Epredia Recruiting Privacy NoticeThis Recruiting Privacy Notice (Privacy Notice) applies to the collection, use and storage of thepersonal data of job applicants by Epredia or its subsidiaries and affiliates in connection with ouronline and offline recruitment activities. This Privacy Notice is designed to help you understand who
we are, what personal data we collect about you, why we collect it, what we do with it during ourrecruitment process and what choices you have in relation to these activities.
Personal data as used in this Privacy Notice refers to all information that relates to an identified
individual or to an identifiable individual (i.e., information about you). For example, your name,address, email address, educational and employment background, CV and job qualifications.
Please read this Privacy Notice to understand how we use your personal data in connection with ourrecruitment activities.
Your Responsibilities
We remind you that it is your responsibility to ensure, to the best of your knowledge, that the personal
data you provide us with are accurate, complete, and up-to-date. If you choose to share personal
data of other people (such as dependents) with us, it is your responsibility to collect such personal
data in compliance with local legal requirements. For instance, you should inform such other people,
whose personal data you provide to Epredia, about the content of this Privacy Notice.
1) Data Controller Responsible for Processing your Personal Data: Epredia, its subsidiaries and its
affiliates are responsible for processing your personal data as described in this Privacy Notice. When
this Privacy Notice mentions “we,” “us,” or “Epredia,” it refers to the controller of your personal data
under this Privacy Notice, namely the Epredia affiliate or subsidiary which may be interested inoffering you a position or that otherwise decides which of your personal data are collected and how
they are used. You may obtain a list of the Epredia’s affiliates by contacting the Data Protection
Officer (you will find the contact details in Section 14 “Contact Us”).
2) Types of Personal Data We Collect About You: Below you will find an overview of the categories of
personal data that we may process during the recruitment process:Type of Data

Identification
Data

ExamplesName, gender, country, date and place of birth, nationality, language(s) spoken, marital/civil
partnership status, domestic partners, dependents

Type of Data

ExamplesContact
Information

Email, phone, address

Network
Traffic Data

Identification numbers, location data, online identifiers, IP address, cookies, device ID, websites
visited, language settings

Account Login
Information

Login ID, password, other information used to access and/or secure Epredia systems and applications
including the career website

Images fromwhich you
may beidentified

Pictures uploaded into CV or otherwise provided to us by you

Dataregardingqualifications
and careerdevelopment

Any information contained in CVs and additional documents containing personal details (e.g. diplomas,
certificates) as provided by applicants, educational and employment background, job qualifications andwork eligibility, including your visa and immigration status, driver’s license information, employment
references and related information, compensation requests

SpecialCategories of
Personal
Data/Sensitive
Personal
Information

When permitted by local law:

Criminal Data

Data relating to criminal behavior, criminal records or proceedings regarding criminal or unlawful
behavior (only in certain countries, for certain roles and only upon request of Epredia)

Compensationand payroll

Bank account information, desired salary, compensation, and benefits

Any other
information
you choose toshare with
Epredia

Feedback, opinions, information provided in emails and letters, during telephone calls andconversations•Information about disabilities to the extent relevant for the performance of your work: for instance,
where we would be required to make work or workspace adaptations or adjustments.
•Racial or ethnic data: for instance where this would show from pictures, photographs and other visual
images, but also where such data is processed for diversity related purposes

Information We Collect Automatically
When you apply for a job offered by us, use our recruitment channels, or visit our career websites, inaddition to the information you provide to us directly, we may collect information sent to us by yourcomputer, mobile phone or other access device. For example, we may collect the name of yourinternet service provider, the website that you used to link to our Website, the websites that you visit
from our website, the type of device you use, a unique device identifier (such as your device IMEI

