Privacy Notice

Data processing for employment applications and hiring processes

Effective as of 1 July, 2026

1. Introduction

Each company listed in section 1.1 as a member of the AutoWallis Group, acting as the data controller (hereinafter: Data Controller), considers it of utmost importance to ensure and protect the rights of its customers, employees, and all individuals who come into contact with it (hereinafter: Data Subjects) regarding their personal data.

Out of a commitment to ensuring the fullest possible enforcement of these rights, and in compliance with the legal requirements applicable to data controllers, the Data Controller outlines the details of its data processing activities in this privacy notice (hereinafter: Notice).

Please be aware that this Notice's provisions only apply to data related to natural persons.

1.1. Data Controllers and Contact Details

1.2. Data Protection Officer and Contact Details

The Data Controller, along with other companies within the AutoWallis Group, employs a joint Data Protection Officer in accordance with the authorization outlined in Article 37(2) of the GDPR.

Email address: adatvedelem@autowallis.com

1.3. Purpose of this Notice

The purpose of this Notice is to answer the following questions.

• What personal data we collect about you when we process your personal data,
• For what purpose and on what legal basis do we do this,
• How long do we store the data,
• Do we transfer it to others,
• What rights and remedies do you have regarding data processing.

1.4. General Rules for Data Processing

Source of data

We typically obtain personal data directly from the Data Subject. In cases where personal data is collected through alternative methods, we shall inform you accordingly within the relevant data processing section notice.

Data transfers to third countries

In accordance with standard business practices, as a data controller, we utilize the services of providers located in third countries outside the EEA. Due to their headquarters in these third countries, the personal data processed through these services may, in certain instances, be transferred outside the EEA. For example, in the case of Microsoft Office software or the LinkedIn platform, such transfer may involve the United States. From a data protection perspective, we continuously oversee the compliance of these service providers and their services. This includes verifying whether these providers are registered in the EU-US Data Privacy Framework. In accordance with our internal data protection standards and the expectations imposed upon us, we engage only with service providers who guarantee substantively their compliance with data protection regulations.

Profiling or Automated Decision-Making

We generally do not use profiling or automated decision-making in our data processing. If we do, we will specifically inform you about this in the relevant data processing details.

Data processors

Our subcontractors with access to personal data commit, through contractual guarantees, to follow our instructions regarding data processing and adhere to applicable data protection laws.

---

2. Description of specific Data Processing activities

Below, we detail each Data Processing activity:

• General communication
• Data processing related to employment applications and hiring
• Enforcement of data subject rights

2.1. General communication

Purpose and Legal Basis of Data Processing

The purpose of communication is to address questions arising in connection with our services and general business activities. This includes responding to and handling all inquiries regarding the operation of our business and technical information. Legal basis for data processing - GDPR Article 6(1)(f): the Data Controller's legitimate interest in maintaining contact.

As a Data Subject, you can object at any time to the processing of your personal data based on legitimate interests.

Scope of processed personal data

• Name (identification data)
• Email address / mailing address / phone number (contact information)
• Other personal data provided in the inquiry

Retention period for personal data

We retain the data for five (5) years after the last contact or until an objection is raised against it, whichever comes first.

Data processors

• IT service provider
• Social media provider (if you contact us through it)

Recipient of data transfer

• AutoWallis Nyrt.

2.2. Data Processing for employment applications and hiring

We are excited about your interest in joining our team and applying for one of our available positions. During the selection process, we mainly handle your name, email, phone number, resume, and any other personal details you give us.

Purpose and Legal Basis of Data Processing

If you apply for one of our job openings, we collect and process your personal data to manage the selection process and fill the advertised position. This data processing includes accepting applications; communicating with you as a candidate (such as scheduling and conducting interviews); verifying and assessing your qualifications against the application requirements; and monitoring the progress of the selection process.

You can submit your application to us in several ways. For example, you can apply through job portals, by email or mail using our central contact information, or via the HR Cloud system that supports recruitment.

Legal basis for data processing – GDPR Article 6(1)(f): the Data Controller's legitimate interest in successful recruitment.

To monitor the status of your application and the selection process, you can register as a user in HR Cloud. In this case, we process your personal data to facilitate registration and account creation in order to fulfill the contract concluded with you—Article 6(1)(b) of the GDPR.

In this case as well, we process your application and the data you upload in connection with it based on our legitimate interest.

As a Data Subject, you can object at any time to the processing of your personal data based on legitimate interests.

Providing your personal data is not required to create an account (as data processing is based on a contract), but we cannot set up your user account without it.

Scope of processed personal data

• Basic data: name, email address, phone number.
• Identification data: place and date of birth, photograph.
• Data necessary for selection: resume, references, certificates, presentation of identification documents (if needed).
• Any other data provided: any additional personal information that you voluntarily share with us as a Data Subject.

Important: Applications do not require any special categories of personal data, such as racial or ethnic origin, political opinions, religious or philosophical beliefs, or health information. Please refrain from including such data.

Source of personal data

• Data Subject (in connection with the application, the data subject determines whether to provide data and the extent of such data).
• Headhunter
• Employment Agency (outsourced recruitment activity)
• Job portal
• LinkedIn
• Internal referral
• Employee referral program
• HR Cloud

Retention period for personal data

We process your data for six months after the selection process ends. If you have registered with HR Cloud, we will keep the data stored there as long as your account remains active or for three years after your last activity on your account. After that, we will delete your personal data.

