Information Notice for Job Candidates

Please carefully read this Information Notice. It contains important information on how we
process personal data of job applicants and participants in recruitment processes (“you”).
I. Controller of your personal data
The Controller of your personal data is Lab08 Ltd. (“Lab08”, “we”, “our”), UIC 204018108,
address: Sofia 1000, 14 Todor Aleksandrov Blvd., fl. 2, office 4, email:
II. Categories of Personal Data
1. Personal Data processed in recruitment procedures
Lab08 may process the following categories of personal data for recruitment purposes:
 Data about you and your contact details: names; address (permanent, current and
address for correspondence); e-mail address; telephone number; information about the
position you are applying for;
 Information regarding your education and qualifications: resume/CV; cover letter;
information contained in documents certifying a education, professional qualifications,
competence and skills;
 Data regarding your professional experience: previous work experience (including
information on previous employer’s name, period of work, place of work, position held,
recommendations etc.); information on the nature and scope of work performed with
previous employers; as well as information on the current employment and civil contract
 Data we have obtained during interviews and tests conducted within the recruitment
process, including information about the requested/ proposed remuneration; information
generated under the conducted tests, interviews, and other forms of verification of the
availability of knowledge, skills and competences, qualifications, etc.
 Data from correspondence with you related to your application and participation in the
recruitment process;
 Other information included in your application at your discretion: In case you decide,
upon your free will, to include a broader range of data in your application, including
information on recommendations; a photograph; other data that you have included in
your application at your discretion such as age, date of birth, other information included
in the resume (CV) cover letters and other accompanying the relevant application
documentation, etc. we will process these data. In case you do not wish Lab08 to process
additional personal data about you, please do not include such information in your
2. Personal Data processed outside specific recruitment procedures
Lab08 is open and actively seeks to expand its team by gathering information about potential new employees and partners. This information may include:
 Information that is publicly available in professional networks, recruitment platforms, webpages, etc.: Any personal data you chose to disclose for the purposes of future job or professional opportunities, including, for example, names, contact details, employment history, experience, education, professional qualification, competences and skills;
 Information we receive from personal recommendations – Lab08 uses its network of
Friends of Lab08 – persons, such as employees, ex-employees, partners, personal
acquaintances, and others, to find suitable future members of our team. The information
we receive via such channels could include CVs, contact details, information about your
professional experience, previous or current employment, educational level, professional
qualification, competence and skills and recommendations by the persons who
recommend you to us as and provide us with the above information.
Important note: Please do not provide us with information about other persons in respect to
job opportunities with Lab08, if you have not confirmed with the respective person that they
do not object to such actions on your part and/or do not object to Lab08 obtaining the
respective information.
 Information you send to us as a spontaneous application: You may send to us personal
data contained within spontaneous job applications outside a particular recruitment
procedure. In such cases, we will process these personal data that you have choose to
disclose, such as information contained with a CV, as well as any other documents and
other information described in p. II(1) above for the purposes of taking these data into
account for recruitment procedures for job positions within our team which we consider
relevant for your professional and educational background.
3. Personal Data processed on the basis of consent
We may process your personal data based on your specific and explicit consent, such as, for example, to process your personal data for the purposes of future recruitment procedures. The categories of personal data processed in such cases will be described in each consent document.
III. Information you should not include in your application
We explicitly ask you not to include in your application and not to send us information that is not necessary for the evaluation of your job application. Specifically, you should not send us any sensitive information or copies of official identity documents. Copies of such documents are in no way necessary for the evaluation of your job application.
IV. Purposes and legal basis of the processing of your personal data
Your personal data may be processed by Lab08 for the following purposes:
 Job application evaluation: Lab08 may process your personal data under p. II(1) for the purpose of considering your application, assessing your qualifications, and
communicating with you with regard to your application. Such processing would be
carried out on the basis of Art. 6, para. 1 (b) GDPR – taking steps at the request of the data subject prior to entering into a contract (employment contract).
 General recruitment purposes: Lab08 may process the personal data under p. II(2) above for the purposes of actively searching for and approaching suitable professionals to enforce its team, including receiving and reviewing spontaneous applications, receiving recommendations from Lab08 Friends, reviewing publicly available information made known by the persons themselves for future recruitment purposes. This processing is based on – our legitimate interest to find potential new employees or partners (Art. 6, para. 1 (f) GDPR).
 Legal claims: Your personal data may also be processed by us in case of possible legal claims or complaints for the purposes of defending and exercising Lab08’s legal rights and obligations. Such processing could be carried out on the basis of Art. 6, para 1 (f) GDPR – legitimate interest of establishment, defence or exercise of legal claims.
 Compliance with legal obligations: Lab08 may also process your personal data for the purpose of complying with its legal obligations, such as informing you on circumstances related to your rights or to the protection of your personal data, as well as record-keeping and reporting to competent authorities, if applicable. Such processing will be carried out on the basis of Art. 6, para. 1 (c) GDPR – compliance with legal obligations to which we are subject.
