Recruitment Privacy Statement

Effective as of December 17, 2021

This Recruitment Privacy Statement explains our privacy practices when you apply for employment with Populous Holdings, Inc., together with its subsidiaries and affiliates (“Populous”, “we”, or “us”). Please see our Privacy Policy for additional information regarding our privacy practices. This Privacy Statement covers the following topics:

1. What personal data do we collect?
2. Do we collect and process special category or sensitive personal data?
3. How do we use your personal data?
4. What are the legal bases for collecting and using my personal data?
5. Will you share my personal data with third parties?
6. Do you transfer my personal data to third countries?
7. How is my personal data protected?
8. How long is my personal data retained?
9. What rights do I have with respect to my personal data?
10. Will I be notified of changes to this Privacy Statement?
11. How can you contact us?

1. What personal data do we collect?

We will collect the following personal data when you apply for employment with us:

• When you apply, we will collect personal data such as your name, address, telephone number, email address, employment and educational history, and other demographic and employment-related information as set forth in the online application. We use Paycor to collect and process applications. Paycor’s privacy policy is available here. We also use SEEK to collect and process applications in Australia. SEEK’s privacy policy is available here.
• Interactions with Us. If you engage in a formal or informal interview with us, we will collect information regarding your interactions and discussions with us.
• If we contact your references, we may collect personal data about you, including your employment history.
• Other Information. We may collect other personal data about you if we run a background check, criminal or financial history report, or contact your former employers.

2. Do we collect and process special category or sensitive personal data?

Subject to and in accordance with the legal requirements of the country in which you are seeking employment and our Privacy Policy, we collect and process special category or sensitive personal data such as race, ethnicity, religion, disability, and, in appropriate circumstances due to the nature of the position, criminal background information.

3. How do we use your personal data?

We use your personal data to consider your application for employment, including for our internal purposes, government reporting purposes (if applicable), to perform background checks, and for other lawful purposes connected with your application.

4. What are the legal bases for collecting and using my personal data?

We process your personal data in compliance with applicable law. In addition, as may be applicable, we will process your personal data with your consent, for our legitimate interest of considering your employment application, to perform an employment contract with you, to enable us to comply with legal obligations, and as may be necessary to exercise or defend against any legal claims.

5. Will you share my personal data with third parties?

We may share your personal data with our service providers and agents; for example, for undertaking background and criminal history checks. If we share your personal data, we will do so in accordance with applicable law and with appropriate safeguards to ensure for confidentiality.

6. Do you transfer my personal data to third countries?

We are a global company with offices in multiple countries. As a result, it is possible that your personal data will be transferred from the country in which you reside to another country. If we transfer your personal data for our own purposes, we will do so in accordance with applicable law. For any transfers of personal data from the European Economic Area (EEA), Switzerland or the United Kingdom that we make to third countries, we use appropriate safeguards to ensure for the law processing and transfer of the data, including, when appropriate, the use of standard contractual clauses approved by the European Commission. To obtain a copy of the safeguards, contact us as described below.

7. How is my personal data protected?

We maintain commercially reasonable security measures to protect the personal data we collect and store from loss, misuse, destruction, or unauthorized access. However, no security measure or modality of data transmission over the Internet is 100% secure. Although we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

8. How long is my personal data retained?

We will retain your personal data for as long as necessary to fulfill the purposes for which we collect it and for the purpose of satisfying any legal, accounting, or reporting requirements that apply to us.

9. What rights do I have with respect to my personal data?

Depending on the jurisdiction in which you are located, you may have the rights to access, delete, update, or correct your personal data and to lodge a complaint with us or a data protection authority. You also may have the right to withdraw your consent to processing, object to processing of your personal data, or opt out of direct marketing from us. For more information, please refer to the description of your rights in our Privacy Policy. If you would like to exercise your legal rights, please contact us as described below. We will process your request in accordance with applicable legal requirements.

10. Will I be notified of changes to this Privacy Statement?

If we change this Privacy Statement, we will post an amended version on this webpage. If we make material changes, we may also notify you by other means, such as sending an email or posting a notice on our home page. If required by applicable data protection laws, we will obtain your consent to any material changes.

11. How can you contact us?

For more information, please contact us at privacy@populous.com.