Notice on the processing of personal data of job applicants

Date updated: July 2026.

1. The controller of job applicants’ personal data is:

Controller	Overseas Trade Co LTD d.o.o., Hrvatski Leskovac, Zastavnice 38 a, OIB: 19407280555
Telephone and fax	Telephone: +385 1 3454 555; fax: +385 1 6175 410
Privacy e-mail	privacy@overseas.hr
Data Protection Officer	Telephone: +385 1 7898 936; e-mail: povjerenik@overseas.hr

2. This notice applies to persons who:

• apply for a published job vacancy;
• submit an unsolicited application;
• participate in an interview, testing or another part of the selection procedure;
• give separate consent for their application to be retained for future recruitment needs;
• are contacted on the basis of a professional profile or another permitted source, if the Company uses such a method of finding candidates.

Where we collect data directly from the applicant, this notice is provided before or, at the latest, at the time the application is submitted.

If we did not obtain the data directly from the applicant, we provide the notice at the latest upon the first contact with the applicant and, in any event, within the time limits prescribed by Article 14 of the General Data Protection Regulation.

3. Personal data we process

Depending on the position and the application method, we may process the following categories of personal data:

• first and last name;
• e-mail address, telephone number and other contact details;
• data contained in the curriculum vitae, cover letter and other documentation submitted by the applicant;
• data on education, professional qualifications, licences, certificates and additional training;
• data on work experience, previous employment, professional knowledge and skills;
• data on language proficiency and the use of computer or other professional tools;
• data on availability to start work and other conditions directly related to the specific position;
• data provided during communication and the job interview;
• results of professional assignments, tests or assessments, where conducted;
• notes and assessments made by authorised persons during the selection procedure;
• data on references and referees, if the applicant provides them or authorises a reference check;
• data required to prove fulfilment of special job requirements where such requirements are prescribed by law or justified by the nature of the work;
• technical and record-keeping data concerning submission of an application through a recruitment system.

Applicants are requested not to provide data that are not necessary for assessing suitability for the position, such as information on marital or family status, children, religion, political views, health status or other information from private life, unless providing such information is expressly necessary for exercising a particular statutory right or meeting a statutory requirement.

If an applicant voluntarily provides data that are not necessary for the selection procedure, the Company may remove, redact or delete them.

Data relating to criminal convictions and offences are processed only where such processing is permitted or required under a specific regulation.

4. Sources of personal data

We primarily obtain personal data directly from the applicant:

• through an application form;
• by e-mail;
• through recruitment portals, including MojPosao;
• during interviews, testing and other communication;
• from documents submitted by the applicant.

Where an applicant personally submits an application for our specific vacancy through the MojPosao portal, for the purposes of our selection procedure the data are considered to have been obtained from the applicant through a technical service provider.

5. Purposes and legal bases of processing

5.1. Application for a specific published vacancy

We process personal data for the purposes of:

• receiving and recording the application;
• checking whether the applicant meets the job requirements;
• communicating with the applicant;
• organising interviews, assignments and testing;
• assessing the applicant’s knowledge, experience, qualifications and suitability;
• making a decision on the selection of an applicant;
• preparing an offer and taking other steps prior to the possible conclusion of an employment contract.

The legal basis for this processing is taking steps at the applicant’s request prior to entering into a contract, in accordance with Article 6(1)(b) of the General Data Protection Regulation.

The applicant’s consent is not the legal basis for processing the application for the purposes of a specific recruitment procedure and is not a condition for participating in the selection procedure.

5.2. Unsolicited applications

Where an applicant submits an unsolicited application that does not relate to a specific published position, we process the data on the basis of their consent, in accordance with Article 6(1)(a) of the General Data Protection Regulation.

The applicant may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

5.3. Retaining an application for future recruitment procedures

We will retain the application of an applicant who has not been selected for other possible employment opportunities only if the applicant gives separate, freely given consent for this purpose.

Refusal to give such consent or its subsequent withdrawal does not affect the applicant’s participation in the current selection procedure.

The legal basis is Article 6(1)(a) of the General Data Protection Regulation.

5.4. Compliance with legal obligations

We process personal data where this is necessary for compliance with legal obligations applicable to the Company, in accordance with Article 6(1)(c) of the General Data Protection Regulation, such as, for example, exercising a statutory preference in employment pursuant to the Act on Croatian Homeland War Veterans and Members of Their Families (Official Gazette 121/2017), the Act on Croatian Homeland War Veterans and Members of Their Families (Official Gazette 121/2017), and similar regulations.

