Data Privacy Policy and Candidate Consent

In ONEflow GmbH, We respect your privacy and are committed to protecting your personal data. This Data Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard your information when you use our Platform to apply for job opportunities.

This Policy is designed to comply with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG).

The "Data Controller" responsible for processing your personal data on this Platform is:

PROLIANCE GmbH | www.datenschutzexperte.de

Leopoldstr. 21, 80802 München

datenschutzbeauftragter@datenschutzexperte.de

+49 89 250039222

Currently, we are not legally required to appoint a Data Protection Officer. However, you can direct any privacy inquiries to: privacy@one-flow.de

When you register and use our Platform to apply for a position, we collect the following personal data:

• Contact Information: Name, email address, phone number, postal address.

• Application Documents: CV/resume, cover letter, references, portfolio/work samples, passport copies, criminal record and language proficiency certificate.

• Professional Background: Work experience, job titles, previous employers, skills, qualifications, education history, academic certificate, academic transcripts.

• Platform Usage Data: Login details, timestamp of application, status of application.

• If applicable: LinkedIn profile URL, expected salary, availability date.

We process your data based on the following legal grounds:

A. Contractual Obligations (Art. 6(1)(b) GDPR & § 26 BDSG): We process your data to evaluate your suitability for a specific role you applied for and to take steps necessary to potentially enter into an employment contract with you. This includes reviewing your application, conducting interviews, and contacting you regarding the application process.

B. Consent (Art. 6(1)(a) GDPR & § 26 BDSG): If you choose to join our "Talent Pool" (see Section 6), we process your data based on your explicit consent to be considered for future job opportunities.

C. Legitimate Interests (Art. 6(1)(f) GDPR): We process certain data based on our legitimate interests, such as optimizing our recruitment process, ensuring the security of our Platform, and for statistical analysis (data will be anonymized where possible).

We do not actively seek "sensitive data" (as defined by Art. 9 GDPR, e.g., health data, trade union membership, religious beliefs) during the initial application process.

Please do not include sensitive data in your CV or application materials unless it is strictly necessary or legally required for the specific position.

If you voluntarily provide sensitive data (e.g., information about a severe disability to request accommodations), we will process this data only with your explicit consent or where legally required, strictly for the purpose of assessing suitability and providing necessary accommodations (§ 26(3) BDSG).

You to consent that your application data being stored in our "Talent Pool." This allows us to consider you for other suitable positions that may arise in the future within ONE FLOW Group and/or its affiliated companies.

We store your data only for as long as necessary for the recruitment process or as required by law.

• Unsuccessful Applications: If your application is unsuccessful, your data will be deleted 24 months after the rejection decision is communicated. This period is necessary to defend against potential legal claims.

• Talent Pool: If you consented to the Talent Pool, we will store your data for 36 months. We will contact you before the end of this period to ask if you wish to remain in the pool.

• Successful Applications: If you are hired, your application data will be transferred to your employee file and processed in accordance with our Employee Privacy Policy.

Your data is accessed only by authorized personnel involved in the recruitment process (HR department, relevant department heads/hiring managers).

We may share your data with:

• Service Providers (Data Processors): We use third-party service providers (e.g., the provider of this recruitment software platform, IT hosting services). These providers are strictly bound by Data Processing Agreements (DPAs) in accordance with Art. 28 GDPR and may only process data on our instructions.

• Legal Obligations: We may disclose data if legally required (e.g., to authorities).

We store and process your data primarily within the European Union (EU) or the European Economic Area (EEA).

No Transfers Outside EU/EEA: We do not transfer your personal data to countries outside the EU/EEA.

We implement appropriate technical and organizational measures (TOMs) to protect your data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. This includes encryption (SSL/TLS for data transmission), access controls, and regular security reviews of our Platform provider.

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access (Art. 15 GDPR): You can request information about what data we hold about you.

• Right to Rectification (Art. 16 GDPR): You can request that inaccurate data be corrected.

• Right to Erasure ("Right to be Forgotten") (Art. 17 GDPR): You can request the deletion of your data under certain circumstances (e.g., if you withdraw consent).

• Right to Restriction of Processing (Art. 18 GDPR): You can request that we restrict how we process your data.

• Right to Data Portability (Art. 20 GDPR): You can request a copy of your data in a structured, commonly used, and machine-readable format.

• Right to Object (Art. 21 GDPR): You can object to processing based on legitimate interests.

• Right to Withdraw Consent (Art. 7(3) GDPR): If processing is based on consent (e.g., Talent Pool), you can withdraw it at any time, effective for the future.

To exercise these rights, please contact us at privacy@one-flow.de

You have the right to lodge a complaint with a data protection supervisory authority. The relevant authority for us in Germany is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg

Postfach 10 29 32, 70025 Stuttgart

https://www.baden-wuerttemberg.datenschutz.de/kontakt-aufnehmen/

We may update this Policy from time to time. The "Last Updated" date at the top indicates when the Policy was last revised.

Every decision about your application is taken by a person. We do not decide about you by automated means.

To prepare those decisions, our internal system calculates a matching score from criteria we define ourselves, such as the specialisation a practice needs, German language level, availability, working-time model and preferred environment. This score is a fixed, rule-based calculation. It does not learn from data, it is used only internally by our team, it is never shown to practices, and it never rejects or excludes anyone on its own.

Where we use AI-assisted tools, for example to check whether uploaded documents are complete and legible, a member of our team reviews the result before it is used. We do not use AI to analyse emotions, personality, ethnicity, religion, health or age, and photographs are never used to assess you.

There is therefore no automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Should this change, we will update this Policy and inform you before it takes effect.

By registering on this Platform and submitting my application, I acknowledge that:

• I have read and understood the Data Privacy Policy above.

• My personal data will be processed for the purpose of evaluating my application for the specific position(s) I apply for, as described in Section 4.A.