Privacy policy notice for the Devtech recruitment

(hereinafter: the “Notice”)

Date of publication: 25-07-2025

This document is written in English, which is the official language of the company. If you require this information in Serbian, Macedonian, or Bosnian, please contact us at pc@devtechgroup.com.

DEVTECH DOO NOVI SAD, with registered seat at Bulevar Mihajla Pupina 12, 21000 Novi Sad, CIN: 20856181 TIN: 107709039 together with all its affiliates and subsidiaries:

- Devtech International LLC 95, Third Street, 2nd floor San Francisco CA94103, USA

- Devtech Limited, Tower 42, 25 Old Broad Street, London, EC2N 1HN, United Kingdom

- DEVTEK DOOEL Skopje, Jordan Hadžikonstantinov Džinot St. 3, Skopje, North Macedonia,

- "Devtech" društvo sa ograničenom odgovornošću, Prvog krajiškog korpusa 39, Banja Luka, Republika Srpska, Bosnia and Herzegovina

(hereinafter referred to as the “Company” or “we/us”, or jointly the “Companies” or “we/us”) are committed to protect your personal data and to respect your privacy. The Companies are committed to collecting and further processing your personal data pursuant to the applicable data protection regulations in the countries where the Companies operate.

This Notice is intended to apply to all candidates whose personal data is processed by the Companies across multiple jurisdictions. Unless expressly stated otherwise, the terms and provisions of this Notice apply collectively to all data subjects, regardless of their location. Where deviations or additional requirements exist under applicable data protection law, such differences will be addressed in the appendices to this Notice.

All terms used in this Notice shall be interpreted in accordance with the Applicable Data Protection Law, which refers to all relevant and binding data protection and privacy laws and regulations that apply to the processing of personal data, including but not limited to:

• Law on Personal Data Protection of the Republic of Serbia (“Official Gazette of the RS” No. 87/2018) – Serbian Law,

• Law on Personal Data Protection of Bosnia and Herzegovina (“Official Gazette of Bosnia and Herzegovina” No. 12/25) – BIH Law,

• Law on Personal Data Protection of the Republic of North Macedonia (“Official Gazette of the Republic of North Macedonia” No. 42/20 and 294/21) – Macedonian Law

• The General Data Protection Regulation (EU) 2016/679 (GDPR);

• The UK General Data Protection Regulation (UK GDPR);

• The California Consumer Privacy Act (CCPA), as amended.

Where there is a conflict between the general terms of this Notice and the applicable data protection law in a specific jurisdiction, the applicable law will prevail to the extent of the conflict. 

1. What is this notice for?

We at Devtech manage our employer branding and recruitment process through our career site (the “Career Site”), and by using a related applicant tracking system.

This notice explains the reason for the processing of your personal data, the way we collect, handle and ensure protection of all personal data provided, how that information is used and what rights you have in relation to your personal data.

We act as the “joint data controllers” with respect to the information described in this Notice. This means that we are responsible for deciding how we hold and use personal data about you. Our contact information is provided at the end of this Notice. 

2. To whom is this Notice applicable?

In this Notice, we explain how we process your personal data if:

You visit our Career Site (you being a “Visitor”)

You connect with us via our Career Site, to create a profile with us and receive information about current or future vacancies with us (you being a “Connecting Candidate”)

You apply for a position with us, via our Career Site or a third party service (you being an ”Applying Candidate”)

We collect information about you from other parties, sites and services, since we believe your profile is of interest for our current or future vacancies (you being a “Sourced Candidate”)

We receive information about you from our employees or partners, since they believe your profile is of interest for our current or future vacancies (you being a “Referred Candidate”)

We receive information about you from a Candidate, who lists you as their reference (you being a “Reference”).

When we use the term “Candidate” in this privacy policy, we are referring to each of Connecting Candidates; Applying Candidates; Sourced Candidates; and Referred Candidates, unless it’s stated otherwise. 

3. What personal data are we processing, for what purpose, legal basis, and processing period?

As part of the recruitment process, we will process various types of personal data. The legal basis mentioned in the table below is alternative and can vary based on the jurisdiction where we operate, considering the particularities of the local legislation.

• Purpose: Recruitment Process - assessing your skills, qualifications, and suitability for a certain job position.
• Legal Basis: Taking steps at the request of the data subject prior to entering into a contract, legitimate interest.
• Categories of Data: Name, contact information, CV, cover letter, job preferences, qualifications, professional background, and other data you provide in your application.

