Processing of Personal Data of Persons within the EEA or the UK(Attachment)
If a user is a person in the EEA (European Economic Area) or the UK, and is subject to theEU General Data Protection Regulation or the UK General Data Protection Regulation(collectively “GDPR”), then this Attachment will apply in addition to the section titled“Regarding the handling of personal information” (the “Rules”) above.

If there is any

discrepancy between the provisions of the Rules and those of this Attachment, the provisionsof this Attachment shall prevail.
◼

PERSONAL DATA

“Personal information” as used in the Rules shall be read as personal data as defined in theGDPR.
◼

USE OF COOKIES

Details regarding the use of cookies as personal data shall be set out separately.
◼

SOURCE OF PERSONAL DATA

We will obtain customers’ personal data directly from customers.
Use of the Service is limited to customers who are 16 years old or older. Anyone who isyounger than 16 years old should refrain from using the Service.
◼

PURPOSE OF USE AND LEGAL BASIS FOR PROCESSING

Notwithstanding the provisions of the Rules, we will obtain and process the following
categories of users’ personal data only for the purposes stipulated below, as doing so isnecessary for the performance of contracts.
Purpose of Processing
To

provideCategories of Personal Data
regardingName, address, date of birth, age, gender,

introduction of jobs, finding or changing

phone number, email address, work/schooljobs, and temporary staffing, and to provide

information (company name, section, title,

services related thereto (including, with thename of school, etc.), ID number (driver’sapproval or at the request of Candidates,

license, passport, insurance card number,provisionetc.), financial condition (income, amountofinformation

personal

datatoclientcompanies,Service,of loans, etc.), medical condition (medicalconfirmation with employers regarding facts

history, surgical history, results of checkups,

suchetc.),

asetc.
ausingCandidatethesubmitting

ancriminal history (criminal records,application or joining the company during

arrest records, history with the police),the provision of service or after thecertificate of status of residencecompletion of service, and receiving notices
from employers)
To respond to inquiries, consultations, andcomplaints and to resolve disputes
To confirm the status after the job
placement,jobchange,ortemporary

staffing and to obtain opinions or requests toimprove services
We will not use any personal data of a user for the purpose of making the user subject toautomated processing, including profiling, which produces legal effects concerning the useror similarly significantly affects the user without the consent of the user.
◼

PERSONAL DATA REQUIRED TO BE PROVIDED

Users may not apply for job openings if they do not provide their personal data designated as
required information.
In addition to the above information, if the provision of personal data is required under laws
and regulations or is necessary for entering into a contract, we will separately notify customers
individually regarding whether the data subject is obliged to provide the personal data or not
and regarding the consequences that may arise if the data subject does not provide such data.
◼

RETENTION PERIOD OF PERSONAL DATA

We may retain the personal data of users for the period necessary to achieve the purpose ofuse of personal data above in connection with the provision of the Service.

A specificretention period will be determined taking into account the purpose of obtaining andprocessing the personal data, the nature of the personal data, and the necessity to retain thepersonal data based on statutory or contractual requirements.
◼

PROVISION AND TRANSFER OF PERSONAL DATA TO THIRD PARTY

Notwithstanding the provisions of the Rules, we will provide the personal data of users toservice providers, to venders, and to contractors and cloud service providers that offer hosting,data storage, and other services to the extent necessary to achieve the purpose of use above.In connection with the above sharing and disclosing of personal data, we may transfer thepersonal data of users to one of the following third countries outside the EEA, such as HongKong.

In that case, we will establish appropriate safeguards by executing standard

contractual clauses (Paragraphs 2(c) and 5 of Article 46 of the GDPR) approved by therecipient of personal data and the European Commission. Please contact us at the contact
details above if you wish to see a copy of the document regarding the safeguards.
◼

USERS’ RIGHTS

Users have following rights with respect to their personal data obtained and processed by us.
●

Obtain Information Regarding the Data Processing

Each user shall have the right to obtain all of the necessary information with respect to ourdata processing activities relating to users (Articles 13 and 14 of the GDPR).
●

Access to Personal Data

Each user shall have the right to obtain confirmation from us as to whether or not personal
data concerning him or her are being processed, and, where that is the case, access to thepersonal data and certain related information (Article 15 of the GDPR).
●Correction or Deletion of Personal DataEach user shall have the right to obtain from us without undue delay the rectification ofinaccurate personal data concerning him or her and the right to have incomplete personal data
completed (Article 16 of the GDPR). Each user shall have the right to obtain from us theerasure of personal data concerning him or her without undue delay if certain requirements
are met (Article 17 of the GDPR).
●Restriction on Processing of Personal Data

Each user shall have the right to obtain from us restriction of processing if certain
requirements are met (Article 18 of the GDPR).
●Objection to Processing of Personal Data

Each user shall have the right to object to processing of personal data concerning him or her
if certain requirements are met (Article 21 of the GDPR).
●

Data Portability of Personal Data

Each user shall have the right to receive the personal data concerning him or her in astructured, commonly used and machine-readable format and have the right to transmit thosedata to another controller without hindrance from us if certain requirements are met (Article
20 of the GDPR).
●No Automated Decision-Making

Each user shall have the right not to be subject to a decision based solely on automatedprocessing, including profiling, which produces legal effects concerning him or her orsimilarly significantly affects him or her if certain requirements are met (Article 22 of theGDPR).
Please contact us at the contact details above if you wish to exercise any of the rights above.
Users may file an objection regarding our processing of users’ personal data to the dataprotection supervisory authority of the member country where the user resides or works orwhere the violation of the GDPR occurred.
◼

HOW YOU CAN CONTACT OUR EU REPRESENTATIVE

We have appointed the below point of contact as our representative in EU and UK for dataprotection matters. You can contact them using the following email address. Your message
will be forwarded to appropriate members of their data privacy team.
EU
Bird & Bird GDPR Representative Services SRL
Avenue Louise 235
1050 Bruxelles
Belgium
EUrepresentative.RecruitCo@twobirds.com
UK
Bird & Bird GDPR Representative Services UK
12 New Fetter Lane
LondonEC4A 1JP
United Kingdom
UKrepresentative.RecruitCo@twobirds.com “