GDPR Policy

Through this document and in compliance with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter referred to as "General Data Protection Regulation" or “GDPR”), we inform you that INNOVMETRIC SOFTWARE INC. and the Company owned by it (either subsidiary or joint venture) which belongs to INNOVMETRIC Group, which operates (or, where appropriate, makes the job offer) in the country where you are and whose identity and contact information are available at the following link ( https://www.polyworkssouthafrica.com/find-contact ) will process the personal data provided by you to these companies, as well as all data that may derive from the possible contacts and/or interviews with you, in order to keep a record of curricular information of the candidates to serve as employees which allows to assess the profile and suitability of the candidates for selection processes and to cover eventual vacancies that may be opened in the Company.

The companies responsible for data processing (the Data Controllers) are:

• INNOVMETRIC SOFTWARE INC., with tax identification number (SIN/NAS) R138293006, with registered address at 2014 Cyrille-Duquet, Suite 310, Québec, Québec, Canada, G1N 4N6, and with the following email address for these purposes: privacy@innovmetric.com

  It should be noted that INNOVMETRIC SOFTWARE INC. has appointed, as its representative in the European Union in compliance with the provisions of Article 27 of the General Data Protection Regulation the Company (either subsidiary or joint venture) belonging to INNOVMETRIC Group that operates (or, where appropriate, that makes the job offer) in the country where you are which also acts as a Data Controller in this case. The identity and contact information of this Company are available at the following link: https://www.polyworkssouthafrica.com/find-contact

• The Company (either subsidiary or joint venture) which belongs to INNOVMETRIC Group and operates (or, where appropriate, makes the job offer) in the country where you are, whose identity and contact information are available at the following link: https://www.polyworkssouthafrica.com/find-contact

According to the provisions of article 6.1.b) of the European Regulation, the legal basis that enables and entitles these Companies to process your personal data is the express consent given by you for such purposes by accepting this Policy.

By accepting this Policy, you give your express consent so that your personal data may be retained and processed for a reasonable period of time (which we establish as 5 years), for future selection processes that may be carried out by the Company, or to cover eventual vacancies that may be opened in the future, where the required profile may correspond to yours; unless you expressly exercise your right to erasure or your right to object to the processing of your personal data under the terms set forth in section 5 of this Policy.

The Companies responsible for data processing (the Data Controllers) may disclose your personal data to third parties when so provided by law.

By accepting this Policy, you also give your express consent so that your personal data may be disclosed to other companies of INNOVMETRIC Group located within the European Union, partly or entirely owned by INNOVMETRIC SOFTWARE INC., and whose identity and contact information are available at the following link ( https://www.polyworkssouthafrica.com/find-contact ). The purpose of these possible disclosures of data and the eventual processing of it by these companies is to enable them to take you into consideration as a potential candidate to provide your services as an employee in these companies.

We inform you that, in the event that any of these disclosures to other companies of INNOVMETRIC Group occur, everything provided for in this Policy in relation to the fulfillment of the duty of information established by the GDPR will be applicable, with the difference that, in such case, the particular company to which your personal data would have been disclosed will be also considered a Data Controller (company responsible for data processing). Therefore, in that case, you will be entitled to exercise the same rights as provided for in Section 5 herein by sending either a letter or an email to the postal address or to the email address that appear as contact information of said company in the link mentioned in the previous paragraph.

Besides, we must inform you that, where data processing is to be carried out by way of a Processor on behalf of the Controllers, your personal data may be accessed by Companies providing hosting services, HR Platforms or HR Software companies (such as iCIMS), and agencies providing labor management services (so, in case you are finally recruited by the Company, these agencies can manage your employment contract and your registration), in their capacity as processors. Some of these services are provided in particular by companies located in Canada and the United States of America. Both countries have a recognized adequate level of data protection according to both, the Commission Decision 2002/2/EC of December 20, 2001, regarding entities subject to the scope of application of the Canadian Law on Data Protection, and the Commission Decision (EU) 2016/1250, of July 12, 2016, on the adequacy of the protection conferred by the EU-US Privacy Shield.

Finally, we inform you that by accepting this Policy you also give your express consent so that the Data Controllers may ask for references to companies in which you may have worked in the last 5 years, when they deem it appropriate.

The Data Controllers undertake to respect and facilitate the exercise of the Data Subject rights: right of access, right to rectification, right to erasure, right to object, right to restriction of processing, right to data portability and the rights related to automated decision-making, under the terms and within the limits established in arts. 15 to 22 of the GDPR.

Please find below a brief explanation of the scope and content of the Data Subject aforementioned rights that you may exercise:

(i) Right of access: Under the exercise of this right, you are entitled to obtain from us confirmation as to whether or not we have personal data concerning you, and, where that is the case, you can ask us for information on it. We are also obliged to answer, among other questions, the ones related to the purposes of the processing, the categories of personal data concerned and the recipients to whom personal data have been disclosed. However, this right is not absolute and the right of access may be restricted by the interests of other parties as provided for in the GDPR. This right is stated in article 15 GDPR.

(ii) Right to rectification: We must rectify inaccurate personal data and complete incomplete personal data at your request. However, this right is subject to the limits set forth in article 16 GDPR.

(iii) Right to erasure (‘right to be forgotten’): In the event that any of the circumstances described in article 17 GDPR occur, we will be obliged to erase your personal data if you so request. However, this right is subject to the limits set forth in said article 17 GDPR.

(iv) Right to restriction of processing: In the event that any of the circumstances described in article 18 GDPR occur, we will be obliged to restrict the use we make of your personal data at your request and under the particular terms stated in said article 18 GDPR.

(v) Right to data portability: In the event that the circumstances described in article 20 GDPR occur you shall have the right, if you so request, to receive the personal data concerning you, and that you provided to us, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from our part (you shall have also the right to have your personal data transmitted directly from us to another controller at your request and where technically feasible.) However, this right is subject to the limits set forth in said article 20 GDPR.

(vi) Right to object: In the event that the circumstances described in article 21 GDPR occur, you shall have the right to object to us using your personal data. In such cases, and provided that you so request, we will be obliged to stop using your personal data. This is the case, for example, when using personal data for marketing or direct marketing purposes, in which case you will be entitled to ask us to stop using your data for that purpose. This right is stated in said article 21GDPR.

(vii) Right not to be subject to a decision based solely on automated processing, including profiling: You shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or similarly significantly affects you. This right is stated in article 22 GDPR and is subject to the limits set forth in said article.

You can exercise the aforementioned rights at any time including the right to object or withdraw the consent you give by sending a regular mail or an email either to INNOVMETRIC SOFTWARE INC. (to the postal address 2014 Cyrille-Duquet, Suite 310, Québec, Québec, Canada, G1N 4N6 or to the following email address: privacy@innovmetric.com ), or to the Company (subsidiary or joint venture) belonging to INNOVMETRIC Group (also appointed as representative of INNOVMETRIC in the European Union) that operates (or, where appropriate, that makes the job offer) in the country where you are. The identity and contact information of this Company are available at the following link: https://www.polyworkssouthafrica.com/find-contact

Your personal data will be processed at all times with a level of protection in accordance with the requirements of the regulations in force on the protection of personal data, guaranteeing their security and confidentiality.

Finally, we inform you of your right to file a claim with a competent control authority whenever you consider it appropriate.