 In addition, your personal data may be processed based on your explicit consent for the specific purposes described in the respective consent.
V. From what sources do we receive your personal data?
Usually we receive your personal data from you:
 when you send us your application in the context of a specific recruitment procedure,
 when you apply without referring to specific open job offer, for example when you
contact us on your own initiative via email, job search platforms, our website, or in person;
 when you fill in forms and questionnaires prepared by us and provide your personal data for the purposes of our future recruitment procedures (e.g. during job fairs).
In some cases, personal data processed by us are not collected or received directly from you, but from third parties. This is especially valid where we actively search for new employees and partners. We may receive your personal data from the following sources:
 recruitment agencies;
 professional social networks, platforms, and webpages – we may process very limited information you made publicly available where it is clear from the context of the network, platform or webpage and the nature of the information provided that it is published for recruitment purposes;
 personal recommendations – usually such recommendations come from natural persons
(Friends of Lab 08) with whom you have personal contact and are not provided to us in a systematic way. We do not process personal data provided via personal
recommendations if we become aware that you object to such processing; in such a case we will erase all information about you immediately. To secure the exercise of rights of the recommended persons under the applicable personal data protection legislation, we ensure traceability of the persons who provide recommendations, i.e. we retain
information that a particular person provided a recommendation. We keep the
information about the persons who provide us with a personal recommendation for the
term for which we keep the personal data of the person who they recommend to us and
we process these data on the basis of an legitimate interest under Art. Such persons have the rights under p. VIII below.
VI. How long will your personal data be stored?
Personal data of job candidates will be processed during the recruitment procedure to which the respective job application relates and may be then stored for no longer than 6 (six) months after the completion of this recruitment procedure. The above is not applicable where the personal data is provided outside of a particular recruitment procedure (i.e. spontaneous applications, personal recommendations) or where we have received your explicit consent for longer
retention of your personal data. Personal data provided to us outside of a particular recruitment procedure (i.e. spontaneous applications, personal recommendations) will be stored by us for up to 6 (six) months upon their receipt. Personal data which we receive and process on the basis of your explicit consent will be processed until its withdrawal and/or for the periods specified in the respective consent. In case of a legal dispute or proceedings requiring data retention and/or at the request of a competent state authority, data will be stored until the final settlement of the dispute or the proceedings before all instances.
The storage duration may also vary depending on amendments to applicable legislation.
VII. Who can have access to your personal data?
Your data may be shared with:
 entities processing personal data on our behalf, such as IT service providers, recruitment agencies, recruitment platforms (e.g. LinkedIn Recruiter). These entities will process your personal data on the basis of agreement with us and only according to our documented
 service providers such as telecommunications and post service providers (for the
purposes of the necessary communication with you);
 law firms, public notaries;
 competent public and judicial authorities, if applicable.
 upon explicit consent – other categories of recipients explicitly specified in the consent.
No transfers of data outside the European Economic Area
Your personal data will not be transferred to third countries, i.e. countries outside the European Economic Area.
VIII. What are your rights with respect to the processing of your personal data?
You are entitled to the following rights concerning the processing of your personal data by Lab08:
 Right of information: to be provided with information regarding the processing of your personal data by us. The present Information Notice has been prepared and made
available to you with respect to this right.
 Right of access: to obtain confirmation as to whether personal data relating to you is being processed, as well as to be provided with access to these data, including to request a copy of the data;
 Right to rectification: to require your personal data to be rectified or completed if the data are inaccurate or incomplete;
 Right to erasure: to require your personal data to be erased if there are grounds for this provided for in the applicable data protection legislation;
 Right to restriction of processing: to require restriction of the processing of your personal data within the limits provided for the applicable data protection legislation if there are grounds for this set forth therein;
 Notification of third parties to whom your personal data has been provided of any
rectification, erasure, or restriction of processing unless this proves impossible or involves disproportionate effort on our part;
 Right to data portability (if applicable): to receive the personal data which you have provided to us, in a structured, commonly used, and machine-readable format and to
transmit these data to another controller without any hindrance if there are grounds for this provided for in the applicable data protection legislation;
 Right not to be subject to a decision based solely on automated processing, (i.e. without human intervention), including profiling within the meaning of the applicable data
protection legislation. For avoidance of any doubt we do not process your personal data in such a manner.
 Right to lodge a complaint with a data protection supervising authority if you consider that the processing of your personal data infringes provisions the applicable data
protection. The data protection supervising authority in the Republic of Bulgaria is the Commission for Personal Data Protection, with its registered address: 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, website:
 Right to object to the processing of your personal data if it is performed by us on the grounds of a legitimate interest.
 Right to withdrawal of consent: To the extent in which certain of your data is processed on the basis of your consent, you also have a right to withdraw your consent at any time. Upon withdrawal of your consent we will stop the processing of your personal data which we process on the basis of this consent. Consent withdrawal has no influence on the
lawfulness of the processing carried out on the basis of the consent before its withdrawal. To exercise the abovementioned rights, please use the contacts specified in this Information Notice.