1. Introduction
WERKLIST DOO, Svetozara Radojičića 80V, 11050 Belgrade (Zvezdara), Republic of Serbia, Tax ID (PIB): 115344942, Registration No. (MB): 22144812 (hereinafter: “WERKLIST”, “the Company”, “we” or “us”) attaches great importance to the protection of personal data of all individuals with whom we do business — whether you are a job candidate, a user of our website, a business partner, or an employee.

Through this Privacy Policy, we aim to inform you in a transparent manner about which personal data we collect, why we collect it, how we process it, how long we retain it, and what your rights are in relation to its processing.

This Policy has been prepared in accordance with the General Data Protection Regulation (GDPR — Regulation (EU) 2016/679), the Law on Personal Data Protection of the Republic of Serbia, and all other applicable data protection legislation.

Data Controller:
WERKLIST DOO
Svetozara Radojčića 80V 11050 Belgrade (Zvezdara), Republic of Serbia Tax ID (PIB): 115344942 Registration No. (MB): 22144812

For any questions, requests, or complaints regarding the protection of your personal data, you may contact us at any time via e-mail: fran@werklist.com or by mail to the Company’s registered address with the note “PERSONAL DATA PROTECTION”.

2. What Are Personal Data
Personal data means any information relating to an identified or identifiable natural person (individual). Direct identification means it is clear from the data itself which individual it refers to, while indirect identification means that an individual can be recognized through a combination of multiple available data points.

This Policy applies exclusively to natural persons. Data relating to legal entities is not considered personal data within the meaning of this Policy.

The Company does not collect personal data of minors under the age of 16.

3. What Personal Data We Collect
Depending on the nature of your relationship with the Company, we may collect the following categories of personal data:

3.1. Job Candidates
If you are a candidate seeking employment, whether you have applied for a specific position or registered in our candidate database, we process data that you have provided to us as well as data collected during the candidate search and assessment process:
• Identification data: name and surname, date and place of birth, citizenship
• Contact data: residential/mailing address, phone/mobile number, e-mail address, social media profile URL
• Professional and educational data: curriculum vitae (CV), education details (institution name, qualification obtained, period of study), foreign language skills, computer proficiency, driving license, certificates and special skills
• Work experience data: names of previous employers, job positions held, duration of employment, descriptions of projects worked on
• Employment data: desired positions, availability, expected salary/compensation
• Assessment results: results of any knowledge and competency tests conducted as part of the selection process
• Photograph: only if you have voluntarily attached it to your application

3.2. Business Partners
If you are our business partner or a representative/employee of a business partner, we process:
• Name and surname, position/function within the company
• Contact data (e-mail, phone, business address)
• Company name and tax identification number
• Other data relevant to business cooperation (education, level of expertise, etc.)

3.3. Website Visitors
When you visit our website, we may collect:
• Technical data: IP address, browser type and version, operating system, screen resolution, time and duration of visit
• Cookie data: data resulting from the use of cookies on the website (see Section 9 for details)

3.4. Contact Forms and Communication
If you contact us via a contact form, e-mail, or other communication channels, we process the data you have entered: name and surname, e-mail address, phone number, reason for contact, and the content of your message.

4. Purposes of Personal Data Processing
We process your personal data for the following purposes:

4.1. For Candidates
• Determining your interest in finding employment and including you in our candidate database
• Conducting the candidate selection and assessment process (organizing interviews, testing, competency evaluation)
• Matching candidates with appropriate employers, i.e., presenting candidates to companies to which they will be assigned after employment
• Communicating with candidates during and after the selection process
• Contacting you regarding new employment opportunities matching your profile (with your consent)
• Sending notifications about employment opportunities, newsletters, and other marketing content (with your consent)
• Fulfilling legal obligations related to employment (work permits, tax regulations, records)

4.2. For Business Partners
• Fulfilling contractual obligations and taking actions related to the conclusion and execution of contracts (including issuing invoices, sending offers, etc.)
• Maintaining the business relationship and communication
• Determining satisfaction with our services

4.3. General Purposes
• Improving our services and user experience on the website
• Ensuring the security of our network and information systems
• Fulfilling legal obligations (responding to data subject requests, requests from competent authorities)
• Protecting the Company’s legitimate interests

5. Legal Basis for Processing
We process your personal data exclusively on the basis of one or more of the following legal grounds:
• Performance of a contract: where processing is necessary for the performance of a contract to which you are a party or for taking steps at your request prior to entering into a contract.
• Legal obligation: where we are required to process data in accordance with applicable regulations (tax legislation, labor regulations, accounting regulations, etc.).
• Legitimate interest: where processing serves our justified business interests, provided that your rights and freedoms do not override them (e.g., the process of finding and selecting candidates for employment, service improvement, network security).
• Consent: for processing for which you have given us explicit consent (e.g., receiving newsletters, marketing notifications, or being contacted regarding future employment opportunities). You may withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