If you are not chosen for a specific position but would like us to keep your data for a future application, we ask for your consent to this additional data processing. In this case, we will process your data for this purpose until you withdraw your consent or for up to one (1) year, after which it will be deleted during the first annual data purge following that period.

Data processors

• IT service provider
• Server provider
• Headhunter, recruitment agency
• Job portal
• HR Cloud

Recipients of data transfers

• AutoWallis Plc.
• In relevant cases (if you are a likely candidate for an open position), the member company(ies) of the AutoWallis Group.

2.3. Exercising Data Subject Rights

Purpose and legal basis of Data Processing

If you contact our company as a Data Subject regarding your personal data, we process your data to respond to your inquiry, uphold your rights, comply with data protection regulations, and ensure accountability. Legal basis for data processing - GDPR Article 6(1)(c): Compliance with a legal obligation the Data Controller is subject to.

Scope of processed personal data

• Name
• Email address
• Content of the inquiry
• Data provided by the data subject in the context of exercising their rights
• Other personal data obtained during identification, etc.

Retention period for personal data

5 years from the date of receipt of the data subject's request.

Data processor

• Server provider

Recipients of data transfer

• AutoWallis Nyrt.
• DPO

---

3. Rights of Data Subjects

As a data subject, you may, using the contact details provided above (1.1 and 1.2), request information about the processing of your personal data and access such data. You can also request the rectification of your personal data or—except for data processing necessary to enforce mandatory or legal claims—their erasure, withdrawal, and, where applicable, exercise your right to data portability. You may object to data processing based on legitimate interests at any time. To be recognized as a data subject, you must properly verify your identity (e.g., at a minimum, by writing from the email address you used to register).

Upon your request, we will provide the requested information without delay, but no later than one month from receiving your request—provided the request is not unfounded or excessive—free of charge.

Right to information

We provide information about data processing details in a clear, transparent, and easily understandable way, using plain language. This document has been prepared in summary form for this purpose.

The Data Subject's Right of Access

You have the right to request a response from us about whether your personal data is being processed. If you provide sufficient proof of your identity and we are processing your personal data, you are entitled to receive information about the data processing details and to get a copy of your personal data.

Right to Rectification

Any data subject can request correction of their personal data processed by us if it is inaccurate for any reason or ask for incomplete data to be completed. We may ask for additional information to clarify.

Right to erasure (Right to be Forgotten)

You have the right to request the deletion of your personal data if any of the following conditions apply:

• if the data is no longer needed for the purpose it was collected;
• if you have withdrawn your consent and there is no other legal basis for processing;
• if you object to the processing and we have no other legitimate grounds for processing that override your interests;
• if the processing of the data is found to be illegal; or
• if we are legally required to delete the data.

Right to Restriction of Processing

You can request to restrict the processing of your personal data in situations outlined by the GDPR. For example, while verifying the accuracy of your data or if you request to retain data that would normally be deleted, in order to assert a legal claim. If data processing is restricted, we will only store your personal data, and will only process it further in exceptional cases. We will also notify you in advance before lifting the restriction on data processing.

Right to Data Portability

You have the right to receive your personal data from us in a structured, commonly used, machine-readable format and to transfer this data to another data controller. We can usually fulfill such a request in MS Word or Excel format. You also have the right to data portability if the data processing is automated and the legal basis for processing is either your consent or the performance of a contract.

Right to Object

You have the right to object at any time, on grounds related to your specific situation, to the processing of your personal data based on the Data Controller's legitimate interests. The Data Controller may continue processing the data only if there are compelling legitimate reasons for doing so or if it is necessary for establishing, exercising, or defending legal claims.

Right to withdraw consent

When we process your data based on your consent, you have the right to withdraw that consent at any time. If you do, we will stop processing your data. Withdrawing consent does not affect the legality of data processing that occurred before your withdrawal.

---

4. Procedural rules, Remedies

Procedural rules

If you exercise any of the data subject rights described above, we will notify you of the actions taken in response to your request, or, if no action is taken, the reason why, without undue delay and in any event within one month of receiving the request.

If necessary, considering the complexity of the request and the number of requests, this deadline may be extended by an additional two months. We will notify you of any extension of the deadline—explaining the reasons for the delay—within one month of receiving your request.

No matter the submission format of your request, our response will be sent via email unless you explicitly ask for a different method.

We will notify all recipients to whom we have shared your personal data of any corrections, deletions, or restrictions on processing that we have made, unless this proves impossible or involves a disproportionate effort. At your request, we will also inform you of these recipients.

Remedies

In the process of managing, recording, processing, and transferring the personal data of Data Subjects, the Data Controller complies with Regulation (EU) 2016/679 of the European Parliament and of the Council, the General Data Protection Regulation (“GDPR”), as well as other legal provisions and official recommendations related to data protection recruitment.

DPO - As a data subject, you may contact our Data Protection Officer with any questions, comments, or complaints regarding data processing using the contact details in Section 1.2.

Supervisory Authority - If you believe that we have violated your rights to data self-determination, you are entitled to submit a complaint to the Data Protection Authority at:

Court - As a data subject, you can also file a lawsuit if you believe your personal data is being processed in violation of the laws or legal acts of the European Union related to data processing.