By expressing interest to join the Coca-Cola HBC team, you will be providing us with certain
personal data about yourself. Coca-Cola HBC Kosovo and its subsidiaries and affiliates (within
this policy and within the opt-in notice “CCHBC”, “CCHBC Group”, ‘our’, ‘us’, ‘we’) are
committed to respect your privacy and to manage your personal data fairly and safely. With this
Privacy Notice, we want to inform you why and how we are processing your personal data in the
context of the recruitment process and within the respective digital recruitment platforms. It
applies to individuals who apply to work for or register in CCHBC Talent Network, attend a
recruitment event, undertake an evaluation with CCHBC or participate in other recruitment
processes.

Unless otherwise indicated, Coca-Cola HBC Kosovo is the entity responsible or “data controller”
for the processing of your personal data. If you are applying for a job with one of the other CCHBC
Group companies, then that CCHBC company is also a data controller.

Personal data we collect

We may collect personal data directly from you, from third parties or public sources, as well as
automatically, such as through your use of our recruitment platforms. In this Privacy Notice,
“personal data” means any information relating to an identified or identifiable individual.
Examples of personal data included: name, email address, IP address, and phone number.
We process your personal data to assess your application prior to entering into an employment
contract with us and pursuant to laws to which CCHBC is subject (e.g., in relation to equal
opportunities). If you are unable to provide us with the information requested, we are unable to
assess your appropriateness for the job applied for or to communicate with you.

If we require further personal data from you, we will let you know whether this is in order to fulfil
your contract or as a consequence of a statutory obligation and we will let you know what the
consequences would be if you failed to provide this to us and any risks associated with the use of
the Personal Data by us.

Personal data we collect directly from you or you provide to a recruitment agency on our
behalf

1. Identification information: Title, Fist Name, Last Name, data of birth, language, gender,
valid driving license, national insurance or other identification number, and your visa,
passport, or permission to work documentation.
2. Contact details: address, telephone, email address and mail address
3. Job application details: CV or résumé, application form details, interview notes,
certifications, diplomas, professional qualifications, and professional experience, language
skills, desired salary, start date/notice period to be considered, tenure and your picture if
you provide it to us knowingly and voluntarily.

4. Interview and Assessment information:
▪ Video and audio recordings of online interviews, if requested
▪ Interview scheduling information
▪ Results of leadership and functional skills tests
▪ Results of leadership skills behavior-based assessments (Role plays and In-trays)
▪ Results of gamified assessments, data from your interaction with the assessment and
analysis of your responses against the success criteria (job fit)

5. Recruitment surveys: We may collect information about our recruitment process, such as
how you found out about the job and your visits to recruitment events such as job fairs.
6. Special Categories, in case applicable to your applied job position:
o details of your race, gender, national or ethnic background, religious or community
background, to ensure meaningful equal opportunity monitoring and reporting.
o disabilities you may have and whether you have been long term unemployed strictly
for the purposes of monitoring compliance with anti-discrimination legislation, our
policies, and our legal duties under anti-discrimination legislation.
o the results of criminal records or financial probity checks or other independent
searches (and where we do so you will be asked to consent to such collection and
use before we or our agents undertake the search) to assess your suitability for the
position.

Personal data we collect automatically

Website usage information. When you visit our digital recruitment platforms, we collect certain
information about your use of the website, including the hostname and IP address of your device,
your browser type and version, device type, unique device identification numbers, broad
geographic location (e.g. country or city-level location) your operating system, the website that
referred you to us, the pages you visit on our recruitment platforms and the time and duration of
your visit.

Cookies. We may use cookies and similar technologies to collect personal data. Cookies are
small data files placed on your computer or mobile device when you visit a website or use an
online service. For more information about our use of cookies, please see the respective
Recruitment Cookie Notice and the related Cookie Preference Center.

Personal data we collect from third parties

Professional social media: If you include a professional social media link or identifier in your
application, we may retrieve information about your professional social media presence from
such social media sites, like LinkedIn and Xing.
Background checks: We may collect and process information from third parties, including
criminal records, to verify information you have provided to us, and to perform background
checks, in case applicable to your applied job position.

Personal data we collect from public sources

Personal information publicly available: on contact information, social links, professional
qualifications, experience, and education

Purposes and Legal Basis for processing Personal Data:

a) Evaluating job applications: Registering your application for a job with us and, if this
application triggers our selection procedure, defining your professional summary to assess
your job application in view of a potential recruitment, including conducting the interview
process, the evaluation of individual skills and competencies, managing the candidate and
enhancing, validating, and updating applicant data to ensure validity and completeness.
b) Background screening: Screening of educational and professional background prior to
and during employment.
c) Contacting you: for information required for entering an employment contract with you.
d) To provide you with our IT services though our 3rd parties platforms

Legal Basis:
• The fulfillment of the recruitment process execution authorized by your acceptance of
the Recruitment contract and on a later stage, an employment contract Article 5
paragraph 1 point 1.2 of the Law on Personal Data Protection.
• To fulfil our legal obligation to comply with Tax and Accounting obligations Article 5
paragraph 1 point 1.3 of the Law on Personal Data Protection.
• We are authorized by law to use certain special categories of data, or data related to
criminal offences, for example to conduct background checks Article 5 paragraph 1
point 1.3 of the Law on Personal Data Protection.

