PRIVACY POLICY FOR RECRUITMENT PROCESSES

1. How do we process your personal data?

Your personal data will be processed to manage your account in our Hulahoop Careers portal, as well as your participation in the recruitment processes managed by HULAHOOP MEDIA, S.L. (hereinafter, "HULAHOOP").

If, in addition to being a candidate, you currently maintain or have maintained a contractual or commercial relationship with HULAHOOP, your data may also be processed in the context of that relationship in accordance with the privacy policy applicable to the corresponding services.

The data processing we carry out is essentially governed by the following regulations:

Regulation (EU) 2016/679 of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR).
Spanish Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD).

2. Who processes your personal data?

The controller of your personal data is HULAHOOP MEDIA, S.L. (hereinafter, "HULAHOOP", the "Entity" or "we"), with:

Tax ID: B10857589
Registered office: Rúa Ponte, 4, Bajo, 15009 A Coruña (Spain)

3. Data Protection Officer

HULAHOOP has appointed a Data Protection Officer (DPO) who will address any questions or queries related to the processing of your personal data and the exercise of your rights.

You can contact the Data Protection Officer at: dpo@hulahoop.media

4. Exercise of rights and complaints to the Spanish Data Protection Agency (AEPD)

You may exercise your rights of:

access
rectification
erasure
objection
restriction of processing
portability
withdrawal of consent
and not to be subject to automated decisions

in accordance with current regulations.

You can exercise these rights by sending a request to: dpo@hulahoop.media

In addition, if you consider that the processing of your personal data does not comply with applicable regulations, you may file a complaint with the Spanish Data Protection Agency: www.aepd.es

5. Data processed

Below you can consult the categories of personal data we may process in connection with the processing activities described in this Policy.

It should be noted that not all data described in this section is used in every processing activity.

5.1. Data provided by the candidate

During the creation of your account in Hulahoop Careers, during the recruitment process or, where applicable, during the hiring process.

Identifying and contact data

first and last name
identification document
postal contact information
phone number
email address
residential address
nationality
date and place of birth
preferred language of communication
work permit in Spain, where applicable
image or recordings when interviews are conducted by videoconference or in remote recruitment formats

Data on training and work experience

professional experience
academic background
languages
certifications

Data on competencies and skills

assessments of professional skills or competencies

Data on geographic availability and areas of interest

geographic availability
professional areas of interest

Data on disability or special needs

percentage of disability or conditions requiring adjustments during the recruitment process

5.2. Data observed during the recruitment process

candidate identifier
vacancy identifier
results of interviews or assessment tests
data derived from participation in recruitment processes
communications with the candidate (email, videoconferences, calls or other equivalent means)

5.3. Inferred or generated data

In certain processing activities, data may be generated derived from the analysis of the above information, for example:

indicators derived from recruitment processes
results from candidate-analysis tools

5.4. Data obtained from public or external sources

Where the candidate authorises or expressly provides it:

information available on professional networks (e.g., LinkedIn)

6. Data processing activities

The processing activities we carry out are based on different legal grounds:

performance of pre-contractual measures
consent of the data subject
legitimate interest of HULAHOOP

In addition to the activities described below, specific processing activities may be carried out, of which the data subject will be informed at the relevant time.

6.1. Processing necessary for the performance of pre-contractual measures

6.1.a. Creation, management and maintenance of your account

Purpose

To create, manage and maintain your account in Hulahoop Careers.

Data processed

identifying and contact data
training and work experience data
competencies and skills
geographic availability and areas of interest

Retention period

Your data will be processed for as long as your account remains active.

In the event of inactivity for one (1) year, we may close the account.

The data will subsequently be kept blocked for three (3) years to address potential legal liabilities.

6.1.b. Management of the recruitment process

Purpose

To manage the recruitment processes in which you participate after registering with Hulahoop Careers.

Data processed

identifying and contact data
training and professional experience
competencies and skills
geographic availability
recruitment process data
communications maintained
information from professional networks if you provide it

Use of supporting technological tools

HULAHOOP may use supporting technological tools for the management and classification of applications in order to identify profiles that match available vacancies. These tools are used exclusively as support for the recruitment process and do not entail automated decision-making, with final decisions always being made by personnel responsible for the recruitment process.

Retention period

Data will be retained for as long as the recruitment process remains open and for one (1) additional month after its completion.

If the candidate is not selected, HULAHOOP may retain their data for a maximum period of twenty-four (24) months in order to consider their profile in future recruitment processes, unless the candidate requests deletion beforehand.

6.1.c. Management of the hiring process

If you are selected for a vacancy, your data may be processed in order to:

formalise the hiring
carry out necessary checks prior to hiring
comply with applicable legal obligations

The data will be retained for the time necessary to formalise the employment relationship and for the applicable legal periods.

6.2. Processing based on consent

6.2.a. Sending job alerts

We may send you new vacancies that match your preferences by email if you request it.

Data processed

name
email address
preferred language of communication

Retention period

Until you withdraw your consent or close your account.

6.2.b. Sending personalised professional opportunities

If you authorise it, we may send you professional opportunities based on:

your experience
your training
your professional career

Processing will continue for as long as your consent remains active.

6.3. Processing based on legitimate interest

Certain processing activities are carried out on the basis of HULAHOOP's legitimate interest, in accordance with article 6.1.f) of the GDPR.

In these cases, HULAHOOP has previously carried out the corresponding balancing test between its legitimate interest and the rights and freedoms of data subjects, concluding that the processing is proportionate and does not unduly affect the rights of candidates.

In any event, data subjects may object at any time to these processing activities through the channels indicated in this Policy.

6.3.a. Sending surveys

We may send surveys to candidates to learn about their experience during recruitment processes and to improve our internal procedures.

6.3.b. Production of reports and dashboards

We may produce internal reports and dashboards to improve the management of recruitment processes.

Wherever possible, anonymisation or pseudonymisation techniques will be applied to avoid the direct identification of candidates.

6.3.c. Development of models

We may develop analytical or statistical models aimed at improving the efficiency of recruitment processes and the management of applications.

Wherever possible, this processing will be carried out using anonymised or pseudonymised information.

7. Data sharing

We may rely on external service providers that may have access to personal data in order to provide services related to:

recruitment
administrative support
technology services
system hosting
cybersecurity
custody or destruction of information

These providers will act as data processors and will be subject to contractual obligations of confidentiality and security.

In addition, data may be communicated to public authorities and bodies where necessary to comply with legal obligations.

8. International data transfers

As a general rule, data will be processed within the European Economic Area.

If providers located outside the European Economic Area are used, HULAHOOP will adopt the appropriate safeguards provided for in the GDPR, such as the signing of standard contractual clauses approved by the European Commission or other equivalent mechanisms.

9. Data retention periods

Data will be retained only for the time necessary to fulfil the purposes described in this Policy.

Once the data is no longer necessary, it will be retained for the periods required by applicable regulations in order to:

comply with legal obligations
address potential claims

10. Automated decisions

If automated tools are used to support recruitment processes, HULAHOOP will adopt measures to safeguard the rights of candidates, ensuring:

human intervention in the final decision
the right to express your point of view
the right to challenge the decision adopted

11. Validity and updates

This Policy may be updated when necessary to adapt it to regulatory changes or to new data processing activities.

In the event of significant changes, we will inform users through the Hulahoop Careers portal or by email associated with their account.

Last updated: April 2026.