6. Sharing Personal Data with Third Parties
We treat your personal data as a business secret. We do not sell your personal data nor disclose it to third parties for their own purposes.
We may share your data with the following categories of recipients:
• Employers and clients of our services — companies for which we seek workers, to whom we may present your candidate profile. Sharing is carried out within the selection process for which you have applied or given consent.
• Partner agencies and affiliated companies — if we determine they have open positions for which you would be a suitable candidate.
• Service providers — third-party IT service providers, accounting, postal, archiving, and similar service providers who process data exclusively according to our instructions and on the basis of appropriate data processing agreements.
• Competent authorities — government bodies, courts, tax administration, and other competent authorities when required by law or by official duty.
• Advisors and auditors — professionals who provide us with legal, accounting, or auditing services, to the extent that access to data is necessary for the performance of those services.

When using digital services of major technology companies (e.g., Google, Microsoft, etc.), the Company accepts their terms of use. Although we cannot fully verify the handling of your data by these companies beyond the guarantees they provide, we strive to minimize risks by applying technical measures such as pseudonymization.

7. Transfer of Data to Third Countries
Your personal data is generally processed within the European Economic Area (EEA) and the Republic of Serbia. If an exceptional transfer of data to third countries (outside the EEA) occurs, we ensure an adequate level of protection by applying Standard Contractual Clauses approved by the European Commission or other applicable safeguard mechanisms.

8. Profiling and Automated Decision-Making
The Company does not carry out automated decision-making based on your personal data, nor does it create data subject profiles for this purpose. None of our decisions are based on automated data processing.

9. Cookies
9.1. What Are Cookies
A cookie is a small text file that a website stores on your computer or mobile device when you visit it. Cookies allow the website to remember your settings and preferences (language, login, etc.) and to adapt content to your needs.
By using cookies, we do not access files stored on your device nor read personal data from the content of cookies.

9.2. Types of Cookies We Use
• Essential (functional) cookies: These are necessary for the basic functioning of the website, such as navigation and access to protected areas. The website cannot function properly without these cookies, and your consent is not required for them.
• Analytical cookies: These help us understand how visitors use the website by collecting anonymized statistical data. We use them exclusively to improve the user experience.
• Functional cookies: These remember your settings and preferences (e.g., selected language) so that you have a better experience on subsequent visits.

We do not use marketing cookies to track users for advertising purposes.

9.3. Managing Cookies
In accordance with applicable regulations, we request your consent for all cookies that are not strictly necessary for the functioning of the website.
You may withdraw your consent for the use of cookies at any time without stating a reason. You may also reject or delete cookies through your web browser settings. Please note that disabling certain cookies may limit the functionality of the website.
Instructions for managing cookies in the most common browsers:
• Google Chrome
• Mozilla Firefox
• Microsoft Edge
• Opera
• Safari

10. Social Media
10.1. Facebook
If you visit our Facebook page, Meta Platforms Ireland Limited and we are joint controllers of your personal data in the context of that visit. Meta processes your data in accordance with its own privacy rules, while we influence this processing only by designating user groups that are relevant to our business.
We receive exclusively anonymized, statistical data from the Meta platform. If you leave a comment or inquiry on our page, we will not separately store your data outside that platform.
We are solely responsible for our posts and messages on Facebook. Meta was not involved in the process of their preparation.

10.2. Other Social Media
The above applies analogously to our profiles on other social media platforms such as LinkedIn, Instagram, YouTube, and similar, and each of these platforms processes personal data in accordance with its own privacy policies.

11. Newsletter
If you have subscribed to receive our newsletter, we process your e-mail address for the purpose of sending the newsletter. The legal basis for this processing is your consent, which you may withdraw at any time.

12. Data Security
The protection of your personal data is of utmost importance to us. We apply appropriate technical and organizational measures to protect your data from unauthorized access, loss, destruction, alteration, or unauthorized disclosure. These measures include, but are not limited to:
• Application of data encryption and modern protection methods
• Access control to data resources containing personal data
• Implementation of data pseudonymization whenever possible
• The principle of data minimization — in each process, we handle only the necessary set of data
• Confidentiality requirements for all employees and associates who access personal data
• Continuous monitoring of all resources used for processing personal data
• Regular security audits and employee training on data protection

13. Personal Data Retention Periods
We retain your personal data only for as long as is necessary to fulfill the purpose for which it was collected or as required by applicable regulations.
• Data subject to mandatory legal retention periods (e.g., accounting, tax regulations): we retain it for the duration of the prescribed period and delete it after its expiration, within a reasonable additional period.
• Job candidate data: we retain it for up to 3 years from the last active communication, unless the candidate requests earlier deletion or withdraws consent. If you were not selected for a specific position and have not given consent for future processing, your data will be deleted after the completion of that selection process.
• Data processed on the basis of consent: we retain it until consent is withdrawn and delete it as soon as possible after withdrawal.
• Data processed on the basis of legitimate interest: we retain it for as long as the legitimate interest exists, and delete it within one year from the cessation of that interest.
• Contact/communication data: we retain it until consent is withdrawn or until the business need for retention ceases.
• Technical data (cookies, IP address, etc.): up to 12 months maximum.