• Purpose: Background Checks.
• Legal Basis: Compliance with a legal obligation to which the Company is subject, or Company’s legitimate interest.
• Categories of Data: Employment history, references, criminal record data/previous convictions data (utilized for background screening and vetting purposes where permissible and in accordance with applicable law) or data you made publicly accessible (e.g. your LinkedIn profile).

• Purpose: Interview Process.
• Legal Basis: Taking steps at the request of the data subject prior to entering into a contract, legitimate interest.
• Categories of Data: Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements, interview feedback, communications during the interview.

• Purpose: Legal and Regulatory Compliance.
• Legal Basis: Legal obligation.
• Categories of Data: Identification details, nationality, work eligibility documents (e.g., visa, work permits).

• Purpose: Diversity and Equal Opportunities.
• Legal Basis: Consent or compliance with legal obligations to which the Company is subject.
• Categories of Data: Gender, nationality, ethnicity (optional for diversity purposes).

• Purpose: Potential consideration for future open positions in the Company after the selection process or after the candidate refuses to participate in the selection.
• Legal Basis: Consent.
• Categories of Data: Data contained in your CV/biography .

• Purpose: In order for Company not to contact you again if you do not fit the Company culture or Company does not see the possibility of cooperation for other reasons.
• Legal Basis: Company’s Legitimate Interest. It is also in your interest to keep the data for this purpose so that you do not have to go through the selection process unnecessarily, although you will not be selected for an open position.
• Categories of Data: Name and surname, data from the recruitment process, reasons for non-engagement. 

• Purpose: Processing the Data published on LinkedIn and placing it in the database of candidates so that the candidate would be invited to participate in the selection either for the positions for which he is currently qualifying or for the positions for which he will qualify in the future.
• Legal Basis: Company’s Legitimate Interest.
• Categories of Data: Name and surname, qualifications, publicly available data on LinkedIn.

• Purpose: Ensuring Website Functionality and Performance (To ensure the Career Site works properly across devices, screen sizes, and browsers e.g., adaptive design, compatibility testing); Security and Fraud Prevention (To detect and prevent malicious activity, including abuse, spam, or unauthorized access to the Site); User Experience Optimization (To analyze usage behavior and improve the usability and performance of the Site e.g. which language settings are used most, which pages users drop off on); Analytics and Reporting (To understand how Candidates interact with the site and improve the recruitment process based on aggregated behavioral data e.g., drop-off rates, device usage trends).
• Legal Basis: Company’s Legitimate Interest and Consent.
• Categories of Data: Information about your device, such as IP address, browser type and version, session behavior, traffic source, screen resolution, preferred language, geographic location, operating system and device settings/usage.

• Purpose: User Experience Optimization (To understand how users interact with the site and improve design, layout, and content based on behavior patterns); Performance and Content Analytics (To measure engagement and effectiveness of recruitment content or job postings e.g., which vacancies attract more interest); Technical Troubleshooting and Site Maintenance (To identify issues such as broken links, performance bottlenecks, or confusing navigation); Security Monitoring (To detect unusual patterns that may indicate abuse, bot activity, or other threats).
• Legal Basis: Company’s Legitimate Interest and Consent.
• Categories of Data: Technical and statistical data about your use of the site, such as information about which URLs you visit, and your activity on the site.

• Purpose: Responding to Inquiries and Providing Support (To respond to candidate or user questions, requests, or complaints in a timely and appropriate manner); Maintaining Records for Accountability and Compliance (To ensure a record of communications is kept where required by law or internal policies e.g. dispute resolution, audit trail).
• Legal Basis: Taking steps at the request of the data subject prior to entering a contract and Legal obligation
• Categories of Data: Your communication with us, including the information you provided in the communication. This may include the content of emails, video recordings, messages on social media, the information you add to your account with us, surveys, etc.

The personal data will be used only for the recruitment process and for determining your suitability for a role. 

4. Where are we obtaining your personal data from?

We primarily collect your personal data directly from you through your application, CV, and other documents provided during the recruitment process. In some cases, we may collect personal data from:

Referees: Information such as your previous employment details and performance, if applicable.

Public Sources: For example, LinkedIn or other professional networks, where we may collect your public profile details, including work history, qualifications, and skills.

Third Parties: We may also collect information from third parties, including via referral from the Companies’ employees, your former employers, background check providers, or publicly available resources (such as social media networks).

If you fail to provide personal data when requested, which is necessary for us to consider your application (such as evidence of qualifications or work history), or to enter a contract with you, we may not be able to process your application further.

5. Will we use your sensitive data?

We may collect and process sensitive data such as:

• Disability status: For the purpose of providing reasonable adjustments during the recruitment process (e.g., special accommodations for interviews or tests).

