Job Applicants Privacy Notice

vAeroLabs AD, hereinafter referred to as “vAeroLabs”, "Company", "we", "us" and "our", are committed to protecting your privacy and your concern about it.

This Job Applicants Privacy Notice (the “Notice”) describes the privacy practices that apply to our collection, use, protection and storage of personal information submitted from applicants for employment with the Company, as well as what are your rights with regard to your personal information. We take care to process and use your information responsibly - we undertake not to use the data you provide for purposes other than the Company's recruitment goals, and, in case of the job selection process is successful, employment records and other administration of employment relations or for a term longer than you have agreed to.

For the purposes of this Privacy Notice “job applicant” shall mean anyone who applies for an open position on the website of vAeroLabs (https://vaerolabs.com) or the following job platforms: Jobs.bg, Dev.bg, LinkedIn, or any job platforms that we choose to cooperate with in the future or contacts vAeroLabs via e-mail indicating that they wish to take part in a job application process, while “employee” shall mean any Bulgarian or foreign individual that is currently working or has worked under an employment or other civil contract concluded with the Company.

The processing of your personal information will be performed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 or General Data Protection Regulation (the “Regulation”), the Bulgarian Personal Data Protection Act and all the applicable data protection legislation.

1. Name and Address of the Controller

The Controller of personal data, provided with the submission of your CV or with the conclusion of your employment contract with us, is vAeroLabs AD, a joint-stock company registered in the Commercial register and register of NPLE with the Bulgarian Registry Agency under UIC 207520607, with its registered seat and business address at: 4 Racho Petkov Kazandzhiata Str., entr. A, fl. 2, Business Building Alfa, r.a. Sofia Park, Sofia 1766, Bulgaria, Email: legal@vaerolabs.com.

2. Categories of Personal Data collected

The categories of data we collect from job applicants are the following:

In order to participate in the recruitment process for specific job position or to be considered your application for any future position, if you have requested so, we ask you to provide the personal information about yourself which you provide on voluntary basis and to the extent determined by you, by submitting your CV, cover letter or other document upon your discretion. However, certain personal information may be necessary to complete an evaluation of your application and if it is not provided, our ability to consider you as a candidate may be limited. Examples of that type of personal information:

• personal data to identify and connect with the job applicant: name, city and country of residence, email address and telephone number, CV;
• personal data you specify in the enclosed CV that allow the evaluation of your skills and qualities with the criteria, listed in the vacancy notices: educational and employment background, including information for previous employers, type and period of previous employment; main responsibilities; job qualifications; language skills and qualifications;
• additional supporting documentation (portfolio, projects description, related pictures, etc.) you elect to provide.

You may also decide to share other information that you may consider important and relevant to the evaluation process, namely:

• information about other skills, competences and qualifications;
• references from your previous employers, teachers, tutors and others;
• information about hobbies, interests, activities.

In some cases, job applicants may decide to share categories of personal data, which are “sensitive” under the meaning of applicable legislation, for example: personal data revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union or organization membership, organizations with religious, philosophical, political or trade union purposes; information regarding health and sex life of the job applicant. In other cases, job applicants may decide to share their identity document information (like number, expiry date) or personal identification number. As far as these data are not relevant to the evaluation process and are not necessary to the Company, we recommend that you do not include them in your CVs and other documents you share, applying for a particular or future position with us. In case that despite our recommendations, you have provided us with such personal data, we believe that this has been done voluntarily, on your own initiative and with your consent, and we will store and process these data with due care and in compliance with all the requirements of the applicable legislation.

The Company may obtain information about job applicants from other sources, to the extent permitted by the applicable law, such as through your contact with us or from third parties such as employment agencies and other websites on the Internet. For example, you may choose to provide us with access to certain personal data stored by third parties such as social media sites like LinkedIn. By authorizing the Company to have access to this information, you agree that Company may collect, store and use this information in accordance with this Notice.

We remind you that in all of the above cases you have the rights under Section 6 regarding this information.

The legal basis for processing of applicant's personal data shared in the course of a recruitment procedure could either be their explicit consent (as per Article 6, Para. 1, (a) of the Regulation) or if the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract (as per Article 6, Para. 1, (b) of the Regulation). In limited cases, the legal basis for processing could be the legitimate interest of the Company, acting in the capacity of an employer and as described in Section 5, Para. 3 below (as per Article 6, Para. 1, (f) of the Regulation) - e.g. in case of initiating legal claim before competent authority or for the purposes of ensuring proper defense in case such legal claim is initiated against the Company, or in case of data processing for the purposes of ensuring protection for Company's property, information and personnel.

3. How we use your personal data?

The purposes for which we use the personal data from job applicants are the following:

• to process and evaluate your application when making hiring decisions;
• to communicate with job applicants and provide information about current and future career opportunities with the Company (only if you actively and voluntarily opted-in for such correspondence);
• to manage and improve the hiring processes with the Company;
• for the fulfillment of the Company's legal obligations, including the fulfillment of statutory obligations to preserve or provide information upon the receipt of an appropriate order by competent state or judicial authorities;
• to establish a basic employment record, in case you are hired.