number, MAC address of the device’s wireless network interface, or the mobile phone number usedby the device, mobile network information) your operating system and software version number, IP
address, the type of browser you use, the country and language code and time zone setting. We do
not use this information to identify any individual.
Additionally, if you visit our premises, for security reasons we might also record your personal data
through video or other electronic, digital, or wireless surveillance system or device (e.g. CCTV).
Information We Collect From Other Sources
To the extent permitted by applicable law, in addition to our recruitment channels or career websites,
we may also obtain information about you from other sources, such as from third party recruiters orother websites on the Internet (subject to such third party’s privacy notices), or from a backgroundcheck report.
3) The Reasons for Processing your Personal Data: To enable us to carry out the recruitment process
and to process your application, we may process your personal data for the following purposes.
• to enable your use of the Epredia Careers website and to process information about you forrecruiting purposes, we may process your personal data:• to identify and evaluate candidates, assess skills, qualifications and interest against Epredia career
opportunities;• to set up and conduct interviews and assessments, to evaluate, select and recruit applicants;• to conduct background checks as required or permitted by applicable local law;
• to contact third party references provided by applicant to evaluate applicant’s previous
performances or as otherwise necessary in context of recruitment activities; or• to enable your use of the Epredia careers website when you choose to register for an account.
To manage and improve relationships with current and potential job candidates, we may process yourpersonal data:• to identify and evaluate candidates, assess skills, qualifications and interest against
Epredia career opportunities:• to contact applicants by phone or email;• to inform applicants of available vacancies;• to provide applicants with information relating to their application and to fulfil requests;• to offer applicants suitable opportunities for employment within Epredia;• to respond to applicants’ requests;• to keep records related to the Epredia hiring process; or• to better understand how our career website is used and to improve the recruitment experience.
To comply with local legal and regulatory requirements, we may process your personal data:• to provide information to government institutions or supervisory authorities as applicable in all
countries in which Epredia operates, such as tax and national insurance deductions, record-keeping
and reporting obligations;• to comply with government inspections and other requests from government or other publicauthorities;• to respond to legal process such as subpoenas; or• to pursue legal rights and remedies, and manage any internal complaints or claims.
To maintain the security of our career website and our sites, systems and networks, we may process
your personal data:• to deploy and maintain technical and organizational security measures; or• to conduct internal audits and investigations.
In defense of legal claims, we may process your personal data to establish, exercise or defend legal
claims to which Epredia is subject.
4) Legal Bases for Personal Data Processing (For Individuals in the European Economic Area,
Switzerland and United Kingdom). In order to be able to process your personal data, we may rely on
different legal bases, including:• your consent (only when legally required or permitted). If we rely on your consent as a legal basis
for processing your personal data, you may withdraw your consent at any time;• the necessity to establish a contractual relationship with you;• the necessity for us to comply with legal obligations and to establish, exercise, or defend against
legal claims;• the necessity to pursue our legitimate interests, including;• to ensure that our networks and information are secure;• to administer and generally conduct business within Epredia; and• to prevent or investigate suspected or actual violations of law;
• the necessity to respond to your requests (such as responding to your requests regarding thehandling of, deletion of, or changes to your personal data);• the necessity to protect the vital interests of any person; or
any other legal basis otherwise permitted by local laws;5) Sharing your Personal Data: To fulfill the purposes for which your personal data has been collected(refer to Section 3 on “The Reasons for Processing your Personal Data”) we may disclose yourpersonal data with:•••

Epredia Affiliates: Due to our global nature, your personal data may be shared with certain
Epredia affiliates. Access to personal data within Epredia will be limited to those who have aneed to know the information, for the purposes described in this Privacy Notice, and may
include your interviewers, the relevant manager(s) of the respective job offer and otherselected personnel within Epredia.
Service Providers: We may outsource certain personal data processing activities to trusted
third party service providers to perform functions and provide services to us, such as IT service
providers, consultants, and background check providers.
Public and Governmental Authorities: When required by law, or as necessary to protect ourrights, we may share your personal data with entities that regulate or have jurisdiction over
Epredia.

•

Professional advisors and others: We may share your personal data with other parties
including professional advisors, such as lawyers.

•Other parties in connection with corporate transactions: We may also, from time to time, shareyour personal data during corporate transactions, such as during a sale or purchase of any
Epredia business or asset, or any reorganization, merger, joint venture, or other disposition of
Epredia’s business, assets, or stock.