• CCHBC has a legitimate interest according to Article 5 paragraph 1 point 1.6 of the
Law on Personal Data Protection in using the personal data learning about the
effectiveness of our recruitment efforts and to assess your application prior to entering
an employment contract with us. Also, if your application is successful, the data
collected during the application period will be retained and its processing will be
subject to the CCHBC Employee Privacy Notice. More specifically, the application
data, including your personal data provided in your CV may be processed for further
employment purposes, e.g., so that CCHBC can fully identify and draw upon the experience, industry and professional knowledge, skills and talents employed in the
Company.

To maintain an up-to-date candidate database: Maintaining a database of job candidates in
order to be able to contact potential candidates if any future job opportunities match their
profile. Data enrichment is a process used to enhance, validate, and update candidate’s contact
data to ensure accuracy and completeness. Data enrichment may be used for certain key
categories of personal information that individuals make publicly available on the web.

Legal Basis: Your explicit consent to be considered for other positions and to join Coca-Cola
HBC Talent Network Article 5 paragraph 1 point 1.1 of the Law on Personal Data
Protection

Automatic Decision Making

We do not practice automatic decision making for your recruitment process. We short list
applicants using a manual selection process, considering appropriate experience and skills for the
job.

How we disclose Personal Data

We may share your data with other CCHBC group companies for the purpose of your recruitment
selection and if you are taken on, as part of your employment. We limit the personal data provided
to that which is reasonably necessary for them to perform their functions, and we require them to
agree to maintain the confidentiality of such information.
▪ CCHBC People and Culture. We may disclose details about your application to HR and
management teams of other members of the CCHBC Group, for example employees who are
involved in our recruitment and selection processes and relevant managers.
▪ CCHBC Talent Acquisition Team. We may disclose your personal data to talent
management teams and to
▪ CCHBC People and Services Team (BSO) that provide administration services for your
recruitment to the Talent Acquisition Team
▪ 3rd parties. We may disclose your personal data to:
▪ IT Service providers. third party service providers who provide us with hosting,
maintenance, and other services. These third parties may have access to or process
personal data about you as part of providing those services for us,
▪ Providers conducting pre-employment checks,
▪ Assessment companies or entities providing online interviewing services,
▪ Recruitment agencies who, from time to time, assist us in our recruitment and
selection processes.
▪ Compliance with laws and law enforcement. We reserve the right to disclose your
personal data as required by law or when we believe that disclosure is necessary to
protect the security or integrity of our recruitment platforms, or to protect the legitimate
interests, rights, property, or safety of CCHBC, its employees or others, or to comply
with a judicial proceeding, court order, or governmental or regulatory request or any
other legal process served on us.

International data transfers

We hold your personal data principally in the country in which you apply for a role. However, it
is sometimes necessary for us to provide details about your application to our other CCHBC
Group companies situated outside the European Economic Area for the purposes of your
selection. When we do so, we will ensure that such transfers ensure that an appropriate level of
protection is given to the personal data (and we use EU approved “Model Clauses” where
appropriate in order to ensure this).

For more information about the transfers described above and the adequate safeguards we use to
protect such transfers, you may contact us through the contact information set forth below.

Retention periods

We take measures to delete your personal data or keep it in a form that does not permit identifying
you when this information is no longer necessary for the purposes for which we process it, unless
we are required by law to keep this data for a longer period. When determining the retention period,
we take into account various criteria, such as the position you applied for, whether the application
was successful, the nature and length of our relationship with you, expected future job openings
matching your profile, mandatory retention periods provided by law and the relevant statute of
limitations.

If your application is unsuccessful, we will generally retain your application for a period of up to
7 months or if you have provided consent to us so to maintain your personal data for extended
period.

If you have allowed us to consider you for other job opportunities or have joined our Talent
Network, we will retain your personal information for a period of 36 months.

For more information about our retention of your application, you may contact us through the
contact information set forth below.

Your rights and choices

If you are based in the EU, or we process your personal data in the EU, you have certain rights in
relation to the data we collect about you:
• Subject Access: You have a right to be provided with access to any data held about you
by CCHBC generally within 1 month of your request.
• Rectification: You can ask us to have inaccurate personal data amended.
• Erasure: You can ask us to erase personal data in certain circumstances pursuant to Art.
17 GDPR and we will take reasonable steps to inform other controllers that are
processing the personal data that you have requested the erasure of any links to, copies or
replication of it.
• Withdrawal of consent: You can withdraw any consents to processing that you have
given us and prevent further processing if there is no other ground under which CCHBC
can process your personal data.
• Restriction: You can require certain personal data to be marked as restricted whilst
complaints are resolved and also restrict processing in certain other circumstances.
• Portability: You can ask us to transmit the personal data that we hold about you to a
third party electronically.
• Raise a complaint: You can raise a complaint about our processing with the data
protection regulator – the INSTITUTIONAL PROTECTION OF PERSONAL DATA
INFORMATION AND PRIVACY AGENCY

Your contact for any queries

CCHBC has a designated Data Protection Officer who should be contacted if you have any
queries regarding the interpretation of this notice. The contact details are set out below:
• Data Protection Officer: Nassos Stylianos
• Location: Coca-Cola HBC Services MEPE, 9, Fragoklissias Street, Maroussi 151 25,
Greece
• Email: [email protected]

Changes to this Privacy notice

We may modify or amend this Privacy Notice from time to time. Any changes we may make to
this Privacy Notice in the future will be posted on this page. To let you know when we make
changes to this Privacy Notice, we will amend the revision date at the top of this page. The new
modified or amended Privacy Notice will apply from that revision date. Please check back
periodically to see changes and additions.