located in the USA, after we have communicated to you our decision about whether
to appoint you to the role. We retain your personal information during that period in order to, in the event
of a legal claim, demonstrate that the recruitment process was conducted in a fair and non-discriminatory
way (in compliance with applicable law).. After this period, we will securely destroy your personal
information in accordance with our data retention policy.
You may choose to extend the retention period at a later date

If you wish to keep your personal information on file with us, on the basis that a further opportunity may
arise in the future and we may wish to consider you for that, we will seek your explicit consent to retain
your personal information for another fixed period.

Your rights
Under certain circumstances, according to the GDPR, you have the right to object to processing activities,
request access to your personal data, to request that your personal data be rectified or erased, and to
request that processing of your personal data be restricted. You also have the right to receive your
personal data (or have it sent to another company) in a structured, commonly used and machine-readable
format from us. Please note that your rights under the GDPR are not absolute and that there may be
situations where we may not comply with your request.

Data protection coordinator
We have appointed a data protection coordinator to oversee compliance with data protection, including
this privacy notice. If you have any questions about this privacy notice or how we handle your personal
information, please contact [email protected]. You also have the right to make a complaint at any
time to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten).

Regards,
The team at Detectify