We will process special categories of personal data only where, in addition to an appropriate basis under Article 6, an appropriate exception under Article 9(2) of the General Data Protection Regulation also applies.

6. Is the applicant required to provide personal data?

Submitting a job application is not a legal obligation.

However, certain personal data and documents are required so that we can:

• identify the applicant;
• contact the applicant;
• verify whether the applicant meets the job requirements;
• conduct the selection procedure.

If the applicant does not provide data necessary for assessing the application, we may be unable to consider the application or continue the selection procedure.

Data that are not marked as mandatory are provided voluntarily.

7. Recipients of personal data

Access to applicants’ personal data is limited to persons who need access in order to conduct the selection procedure, for example:

• authorised employees performing human resources duties;
• managers of the organisational unit for which the applicant is applying;
• members of a committee or other persons involved in selecting the applicant;
• the Company’s management, where involved in making the decision;
• authorised employees in legal, information technology or security functions where necessary.

8. Transfers of data outside the European Economic Area

We do not transfer applicants’ personal data to recipients outside the European Economic Area.

9. Retention periods

We retain applicants’ personal data only for as long as necessary for the purpose for which they were collected.

Application for a specific vacancy

We retain applicants’ data during the selection procedure and for a further 6 (six) months after completion of the procedure and notification of applicants of the outcome, for the purpose of resolving possible enquiries and objections and protecting legal interests.

If an objection, procedure or legal claim is initiated before expiry of that period, the relevant data may be retained until its final and legally binding conclusion.

Selected applicant

If an applicant is selected and enters into an employment contract, data required for establishing and performing the employment relationship are transferred to the employee’s records and are subsequently processed in accordance with the notice on the processing of employees’ personal data.

Application data that are not required for the employment relationship are deleted in accordance with the applicable retention schedule.

Unsolicited applications and future opportunities

Unsolicited applications and applications retained on the basis of consent for future employment opportunities are retained for no longer than 12 (twelve) months from receipt or from the giving of consent, unless the applicant withdraws consent earlier.

Upon expiry of that period, the data are deleted or the applicant is asked to provide new consent, where there is a justified need to do so.

Evidence of consent and exercise of rights

Data required to demonstrate the giving or withdrawal of consent and the handling of applicants’ requests are retained for as long as necessary to demonstrate compliance and protect legal claims.

10. Applicants’ rights

Subject to the conditions prescribed by the General Data Protection Regulation, the applicant has the right to:

• request confirmation as to whether we process their personal data and obtain access to those data;
• request rectification of inaccurate data or completion of incomplete data;
• request erasure of data where there is no longer a legal basis for processing;
• request restriction of processing;
• object to processing based on legitimate interests;
• exercise the right to data portability where processing is based on consent or a contract and is carried out by automated means;
• withdraw consent at any time where processing is based on consent;
• not be subject to a decision based solely on automated processing, under the conditions set out in Article 22 of the General Data Protection Regulation;
• lodge a complaint with the supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

To exercise their rights, the applicant may contact povjerenik@overseas.hr.
To protect the data, we may request additional information necessary to verify the identity of the person submitting the request.

Requests are handled without undue delay and within the time limits prescribed by the General Data Protection Regulation.

The applicant has the right to lodge a complaint with:

Agencija za zaštitu osobnih podataka
Ulica Metela Ožegovića 16
10 000 Zagreb
E-mail: azop@azop.hr.

11. Protection of personal data

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, use, disclosure, alteration, loss or destruction.

Access to the data is restricted to authorised persons who need the data to perform duties related to the selection procedure. Those persons are required to maintain the confidentiality of the data.

12. Amendments to this notice

We may amend this notice when the methods of processing, purposes, recipients, retention periods or applicable regulations change.

13. Method of providing this notice to applicants

This notice is provided to applicants:

• by publication in a dedicated “Careers” section on the Company’s website;
• by a direct link in every job advertisement published by the Company;
• by a direct link next to the online application form;
• by a link or appropriate notice in advertisements published on the MojPosao portal and other portals;
• by a link next to the e-mail address used to receive unsolicited applications;
• by providing it in electronic or PDF form at the applicant’s request;
• upon first contact with the applicant, if their data were not obtained directly from them.