JOB APPLICANT PRIVACY POLICY
 
This Policy is intended for candidates applying for published job vacancies or submitting spontaneous job applications.
 

1. Data Controller

 
Data Controller: IMPULS-LEASING d.o.o.
Registered Office: Velimira Škorpika 24, 10000 Zagreb
PIN (OIB): 65918029671
E-mail: dpo@impuls-leasing.hr
Telephone: 01 3458 555 
 

2. Categories of Data Processed

 
During the recruitment process, we process data provided by candidates in their applications, CVs, cover letters, communications with the Company, or during job interviews. This may specifically include:

• First and last name, address, telephone number, and e-mail address.
• Information on education, qualifications, work experience, knowledge, and skills.
• Information from the CV, cover letter, and other documentation submitted by the candidate.
• Information regarding the progress of the selection process, such as interview notes, eligibility assessments, and correspondence with the candidate.
• Other data necessary for conducting a specific job competition or assessing the candidate for a particular position.

 
Candidates are requested not to provide data that is not necessary for assessing their application, particularly special categories of personal data (e.g., health data, religious or political beliefs, trade union membership, etc.), unless explicitly required or prescribed for a specific position.
 

3. Purpose and Legal Basis for Processing

 
We process candidates' personal data solely to conduct the selection process and evaluate candidates for employment, including receiving and reviewing applications, communicating with candidates, organizing interviews, and making selection decisions.
 
The legal basis for processing is taking steps at the request of the data subject prior to entering into an employment contract. To the extent necessary for the proper conduct of the job competition, communication with the candidate, or demonstrating proper conduct in the selection process, processing may also be based on the legitimate interest of the Company, or for the establishment, exercise, or defense of legal claims.
 

4. Applications via Employment Platforms

 
If a candidate applies through a job board or recruitment platform (e.g., MojPosao), the Company processes the data received through that platform for the purpose of conducting the specific job competition. Job platforms may process candidates' personal data independently in accordance with their own privacy policies, about which candidates should be informed by the platform itself.
 

5. Who Has Access to Data

 
Access to candidate data is restricted to individuals who require it to conduct the selection process, such as human resources personnel, board members, heads of organizational units, and other persons involved in candidate selection.
 
Data may also be processed by technical service providers, employment platforms, IT support, or other data processors, solely to the extent necessary to conduct the competition and subject to appropriate security measures.
 

6. Retention Period and Data Erasure

 
The Company does not retain candidates' CVs after the completion of the selection process and does not use them for other purposes, including future job openings or talent pools.
 

Type of Application	Retention Period
Application for a published vacancy	Until the completion of the selection process, and at the latest within 30 days after the end of the process, after which the application and CV are deleted or destroyed.
Spontaneous application (not linked to an active vacancy)	Solely to check if an appropriate vacancy currently exists; if none exists, the application is deleted or destroyed without delay, and at the latest within 30 days of receipt.
Data of the selected candidate	Data required for establishing employment is transferred to the personnel files and is further retained in accordance with employee policies.

 
Exceptionally, certain data may be retained longer only if necessary to comply with a legal obligation, act upon a candidate's request, complaint, or audit, or for the establishment, exercise, or defense of legal claims.

7. Candidate Rights

 
Candidates have the right to request access to their personal data, rectification of inaccurate or incomplete data, erasure of data, restriction of processing, objection to processing when processing is based on legitimate interest, and, where applicable, data portability.
 
To exercise these rights, candidates may contact the point of contact specified in Section 1 of this Policy. The Company will respond to requests within the timeframes prescribed by applicable regulations.

8. Data Security

 
The Company implements appropriate technical and organizational measures to protect candidates' personal data. Access to data is restricted to authorized persons, and data is not used for purposes unrelated to the specific selection process.
 

9. Lodging a Complaint with a Supervisory Authority

 
If a candidate believes that the Company is processing their personal data contrary to personal data protection regulations, they have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), www.azop.hr.
 

10. Amendments to the Policy

 
The Company may periodically amend this Policy to align with changes in regulations or recruitment procedures. The valid version of the Policy is published on the Company's website or otherwise made available to candidates in an appropriate manner.
 
Effective Date: July 10, 2026