• Nationality or ethnicity: For compliance with immigration laws or for diversity purposes.

We will only use this data where permitted by law and with your consent where required, with purposes limited to what is necessary, if permitted by the applicable legislation.

6. With whom are we disclosing your personal data?

Your personal data may be shared with third parties, including:

• Our recruitment team and hiring managers: To assess your suitability for the role.

• Background check providers: For reference checks or verification of qualifications.

• Our suppliers who provide services and functionality in our employer branding- and recruitment process. For example, this includes recruitment service providers and the supplier of our Career Site and related applicant tracking system.

• Companies providing cookies on the Career Site. If you consent to it, cookies are set by other companies than us, who will use the data collected by these cookies in accordance with their own privacy policy. You can find information about which cookies this applies to in our Cookie Policy.

• Legal authorities or other public bodies: As required by law, such as verifying work permits or immigration status.

All third-party service providers are, where required by law, bound by confidentiality agreements and data protection agreements and are required to process your personal data in line with our data protection policies.

7.  Is your personal data transferred abroad?

The personal data you entrust to our Company may be transferred outside the country of your residence, including third countries. Where required by law, any transfer will be made subject to an adequate contract laying down the conditions of the transfer in accordance with the applicable privacy laws or in accordance with legal provisions. Your personal data will be transferred to the United Kingdom, USA, Serbia, BIH and North Macedonia. The legal basis for the transfer are:

Given that the ​United Kingdom​ have been designated to provide an adequate level of protection of personal data defined under Article 64, paragraph 2 of the Serbian Law, i.e. Article 47 par. 2 of the BIH Law, i.e. Article 48 par. 2 of the Macedonian Law, data transfer may be performed without the prior approval by the competent supervisory authority. Additionally, the Companies have concluded a joint controller’s agreement concerning data processing between the Company’s affiliates.

As for the international transfer of personal data to ​the United States​, the Companies have concluded a joint controller’s agreement between the Companies. The transfer is based on Article 69. par. 1 items 2 and 3 of the Serbian Law, i.e. Article 51 par. 1, items b. And c. Of the BIH Law, i.e. Article 53 par. 1 items b. and c. of the Macedonian Law.

For more information on the content of the agreement between joint controllers, please send an email to pc@devtechgroup.com.

8. For how long are we processing your personal data?

We will retain your personal data for a period of 6 months after the end of the recruitment process if your application was unsuccessful. We retain your personal data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. We further retain such personal data in case a similar role becomes vacant for which you will be a fitting candidate if we have your consent. After this period, we will securely destroy your personal data in accordance with our data retention policy, unless you have consented that we retain your personal data after this period, in which case we will retain your personal data for a maximum of 2 (two) years after the end of the selection process (after which period we will destroy your personal data as explained above). If your application is successful and you enter into an employment relationship, we will retain your data for the period of your employment, i.e., after your employment in accordance with the applicable law. If the processing is based on consent, we will keep the data until the consent withdrawal. If the processing is based on Company’s legitimate interest, we will keep the data until Company’s legitimate interest exists, but no longer than one year.

9. Security of your personal data and Automated data processing

The Company undertakes adequate technical, organizational and personnel security measures and has the necessary protection mechanisms in place, in order to process personal data in accordance with the Law and to prevent the misuse of the data or accidental, unlawful or unauthorized access, destruction, loss, alterations, disclosure or acquisition of the data. The measures include the electronic and physical protection of the collected data on the candidates.

You will not be subject to decisions based solely on automated processing that would have a legal or similarly significant effect on you during the recruitment process. If such automated decision-making is introduced, we will ensure compliance with the applicable requirements of the applicable data protection laws, including the implementation of suitable measures to safeguard your rights, freedoms, and legitimate interests, such as the right to obtain human intervention, to express your point of view, and to contest the decision.

10. What are your data subject rights?

In accordance with the applicable laws, you have several rights regarding your personal data depending on your jurisdiction or the jurisdiction in which you are applying, including the right to:

• Right to be truly and properly informed on personal data collection.

• Right to Access: You have the right to request access to your personal data held by the employer, as well as information about how your data is processed.

• Right to Rectification: You have the right to request the correction of inaccurate or incomplete personal data held by the employer.

• Right to Erasure: You have the right to request the deletion of your personal data, subject to certain legal and contractual limitations, including the necessity to comply with applicable employment and legal obligations.

• Right to Restriction of Processing: You have the right to request a restriction on the processing of your personal data under certain circumstances, such as if the data is inaccurate or the processing is unlawful.

• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and, where feasible, to transmit that data to another controller.

