CANDIDATE PRIVACY NOTICE

1.

ABOUT THIS DOCUMENT

Each company within the Com Laude Group (the “Group”) is a “controller” in relation topersonal data. This means that we are responsible for deciding how we hold and use personal
information about you. You are being sent a copy of this privacy notice because you are
applying for work with us (whether as an employee, worker or contractor). It makes you awareof how and why your personal data will be used, namely for the purposes of the recruitment
exercise, and how long it will usually be retained for. It provides you with certain informationthat must be provided under the UK General Data Protection Regulation and EU General Data
Protection Regulation (collectively the “GDPR”).

2.

DATA PROTECTION PRINCIPLES

2.1

We will comply with the data protection law and principles, which means that yourdata will be:(a) Used lawfully, fairly and in a transparent way.
(b) Collected only for valid purposes that we have clearly explained to you and notused in any way that is incompatible with those purposes.
(c) Relevant to the purposes we have told you about and limited only to thosepurposes.
(d) Accurate and up to date.
(e) Kept only as long as necessary for the purposes we have told you about.
(f)

2.2

Kept securely.

“Personal data”, or “personal information”, means recorded information we hold about
you from which you can be identified. It may include contact details, other personalinformation, expressions of opinion about you or indications as to our intentions aboutyou. It does not include data where your identity has been removed (anonymousdata). “Processing” means doing anything with the data, such as accessing, disclosing,destroying or using the data in any way.

3.

WHAT TYPE OF INFORMATION WE HOLD ON YOU

3.1

In connection with your application for work with us, we will collect, store, and use thefollowing categories of personal information about you:

1

(a)

The information you have provided to us in your curriculum vitae and (ifapplicable) covering letter.

(b)

The information you have provided on any application, including name, title,address, telephone number, personal email address, date of birth, gender,
employment history and qualifications.

(c)
3.2

Any information you provide to us during an interview/application process.

We may also collect, store and use the following more sensitive types of personal
information:(a)Information about your race or ethnicity, religious beliefs, sexual orientationand political opinions.

(b)

Information about your health, including any medical condition, health andsickness records.

4.

HOW IS YOUR PERSONAL DATA COLLECTED?

We collect personal information about employees, workers and contractors through theapplication and recruitment process, either directly from candidates or sometimes from anemployment agency or background check provider. We may sometimes collect additional
information from third parties including former employers, credit reference agencies or otherbackground check agencies.

5.

FAIR AND LAWFUL PROCESSING

5.1

We will only use your personal information when the law allows us to. Most commonly,
we will use your personal information in the following circumstances:(a)

Where we need to comply with a legal obligation.

(b)

Where it is necessary for legitimate interests pursued by us or a third party
and your interests and fundamental rights do not override those interests.

(c)Where we have received your informed consent to use your personal
information for a specific purpose, in particular when processing sensitivedata.

5.2

We may also use your personal information in the following situations, which are likely
to be rare:(a)Where we need to protect your interests (or someone else’s interests).

(b)

Where it is needed in the public interest.

2

6.

HOW WE ARE LIKELY TO USE YOUR PERSONAL DATA

6.1

Some situations in which we will process your personal information are listed below:
To enable us to comply with our legal obligations-Checking you are legally entitled to work in the country where youremployment is based.

-Complying with health and safety obligations

To pursue legitimate interests-

To decide whether to appoint you to the role or work since it would be
beneficial to our business to appoint someone to that role or work-

We also need to process your personal information to decide whether to enter
into a contract (of employment or for services) with you-

Having received your CV/covering letter or your application form (and resultsfrom any test which you may take as part of your application, if applicable)
we will then process that information to decide whether you meet the basic
requirements to be shortlisted for the role. If you do, we will decide whether
your application is strong enough to invite you for an interview. If we decide tocall you for an interview, we will use the information you provide to us at theinterview to decide whether to offer you the role or work. If we decide to offer
you the role or work, we will then take up references and/or carry out
background checks before confirming your appointment.

6.2

Some of the above grounds for processing will overlap and there may be several
grounds which justify our use of your personal information.

6.3

If you fail to provide information when requested, which is necessary for us to consider
your application (such as evidence of qualifications or work history), we will not beable to process your application successfully. For example, if we require a credit checkor references for this role and you fail to provide us with relevant details, we will not beable to take your application further.

6.4

We will only use your personal information for the purposes for which we collected it,
unless we reasonably consider that we need to use it for another reason and thatreason is compatible with the original purpose. If we need to use your personal
information for an unrelated purpose, we will notify you and we will explain the legal
basis which allows us to do so.

6.5“Special categories” of particularly sensitive personal information, such as information
about your health, racial or ethnic origin, sexual orientation or trade union3

membership, require higher levels of protection. We need to have further justification
for collecting, storing and using this type of personal information.
6.6

We will process special categories of data in the following circumstances:(a)With your explicit written consent, in limited circumstances.

(b)

Where we need to carry out our legal obligations.

(c)Where it is needed in the public interest, such as for equal opportunities
monitoring.

6.7

Less commonly, we may process this type of information where it is needed in relation
to legal claims or where it is needed to protect your interests (or someone else’sinterests) and you are not capable of giving your consent, or where you have alreadymade the information public.

