Senior Platform Engineer – BMaaS/K8SaaS

Privacy notice for job candidates and potential contractors (B2B) Pursuant to Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, “GDPR”), the controller hereby provides the following detailed information on the processing of your personal data: Data Controller The controller of your personal data is Sovereign AI Holdings Poland sp. z o.o., with its registered office in Wrocław at Pl. Nowy Targ 28, 50‑141 Wrocław, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register, under KRS number: 0001190626, NIP: 5253058736, REGON: 542558640, share capital: PLN 5,000 (the “Controller”). Contact details You may contact the Controller as follows: by post: Plac Nowy Targ 28, 50-141 Wrocław, Poland; by e-mail: datasec@rhaelm.com Purposes and legal bases for data processing The Controller will process your personal data for the following purposes: - for purposes related to the ongoing recruitment process, to the extent that the provision of personal data during recruitment is regulated by applicable law (Article 6(1)(c) GDPR – processing is necessary to comply with a legal obligation to which the Controller is subject); - for purposes related to taking steps at your request prior to entering into a contract, in the case of candidates for cooperation under civil law contracts (Article 6(1)(b) GDPR – processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract); - based on your voluntary consent, with respect to the processing of additional personal data provided during the recruitment process which is not required under labour law, or where consent has been given for the processing of personal data for the purposes of future recruitment (Article 6(1)(a) GDPR – the data subject has given consent to the processing of their personal data for one or more specific purposes); - for purposes related to the establishment, exercise or defence of claims arising in connection with the recruitment process (Article 6(1)(f) GDPR – processing is necessary for the purposes of the Controller’s legitimate interests, which in this case consist in the establishment, exercise or defence of claims). Data retention periods Data retention periods The Controller will retain your personal data for the period necessary to fulfil the purposes for which they were collected: in the case of data processed for recruitment purposes – until the completion of the recruitment process, and thereafter until the expiry of any statutory data retention obligations resulting from applicable laws or for the limitation period of any potential claims (as a general rule, civil claims related to the employment relationship become time‑barred after 3 years from the date on which the claim became due). In the event that judicial or administrative proceedings are initiated, personal data may be processed until such proceedings are finally concluded; in the case of data processed for future recruitment purposes – for no longer than 2 years from the moment of consent to such processing. Recipients of personal data Your personal data may be disclosed to the following categories of recipients: - public authorities, within the limits set out in applicable law (e.g. courts, administrative authorities, tax authorities); - the Controller’s subcontractors and service providers, including in particular providers of IT services and recruitment services; - law firms; - providers of IT services, tools or systems used by the Controller; - other companies belonging to the same capital group as the Controller. - In each case, the disclosure of your data will take place only to the extent necessary and on the basis of appropriate authorisation, data processing agreements, data sharing arrangements or applicable provisions of law. Transfer of personal data outside the European Economic Area (EEA) The Controller may transfer your personal data outside the European Economic Area, i.e. to the United Kingdom, to companies belonging to the same capital group as the Controller, to the extent necessary to achieve the purposes set out in Section 3 of this notice. Transfers of personal data to the United Kingdom are carried out on the basis of an adequacy decision referred to in Article 45 of the GDPR, issued by the European Commission for the United Kingdom. In all other cases, the Controller processes personal data within the territory of the European Economic Area, and your personal data will not be transferred to third countries outside the EEA. Your rights At any time, you may exercise the rights referred to in the GDPR, including: - the right of access to personal data (Article 15 GDPR) and the right to obtain a copy of personal data processed; - the right to rectification (correction) of personal data (Article 16 GDPR); - the right to erasure of personal data (Article 17 GDPR), unless processing is necessary for one of the purposes specified in Article 17(3) GDPR; - the right to restriction of processing (Article 18 GDPR); - the right to object to processing (Article 21 GDPR) – where processing is based on the Controller’s legitimate interests (Article 6(1)(f) GDPR); - the right to data portability (Article 20 GDPR), i.e. the right to receive your personal data processed by the Controller on the basis of a contract and by automated means, in a structured, commonly used and machine‑readable format; - the right to withdraw consent at any time, where personal data is processed on the basis of consent. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal (Article 7(3) GDPR); - the right to lodge a complaint with a supervisory authority (the President of the Personal Data Protection Office) (Article 77 GDPR). To exercise the above rights, submit a request or obtain information on the processing of personal data, you may submit a request in writing or by email using the contact details indicated in point 2 above. Information on whether the provision of data is mandatory The provision of your personal data is voluntary; however, the provision of certain categories of personal data is required under labour law (in particular, the categories listed in Article 22¹ of the Polish Labour Code, such as: first name(s) and surname, date of birth, contact details, education, professional qualifications and employment history). Failure to provide personal data required by law may make it impossible to carry out the recruitment process and to conclude an employment contract between you and the Controller. Automated decision making No decisions concerning you will be taken that are based solely on automated processing of personal data.

Consent Clause for Ongoing Recruitments I voluntarily consent to the processing of my Personal Data contained in my application documents (including my CV and cover letter) sent in response to the job offer, and collected during a possible recruitment interview for the purposes of recruitment process conduct by the Controller, i.e. Sovereign AI Holdings Poland sp. z o.o. I acknowledge that I have been informed of my right to withdraw this consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal. The consent might be withdrawn by contacting the Controller in writing at: Plac Nowy Targ 28, 50-141 Wrocław, Poland, or by e-mail at: datasec@rhaelm.com I confirm that I have read and understood the privacy notice for job candidates and potential contractors. The Controller of Personal Data is Sovereign AI Holdings Poland sp. z o.o., with its registered office in Wrocław at Pl. Nowy Targ 28, 50-141 Wrocław (KRS: 0001190626, NIP: 5253058736, REGON: 542558640).