• Right to Object: You have the right to object to the processing of your personal data, particularly where the processing is based on legitimate interests, direct marketing, or profiling.

• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, which have legal or similarly significant effects.

• Right to lodge a complaint to the national supervisory authority or lawsuit to the competent court.

For Serbia:  Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, email: office@poverenik.rs phone: +381 11 3408 900.

For Bosnia and Herzegovina: Agency for the Protection of Personal Data in Bosnia and Herzegovina, Dubrovačka no. 6, 71000 Sarajevo, e-mail: azlpinfo@azlp.ba, phone: 00 387 33 726 250.

For North Macedonia: Agency for Personal Data Protection, Blvd. "Goce Delcev" 18, Post Office box 417, 1000 Skopje, email: info@privacy.mk, phone: ++ 389 (2)3230 635.

For the United Kingdom: Information Commissioner's Office, live chat: https://ico.org.uk/global/contact-us/contact-us-public/public-advice/, phone: 0303 123 1113.

For the state of California: California Privacy Protection Agency, via the online form at https://cppa.ca.gov/webapplications/complaint. ;

You can exercise all the mentioned rights by contacting pc@devtechgroup.com and all the requests will be processed in accordance with applicable data protection laws. 

11. Do you need additional information?

For any questions regarding the content of this notice or your rights as a data subject, please reach out to pc@devtechgroup.com.

By checking the check boxes, the candidate, i.e. data subject, gives his/her explicit consent to the Company to process his/her personal data for the above stated purposes.

Consent can be withdrawn freely at any time by the submission in writing. By withdrawing the consent, personal data collecting will be stopped, and the collected personal data will be erased. Consent withdrawal will not affect the lawfulness of processing based on consent before its withdrawal.

Exhibit A

California Privacy Addendum

CCPA Notice at Collection. We collect and handle personal information in line with the purposes described in Section 3 of this notice. Below, you’ll find the applicable CCPA categories for the data we process. If we gather new categories of information or intend to use collected data for different reasons, we may issue an additional notice. This document pertains to data collected in the context of our interactions with you.

Categories of Personal Information

• Identifiers, such as name, telephone number, personal and work email address.

• Personal information under California Civil Code section 1798.80 (Categories Described in the Customer Records Statute), such as date and place of birth, signature, and bank account information.

• Characteristics of protected classifications under federal law – such as gender, citizenship status, religion, and age (if at least 40 years old) – or under California law – such additional categories as age and medical conditions.

• Professional or employment related information, such as Curriculum Vitae/resumé, current and previous employment details, immigration status, or work authorizations.

• Education information, such as education background, university or school diplomas/certificates, and other educational achievements.

• Visual information, such as photographs.

• Inferences such as job preferences or willingness to travel and/or relocate.

We may also collect additional information that you choose to provide to us during the interview process.

• Purpose: Recruitment Process - assessing your skills, qualifications, and suitability for a certain job position.
• Categories of Data: Name, contact information, CV, cover letter, job preferences, qualifications, professional background, and other data you provide in your application.
• CCPA Categories: Identifiers; Categories Described in the Customer Records Statute; Professional or Employment-related Information; Education Information.

• Purpose: Background Checks.
• Categories of Data: Employment history, references, criminal record data/previous convictions data (utilized for background screening and vetting purposes where permissible and in accordance with applicable law) or data you made publicly accessible (e.g. your LinkedIn profile).
• CCPA Categories: Identifiers; Categories Described in the Customer Records Statute; Professional or Employment-related Information; Education Information.

• Purpose: Interview Process.
• Categories of Data: Data from interviews, assessments and other information from the recruitment process - Such as notes from interviews with you, assessments and tests made, salary requirements, interview feedback, communications during the interview.
• CCPA Categories: Identifiers; Categories Described in the Customer Records Statute; Professional or Employment-related Information; Education Information; Audio, Electronic, Visual, or Similar Information.

• Purpose: Legal and Regulatory Compliance.
• Categories of Data: Identification details, nationality, work eligibility documents (e.g., visa, work permits)
• CCPA Categories: Identifiers; Categories Described in the Customer Records Statute; Professional or Employment-related Information.

• Purpose: Diversity and Equal Opportunities.
• Categories of Data: Gender, nationality, ethnicity (optional for diversity purposes).
• CCPA Categories: Identifiers; Categories Described in the Customer Records Statute; Professional or Employment-related Information.

• Purpose: Potential consideration for future open positions in the Company after the selection process or after the candidate refuses to participate in the selection.
• Categories of Data: Data contained in your CV/biography.
• CCPA Categories: Identifiers; Categories Described in the Customer Records Statute; Professional or Employment-related Information.