In the event of the initiation of judicial or other legal proceedings, we retain your personal data until the final conclusion of such proceedings, in accordance with applicable regulations.

14. Your Rights
In accordance with applicable data protection regulations, you have the following rights:
• Right of access: You may request confirmation as to whether we process your personal data, access to that data, and information about how it is processed.
• Right to rectification: You may request the correction of inaccurate personal data as well as the completion of incomplete data.
• Right to erasure (“right to be forgotten”): You may request the deletion of your personal data when there is no longer a legal basis for processing or in other cases provided for by applicable regulations.
• Right to restriction of processing: You may request the restriction of processing of your data in certain situations (e.g., if you contest the accuracy of the data, during verification).
• Right to data portability: You may request the transfer of your personal data in a structured, commonly used, and machine-readable format and request their transfer to another controller.
• Right to object: You may object to the processing of your personal data based on the Company’s legitimate interest.
• Right to withdraw consent: You may withdraw your consent for the processing of personal data at any time, without affecting the lawfulness of processing carried out prior to withdrawal.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the competent data protection authority if you believe that the processing of your data has been carried out in violation of applicable regulations.
How to Exercise Your Rights
You may exercise your rights by sending a request to e-mail: fran@werklist.com or by mail to the Company’s registered address with the note “Data Subject Request”. In your message, please indicate which right you wish to exercise and provide data by which we can identify you. Upon receipt of the request, we will send you a confirmation of receipt.
The Company has the right, for the purpose of protecting your data, to verify the identity of the person submitting the request. You may exercise your rights free of charge. However, in the case of frequent or excessive requests, the Company reserves the right to charge reasonable administrative costs or refuse the request.
The Company will respond to your request within one month of receipt. This period may be extended by an additional two months if the request is complex or if a large number of requests have been received, of which you will be notified in a timely manner.

15. Consent Management
At any time, you may amend, partially or fully withdraw your consent for the collection and/or processing of personal data by sending a message to: fran@werklist.com or by mail to the Company’s registered address.
Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal. If you withdraw consent, we will no longer use your personal data for the relevant purposes; however, this may result in the inability to provide certain services or benefits.
Please note that if you do not provide us with personal data necessary for the performance of a contract or the fulfillment of legal obligations, we may not be able to provide you with the agreed services.

16. Use of Digital Services
Personal data that you provide to us through our website, contact forms, job applications, e-mail, or other electronic communication channels is used exclusively for the purposes stated in this Policy and in a confidential manner.
Access to our website is subject to standard technical protocols under which certain technical data is recorded (time of visit, operating system, screen resolution, size of data transferred). This data is used to ensure the functionality and security of the website and to improve the user experience.

17. Protection of Company Interests
The Company reserves the right to protect its legitimate interests and may:
• Take steps to verify the identity of the person submitting a request regarding personal data
• Accept requests only through previously defined communication channels
• Assess the validity and merits of each individual request and, where necessary, refuse requests that are manifestly unfounded or excessive
• Initiate appropriate legal action in the event of abuse of rights

18. Changes to the Privacy Policy
The Company reserves the right to amend this Privacy Policy at any time in order to keep it aligned with current practices and applicable regulations. You will be notified of all significant changes through our website. We recommend that you regularly review this Policy to stay informed about any amendments.

19. Final Provisions
All matters not regulated by this Privacy Policy shall be governed by the provisions of the Law on Personal Data Protection of the Republic of Serbia, the General Data Protection Regulation (GDPR), and other applicable regulations.
Any individual who believes that their rights regarding the protection of personal data have been violated may contact the Company for mediation via e-mail: fran@werklist.com or by mail to the registered address. The Company is obligated to respond to any such request within one month of receipt.
Regardless of the foregoing, every individual has the right to address the competent data protection authority or the competent court for the protection of their rights.

20. Contact
For all questions related to the protection of personal data, please contact us at:

WERKLIST DOO
Svetozara Radojčića 80V
11050 Belgrade (Zvezdara)
Republic of Serbia
E-mail: fran@werklist.com