INFORMATION MEMORANDUM ON PERSONAL DATA PROTECTION
AND THE CANDIDATE’S CONSENT STATEMENT
REGARDING THE PROCESSING OF HIS/HER PERSONAL DATA


In accordance with the provisions of EU Regulation No. 679 of April 27th, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as “General Data Protection Regulation” or “GDPR”), of the internal regulatory acts approved in view of the implementation of the EU General Regulation, the Company KMGR Services Center SRL, an entity within the KMG International Group, having on the one hand the capacity of Data Processor of the KMG International Group (www.https://rompetrol.kmginternational.com), but also of the 
Agents operating the Rompetrol Downstream SRL gas stations – personal data controllers, and, on the other hand, the capacity of personal data controller, processing, on own behalf, your personal data, provided by creating the account and/or by sending your Resume/information, processing which shall be performed in safety conditions, in good faith, and in compliance with the legal provisions in force, exclusively for the fulfillment of the purposes specified.


In your capacity of person interested on the recruitment/internship announcements published on the website careers.kmginternational.com (hereinafter known as "Data Subject" or “Candidate”) during the recruitment process of one of the entities within the KMG international Group or of one of the Agents operating the gas stations of Rompetrol Downstream SRL (hereinafter "the Company" or “Controller”), the company brings to your attention, expressly, by the herein Information Memorandum, in compliance with articles 12 and 13 of GDPR, with regards to the processing and storage of your personal data in the conditions described, as follows:


1. Personal data:


(a)   General Information on the registration of the Resume in our database: name, first name, date of birth, marital status, telephone number and email address, nationality, citizenship, gender and details, and details on any disabilities or work restrictions, photo of the data subject, any other information contained in the resume.
(b) Selection checks: Recommendations/request for recommendation, interview notes, records/results of the verification/tests, including technical and psychometric tests (measures the abilities, skills, behaviors or personality traits of the Data Subject).
(c)   For hiring purposes only, data on conflicts of interest: information on holding shares in the companies, if the case, your conflict of interest form, as well as other information resulting from the analysis performed, as the case may be, in compliance with article 6 para. 1) letter a) and f) of the General Data Protection Regulation, respectively based on your consent and for accomplishing a legitimate interest of the controller in order to observe the integrity policies of its personnel.
(d)   Your picture : in the case of the video surveillance made by the video surveillance cameras installed at the Controller’s headquarters, or at the headquarters where the recruitment process shall be carried out, as specified by the Company, in the recruitment announcement or in any communication or for the release of the access card.


2. Personal data processing purposes:


Your personal data is processed by the Controller for human resources purposes, for purposes related to the recruitment and selection process, in your capacity of Candidate, for occupying one of the existing or future vacancy jobs/functions/positions or for the carrying out of an internship program at the level of the Company and, if the case, in view of its results, you data processing shall be performed with a view to fulfilling the potential undertakings required to this end, as per the legal provisions applicable, as follows:


(i)   With a view to performing the recruitment and selection process organized by the Controller for the future/vacancy positions or for the internship program for which you are evaluated in order to determine if you are fulfilling the criteria requested for the conclusion of an individual labor agreement or of an internship agreement with the Controller, in compliance with article 6 para. 1) letter b) of the EU General Data Protection Regulation, respectively of article 6 para. 1) letter a) of the EU General Data Protection Regulation, the consent for participation in the recruitment process being acquired by the candidate’s application for the position the latter is evaluated for;
(ii)   With a view to performing the recruitment and selection process organized by the Controller for the future/vacancy positions or for the internship program for which you are evaluated in order to determine if you are fulfilling the criteria requested, including the use of results of the verifications/tests, including technical and psychometric tests (measures the abilities, skills, behaviors or personality traits of the Data Subject), in compliance with article 6 para. 1) letter f) of the EU General Data Protection Regulation (legitimate interests of the Controller to evaluate the professional competencies and personal traits in relation with the requirements of the job position),
(iii)   For the keeping of your Resume, of the interview notes, of the technical tests, including their results or of psychometric tests, of the interview report, but also of all the information communicated, in the Controller’s database, for potential similar vacancy positions, in the case where you were not selected to be hired, for the purpose of being contacted for the participation in future recruitment processes, as per article 6 para. 1) letter a) of the EU General Data Protection Regulation,
(iv)   For the performance of the legitimate interest of the Controller, as per art. 6 para. 1) letter f) of GDPR, such as video surveillance with a view to ensuring the protection of the goods and of the persons, for the performance of the reporting at the level of the Company or to other competent authorities and bodies, etcetera or with a view to ensuring the access in the office/offices of the Company,
(v)   In the case where the Controller shall decide upon processing your personal data for other purposes, namely based on article 6, paragraph 1, letter a) of the EU General Data Protection Regulation, and of the internal normative acts approved in view of implementing the EU General Regulation, respectively based on your consent, you will be sent a separate information memorandum, thus allowing you to express your consent, freely.