6.8

We may process special categories of your personal information including, asappropriate:(a) Information about your physical or mental health or condition to provide
appropriate adjustments during the recruitment process, for example whether
adjustments need to be made during a test or interview;(b) Your racial or ethnic origin or religious or similar information to monitor
compliance with equal opportunities legislation; and(c) to comply with any other legal requirements and obligations.

7.

CRIMINAL CONVICTIONS

We may only use information relating to criminal convictions where the law allows us to do so.
This will usually be where such processing is necessary to carry out our obligations andprovided we do so in line with our data protection policy.

8.

AUTOMATED DECISION-MAKING

You will not be subject to decisions that will have a significant impact on you based solely on
automated decision-making unless we have a lawful basis for doing so and we have notifiedyou.

9.

ACCURATE DATA

We will keep the personal data we store about you accurate and up to date. Data that isinaccurate or out of date will be destroyed. Please notify us if your personal details change or
if you become aware of any inaccuracies in the personal data we hold about you.

4

10.

DATA RETENTION

10.1

We will retain your personal information for a period of 12 months after we havecommunicated to you our decision about whether to appoint you to the role or work.
We retain your personal information for that period so that we can show, in the eventof a legal claim, that we have not discriminated against candidates on prohibitedgrounds and that we have conducted the recruitment exercise in a fair andtransparent way. After this period, we will securely destroy your personal informationin accordance with our data retention policy or applicable laws and regulations.

10.2

If we wish to retain your personal information on file, on the basis that a further
opportunity may arise in future and we may wish to consider you for that, we will write
to you separately, seeking your explicit consent to retain your personal information fora fixed period on that basis.

11.

PROCESSING IN LINE WITH YOUR RIGHTS

11.1

You have the right to:(a)Request access to any personal data we hold about you.

(b) Request to have inaccurate data held about you amended.
(c)Request erasure of your personal information. This enables you to ask us to deleteor remove personal information where there is no good reason for us continuing
to process it. You also have the right to ask us to delete or remove your personal
information where you have exercised your right to object to processing (seebelow).

(d) Object to the processing of your personal information where we are relying on alegitimate interest (or those of a third party) and there is something about yourparticular situation which makes you want to object to processing on this ground.
You may also object to the processing of your data for direct marketing purposes.

(e)Request the restriction of processing of your personal information. This enables
you to ask us to suspend the processing of personal information about you, forexample if you want us to establish its accuracy or the reason for processing it.

(f)

Request the transfer of your personal information to another party if the grounds
for processing your personal data is by consent or contractual necessity.

12.

DATA SECURITY

12.1

We will ensure that appropriate measures are taken against unlawful or unauthorised
processing of personal data, and against the accidental loss of, or damage to,personal data.

12.2

We have in place procedures and technologies to maintain the security of all personal
data from the point of collection to the point of destruction. We will only transfer
personal data to a third party on a need-to-know basis and if such party agrees to5comply with those procedures and policies, or if such party puts in place adequate
measures themselves.

12.3

Maintaining data security means guaranteeing the confidentiality, integrity andavailability (for authorised purposes) of the personal data. We will notify you and any
applicable regulator of a suspected breach where we are legally required to do so.

13.

PROVIDING INFORMATION TO THIRD PARTIES

13.1

We may disclose your personal data to:(a)companies within the Group to the extent necessary for the purposes set out
at section 6 above;(b)

our service providers and professional advisers (insurance providers, legaladvisors, accountants etc.), if required, in order for us to meet our legalobligations;(c)law enforcement agencies in connection with any investigation to help
prevent unlawful activity; and(d)third parties if we are under a duty to disclose or share your personal data inorder to comply with any legal obligation, or in order to enforce or apply ourterms of use and other agreements; or to protect the rights, property, orsafety of the Group, our customers, or others. This includes exchanging
information with other companies and organisations for the purposes offraud protection and credit risk reduction.

13.2

We require all third parties to respect the security of your personal data and to treat itin accordance with the law. We do not allow our third-party service providers to use
your personal data for their own purposes and only permit them to process yourpersonal data for specified purposes and in accordance with our instructions.

14.

SUBJECT ACCESS REQUEST

If you wish to know what personal data we hold about you or to exercise one of the rights
available to you, you must make the request in writing. We may charge a reasonable fee if
your request is found to be excessive or if you request further copies of your data following arequest. All written requests should be forwarded to the Group’s General Counsel.

15.

RIGHT TO WITHDRAW CONSENT

If you provided us with consent to process any personal data as part of the recruitment
exercise, you will have the right to withdraw your consent for processing for that purpose at
any time. To withdraw your consent, please contact the Group’s General Counsel. Once wehave received notification that you have withdrawn your consent, we will no longer process
your application and, subject to our retention policy, we will dispose of your personal data
securely.

616.

DATA PROTECTION ENQUIRIES

If you have any questions about this privacy notice or how we handle your personal
information, please contact the Group’s General Counsel. You have the right to make acomplaint at any time to the relevant data protection authority who is responsible for dataprotection issues in the country that you based in or in the country that the controller is located.

7