• Purpose: In order for Company not to contact you again if you do not fit the Company culture or Company does not see the possibility of cooperation for other reasons.
• Categories of Data: Name and surname, data from the recruitment process, reasons for non-engagement. 
• CCPA Categories: Identifiers; Categories Described in the Customer Records Statute; Professional or Employment-related Information.

• Purpose: Processing the Data published on LinkedIn and placing it in the database of candidates so that the candidate would be invited to participate in the selection either for the positions for which he is currently qualifying or for the positions for which he will qualify in the future.
• Categories of Data: Name and surname, qualifications, publicly available data on LinkedIn. 
• CCPA Categories: Identifiers; Categories Described in the Customer Records Statute; Professional or Employment-related Information.

Who Has Access to Data? Your information may be shared as explained under section 6. above.

Categories of Sources: We have collected the personal information identified in this Notice from you and through third parties, including background check providers and third-party references and websites. Furthermore, we collect information about you from publicly available sources, such as your LinkedIn profile.

Business and Commercial Purposes for Collecting: We have collected the categories of personal information listed above for the following purposes, as explained in detail under Section 3 above:

• Recruitment Process

• Background Checks

• Interview Process

• Legal and Regulatory Compliance

• Diversity and Equal Opportunities

• Potential consideration for future open positions in the Company

• In order for Company not to contact you again

• Processing the Data published on LinkedIn and placing it in the database of candidates

Disclosure of Personal Data: Within the past year, we have disclosed these categories of information for business-related reasons to:

(1) our affiliates and subsidiaries,

(2) professional advisors (e.g., lawyers, accountants), and

(3) third-party service providers (e.g., cloud hosting, administrative support, technical services).

Privacy Rights & Additional Disclosures for California residents

As we have done above, businesses are required to inform members of the categories of personal information they collect and the purposes for which the categories will be used, at or before the point of collection.

You also have the following rights:

Request for Information or Deletion. You have the right to know whether we are processing your personal information, and in some instances, you have the right to request that we disclose to you the categories listed below for the preceding 12 months. We have the right to request verification of your identity for all requests for information. In responding to this right, we shall provide to you:

• The categories of personal information we collect about you.

• The categories of sources from which your personal information is collected.

• The business or commercial purpose(s) for collecting, selling, sharing, or disclosing your personal information, and the categories of personal information disclosed for such purpose(s).

• The categories of third parties with whom we share your personal information.

• The categories of personal information we have sold, if any, about you and the categories of third parties to whom your personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold. Please note that Company does not sell any personal information about you.

• The specific pieces of personal information we have collected about you.

In addition, you may have the right to request we delete your personal information.

Request for Correction. You have the right to request the correction or rectification of inaccurate information in your personal information.

Do Not Sell or Share My Personal Information. You have the right to opt out of the sale or sharing of the individual’s personal information. However, we do not sell your personal information, nor do we share your personal information to provide personalized or targeted advertising. If you have any questions or further comments on the matter, please reach out to us via the contact information at the bottom of this document.

Limiting the Use of Sensitive Personal Information. You have the right to direct us to use or disclose sensitive personal information only for providing goods or services, or as otherwise minimally permitted under applicable law. However, we do not use or disclose sensitive personal information for any purpose not defined under this Notice, or as otherwise minimally permitted under applicable law.

Right of Non-Retaliation. Employees, applicants, and independent contractors that are residents of California have the right not to be retaliated against by an employer for actualizing these rights.

Non-Discrimination. You have the right not to receive discriminatory treatment by us due to your exercise of the rights provided by the CCPA. We do not offer financial incentives and price or service differences, and we do not discriminate against consumers, employees, applicants, or independent contractors for exercising their rights under the CCPA.

Verification Process for Exercising Rights. To protect your privacy, we verify privacy rights requests to ensure that only you (or your authorized agent) can exercise rights pertaining to your personal information. As part of our verification process, we may request you to submit additional information.

If you are an authorized agent wishing to exercise rights on behalf of a state resident, please contact us using the information at the bottom of this Notice and provide us with a copy of the resident’s written authorization designating you as their agent. We may need to verify your identity and place of residence before completing your rights request.

How to Submit a Request

You can contact us by email at pc@devtechgroup.com to exercise any of the rights outlined above. If your request is incomplete or submitted incorrectly, we will either treat it as though submitted correctly or guide you on how to fix it.

Handling Excessive or Repetitive Requests

If your requests are clearly repetitive or excessive, we may either charge a reasonable fee based on the cost of processing or refuse to act on the request altogether. If we decline to act, we will provide the reason for doing so.