4. To whom personal data is shared or disclosed

Your personal data are processed by the Company for the purposes described above. We may disclose the personal data listed in Section 2 to the extent that we consider such disclosure to be necessary for the fulfilment of these purposes to the following recipients:

• with third parties and suppliers who provide services to the Company such as development and maintenance of IT systems, software and hardware, used when processing of personal data and external advisors acting as controllers (e.g., lawyers, auditors etc.) or processors (e.g. accountants), based on Art. 6 (1) (f) GDPR;
• to competent authorities, establishments and persons who are authorised to require the provision of personal data and to whom we are obliged to provide personal data under the applicable legislation (e.g. courts, state or municipal administrative authorities);
• to other companies part of the corporative group of the Controller for the purposes of our legitimate interest as provided under Art. 6 (1) (f) GDPR - e.g. in case of necessity to coordinate your appointment on a specific position (with multinational relevance or other).

We do not perform transfers of personal data within the meaning of the Regulation. If, however, in any of the cases described above, the sharing of personal data is performed outside the EEA, the Company will perform it only after ensuring that the applicable level of protection of personal data corresponds to the level of protection ensured within the EEA, in particular through the implementation of standard contractual clauses, approved by the European Commission or contractual clauses previously approved by the relevant supervisory authority.

5. Personal Data Retention Periods

We retain your personal data in accordance with the applicable law and with respect to the “storage limitation” principle. For the purposes of the recruitment procedures, we store job applicants' personal data during the whole process of selection.

If no employment contract is concluded with the job applicant, the application documents will be erased within six months of the completion of the selection procedure (after notification for rejection of the application) unless we have received express consent from the job applicants to keep their application details for a longer period.

An exception to the above rule relates to such data from the job application that provide proof that the Company has complied with the legal requirements for non-discrimination during the application process, e.g. candidate rankings, orders and other types of records of the performed selection process, if any. These documents that might contain a very limited volume of personal data will be stored for a period of three years, after which they will be erased.

If we conclude an employment contract with the applicant, the submitted data will be stored for the purpose of processing the employment relationship in compliance with legal requirements.

6. You have the following rights in line with the processing of your personal data:

• right to access your personal data (as per Article 15 as of the Regulation): you have the right to obtain confirmation from us as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and information.
• right to rectification of personal data (as per Article 16 as of the Regulation): if you find that personal data that we process about you is inaccurate, you have the right to have us correct such personal data without undue delay;
• right to withdraw your consent for processing of personal data (as per Article 7, Para. 3 as of the Regulation): you have the right to withdraw or decline your consent at any time in case the processing of your personal data is based on your consent. In deciding whether to provide your consent, you should note that, for example, we may not be able to proceed with your application, if you do not provide your consent. Please note that this does not affect the lawfulness of the processing based on consent before its withdrawal.
• right to erasure of personal data (right to be forgotten as per Article 17 as of the Regulation): under certain circumstances, such as if your personal data has been unlawfully processed or you have withdrawn your consent (if the processing of your personal data is based on consent), you have the right to request and obtain erasure of your personal data from us.
• right to restriction of processing (as per Article 18 as of the Regulation): under certain circumstances, such as if you question the accuracy of your personal data or you have objected to our legitimate purpose to process your personal data, you have the right to request that we restrict the processing of your personal data until a solution has been found.
• right to data portability (as per Article 20 as of the Regulation): if your personal data is processed by automated means based on your consent or for the fulfilment of our contractual relationship, you have the right to request that we provide you with personal data on a machine-readable format for transmission to another data controller.
• right to lodge a complaint with the Commission for Personal Data Protection (as per Article 77 as of the Regulation): If you believe that we are violating your rights or the applicable legal framework, please contact us to clarify the matter. In any case, you have the right to lodge a complaint with the Commission for Personal Data Protection through the means of correspondence set out in Section 9 of this Notice.

We do not employ automated decision-making nor profiling when processing your personal data.

7. Right to object to processing

In addition to the rights mentioned under the previous Section, under certain circumstances, such as if you question our legitimate interest to process your personal data or in case you have no further interest of our marketing activity and/or notification, you have the right to object, on grounds relating to your particular situation, to such processing. Your rights are derived directly from the provision of Article 21 as of the Regulation and we will assure their proper satisfaction in any case, except the Regulation provides otherwise.

8. Security of Processing

We guarantee the complete confidentiality of personal data. The personal information of any of the job applicants and current or former employees will not be published anywhere unless they have explicitly has asked for it. As a Controller of personal data, the Company has implemented technical and organizational measures to ensure personal data processed remains secure. However, absolute security cannot be guaranteed, but we maintain security and incident response plans in the event of a physical or technical incident to handle this in a timely manner and limit any negative effect of such incident.

9. How to contact us

If you have any questions or concerns regarding this Privacy Notice, you may write to us at: elitsa@vaerolabs.com

You may also refer to our Data protection officer appointed on a group level, available here: datenschutz@dlh.de

If you are not satisfied with the way we responded to your inquiry/request/complaint, you have the right to lodge a complaint with the Commission for Personal Data Protection. You can contact the supervisory authority at:

email: kzld@cpdp.bg, or address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592

10. Your responsibilities

As we undertake numerous obligations and implement a wide range of technical and organizational measures to ensure the confidentiality of your personal data, you are also required to provide us only with information which is honest, truthful, accurate and not misleading in any way and the sharing of which is not infringing on any rights of any third party.

11. Changes to this Notice

This Notice was last updated on 29.09.2025. We may change it from time to time to reflect changes in the law or our privacy practices. We will keep this notice updated and we will also keep prior versions of it in our archive for your review. You can request a copy of the Notice at any time by sending us an email to: elitsa@vaerolabs.com.