3. Data processing duration:


During the purposes related to the human resources activity, your personal data will be stored for a limited period of time in a safe place, in compliance with the legal conditions and provisions, as follows:


(a)   In the case where you are not selected to be called for an interview or if you have participated in an interview, but you have not been selected (recruitment for a vacancy position or for an intern position during the internship program, following to be carried out at the level of the Company), with your consent or until the retraction of your consent, the data in your resume, as well as the notes and the interview report, but also all the information communicated by you shall be kept for 6 months from your last login on the website careers.kmginternational.com.   You have the possibility, at any time, to retract your consent by deleting your personal data from the application, as follows: See profile/Options/Settings/Profile Deletion
(b)   Data on psychometric tests shall be kept 6 months from the completion of the recruitment process.  
(c)   Data on video surveillance for ensuring the security of the goods and persons shall be stored for a period of at most 30 calendar days, respectively in compliance with the grounds provided for by the law in force.

 

4. Data Processors/Data Recipients/Associated controller:


Your personal data may be processed by the following persons, with the observance of the law on personal data protection: 


i.    The Companies within the KMG International Group performing activities for the Company in the domain of work relationships or to which the Company reports the results of its activity, respectively, but not limited to KMGR Services Center, KMG Rompetrol S.R.L., Rompetrol Downstream, Rompetrol Rafinare, and Rominserv.
ii.   Agents operating the gas stations of Rompetrol Downstream SRL or of other entities within the KMG International Group, in their capacity of Controller in the case where the application is submitted for an open position within the gas stations;
iii.   IT services and systems providers, such as Total Soft S.A., SAP, or archiving providers such as Global Archive Management S.R.L., GREAT PEOPLE INSIDE SRL, 42 Organizational Assessment, Predictive INDEX, LLC, all the companies under these categories with which the Company shall contract this type of services and which have taken adequate safeguarding measures, as per the legal provisions, in order to ensure that they are observing their obligations on personal data protection. In the case where associated controllers subcontract part of their activities involving the processing of personal data, the subcontractors shall be subject to be same obligations with regards to the implementation of the security, technical, and organizational measures provided for by the EU General Data Protection Regulation, but also of the internal normative acts approved with a view to implementing the EU General Regulation;


5. Personal data transfer:


Personal data may be transferred (e.g. accessed, consulted, etcetera) to other companies within the KMG International Group headquartered in countries outside the EU, on the basis of your direct application for a vacancy position within the respective entity or of your contacting, with a view to initiating, concluding, and developing certain labor or internship contracts, and/or projects with those companies. To this end, the guarantees provided for by articles 44-49 of the General Data Protection Regulation shall apply.


6. Your rights with regards to personal data:


Furthermore, we wish to inform you that, as per articles 12-22 of the EU General Data Protection Regulation and of the internal normative acts approved with a view to implementing the EU General Regulation, you have the following rights:


i.   the right to information and to access your personal data;
ii.   the right to the rectification of your data;
iii.   the right to be forgotten /the right to data deletion;
iv.   the right to restrict the processing;
v.   the right to data portability; 
vi.   the right to object to the processing of your data, in the case of the personal data processed in accordance with Article 6 paragraph 1) letter e) or f), including the creation of profiles based on these provisions, respectively for the fulfillment of a task performed for public interests or within the exercise of an official authority with which the data controller is vested, respectively to the Company’s legitimate interests;
vii.   the right not to be subject to any individual decision, which means that you have the right to request and obtain the retraction, cancellation and reconsideration of any decisions which produces legal effects on you, adopted solely based on an operation of personal data processing through automated means, for the purpose of assessing personality traits, such as professional skills, credibility, your conduct at the workplace;
viii.   the right to withdraw your consent (approval) at any given moment, without it having an impact on the processing performed based on your consent before its retraction;
ix.   the right to notify the National Supervisory Authority for Personal Data Processing or any competent courts of law.
In order to exercise all these rights, you may contact the Company by a request sent at the email address DataProtection@rompetrol.com (Romania), RPBDPO@rompetrol.com (Bulgaria). Your request will be analyzed, and you will receive a reply within at most 30 days from the receipt of your request by the Company, as per the EU General Data Protection Regulation and the internal normative acts approved with a view to implementing the EU General Regulation. The term mentioned herein before for sending a reply may be extended in accordance with and with the observance of the legal provisions. 


7. Other aspects:


The controller guarantees the fact that your data is processed legitimately, by concurrently implementing adequate technical and organizational measures for ensuring the integrity and confidentiality of the data as per articles 25 and 32 of the EU General Data Protection Regulation.
The candidate has the obligation to observe the above mentioned law on personal data protection, by using the personal data solely within the limit necessary for the purpose considered.  


I understand that the consent with regards to the processing of my personal data for the purposes mentioned herein above represents my option, expressed freely and specifically, being fully informed on the processing operations of my personal data.