Privacy Notice – Employment Verification Requests

Personal data is processed for the purposes of:

• receiving and handling requests for verification of employment of former Syberry employees;
• verifying the authenticity and validity of such requests;
• providing employment verification responses to authorized third parties;
• ensuring compliance with applicable legal obligations and internal policies, including maintaining appropriate records for evidentiary purposes.

Personal data is processed on the basis of Syberry's legitimate interest (Article 6(1)(f) GDPR), consisting in enabling reliable verification of employment history and preventing unauthorized disclosure of personal data.

The authorization provided by the former employee constitutes an additional safeguard and condition for disclosure of personal data but does not constitute the sole legal basis for processing.

Depending on the content of the request, Syberry may process the following categories of personal data:

• identification data of the former employee (e.g. name, surname);
• employment-related data (e.g. job title, employment dates, employment status);
• identification and contact details of the requester (e.g. company name, email address, phone number);
• information contained in the request and any supporting documentation submitted (including authorization documents).

Syberry processes only data that is necessary and proportionate for the purposes indicated above.

Personal data may be disclosed to:

• authorized Syberry personnel, in particular within the HR function;
• IT service providers supporting Syberry's systems (e.g. hosting, ticketing or workflow tools), acting on the basis of appropriate contractual arrangements;
• the entity submitting the verification request, strictly to the extent necessary to confirm employment (limited to employment status, job title and employment dates).

Personal data will be retained only for the period necessary to process the request and to ensure proper documentation of the process, including for evidentiary and compliance purposes, and in any case no longer than 12 months from completion of the request, unless a longer retention period is required by law or justified by legitimate interests (e.g. defence against claims).

Data subjects have the right to:

• request access to their personal data;
• request rectification of inaccurate or incomplete data;
• request erasure of data (subject to legal limitations);
• request restriction of processing;
• object to processing based on Syberry's legitimate interest.

Data subjects also have the right to lodge a complaint with the competent supervisory authority.

Where Syberry uses third-party tools (e.g. reCAPTCHA provided by Google), personal data may be transferred outside the European Economic Area.

In such cases, Syberry ensures that appropriate safeguards are implemented in accordance with applicable data protection laws, including the use of standard contractual clauses or other lawful transfer mechanisms.

Providing personal data is necessary to submit and process an employment verification request.

Failure to provide required data or supporting documentation (including valid authorization) may result in the inability to process the request or provide a response.

For any questions regarding the processing of personal data or to exercise your rights, please contact:

compliance@syberry.com