6) Storing your Personal Data: Due to our global nature, the personal data you provide to us may betransferred to or accessed by Epredia affiliates and trusted third parties from many countries aroundthe world. As a result, your personal data may be processed outside the country where you live if thisis necessary for the fulfilment of the purposes described in this Privacy Notice. If you are in theEuropean Economic Area, we may transfer your personal data to countries located outside of theEuropean Economic Area. Some of these countries are recognized by the European Commission asproviding an adequate level of protection. For transfers from the European Economic Area to othercountries that are not are recognized by the European Commission as providing an adequate level ofprotection, we have put in place adequate measures to protect your personal data, such asorganizational and legal measures (e.g. binding corporate rules and approved European Commission
standard contractual clauses). You may obtain more information about these measures by contacting
the Data Protection Officer. You will find the contact details in Section 14 “Contact Us.” We willprocess any request in line with any local laws and our policies and procedures.
If you are a resident of a country with data localization laws, your personal data will be stored onservers located within your country.
7) Retention of Your Personal Data: We will retain your personal data for as long as needed or
permitted in light of the purpose(s) for which it was obtained. The criteria used to determine ourretention periods include:• the length of time we have an ongoing employee relationship with you;• whether there is a legal obligation to which we are subject; or• whether retention is advisable in light of our legal position (such as applicable statutes of limitations,litigation or regulatory investigations).
For the purposes of the Epredia Careers website, the retention period will be 1 year from the date you
register for an account.
8) Keeping your Personal Data Secure: Epredia implements appropriate administrative, technical andphysical safeguards to protect the confidentiality, integrity and availability of your personal data. We
will take appropriate measures that are consistent with applicable privacy and data security laws andregulations, including requiring our service providers to use appropriate measures to protect theconfidentiality and security of your personal data. Depending on the state of the art, the costs of theimplementation and the nature of the data to be protected, we put in place technical andorganizational measures to prevent risks such as destruction, loss, alteration, unauthorized disclosureof, or access to your personal data.
9) Use of Cookies: We use cookies and similar technologies. These are small data files that are sent
to your browser and placed on your computer’s hard drive when you visit a website. The information
the cookie contains is set by a website’s server and it can be used when the user visits the website.
Cookies are designed to remember things that an internet user has done while on a website in thepast, which can include logging in or clicking on links. We make continuous improvements andchanges to the ways we use cookies and similar technologies and we will keep this section of ourPrivacy Notice updated with the cookies we use. We use the following cookies on our website:
Strictly necessary cookies: Required for the operation of our website. They include, for example,
cookies that enable you to log into secure areas of our website, to move around the website and touse its features.
Functionality cookies: These recognize you when you return to our website. This enables us topersonalize our content for you, for example, your choice of language or region.
Analytical/performance cookies: Allowing Epredia to recognize and count the number of visitors andto see how visitors move around our website when they are using it. This helps us to improve the way
our website works, for example, by ensuring that users are finding what they are looking for easily.
Some of these are persistent cookies that may be used if you log on to restricted areas of our website
to remember who you are. Others are session cookies that may be used for anonymous identificationof a website visit for technical purposes only. Session cookies are stored only temporarily during thebrowsing sessions and are deleted once the browser is closed.
We use cookies and similar technologies for the following purposes:• to improve our website security;• to identify you when you sign-in to our website and remember your preferences;• to analyze how you use our website by tracking specific actions on our website, such as visits to thevarious pages of our website;• to collect anonymous statistical information on how visitors use our website so that we can make
improvements to its usability and to improve content delivery value;We also use cookies and similar technologies provided by other companies to collect web traffic
information such as time, date, IP address, and browser, so that we can store your preferences andother information on your device and save you time on subsequent visits by eliminating the need torepeatedly enter the same information. In most circumstances the information captured cannot
identify you as an individual. This data could possibly lead to your identification, but we do not use it
to do so.
10) Opting out of cookies: You may refuse to accept cookies by altering the settings on your internet
browser (for example Internet Explorer, Chrome and Firefox). Please note that if you choose not topermit cookies some areas of our Website may not function properly or be accessible.
In general, by consulting the help menu item in your internet browser, instructions on how to disable
or delete cookies is available. Most browsers are set-up to accept these cookies automatically. In
addition, you can deactivate the storing of cookies or adjust your browser to inform you before thecookie is stored on your computer. You may also use self-regulation programs available in yourjurisdiction to manage the way that companies other than Google advertise to you, such as the EUbased Your Online Choices.
11) Exercising Your Rights: Residents of the European Economic Area (EEA), United Kingdom or
Switzerland: You have the right to: request(a) access to the personal data we hold about you; (b) request we correct any inaccurate personal
data we hold about you; (c) request we delete any personal data we hold about you; (d) restrict theprocessing of personal data we hold about you; (e) object to the processing of personal data we holdabout you; and/or (f) receive any personal data we hold about you in a structured and commonly usedmachine-readable format or have such personal information transmitted to another company. We
may ask you for additional information to confirm your identity and for security purposes, before
disclosing information requested to you. Where you have been asked to consent to the processing ofyour personal data, we will provide you with an opportunity to withdraw your consent. You can
withdraw consent, such as by contacting us using our contacts details below. In each case you will begiven information about how to withdraw consent. Any withdrawal of consent will not affect thelawfulness of the processing based on your consent before the withdrawal. Please also note that
where you withdraw consent, we will only stop processing your personal data that relates to thewithdrawal of consent. If you would like to review, change, restrict, or delete the personal data you
have supplied to us (to the extent Epredia is not otherwise permitted or required to keep such
personal data), if you wish to object to certain data processing operations (as permitted by applicablelaw), or if you would like to receive a copy of your personal data (in a common machine readable
format, to the extent such is required by applicable law), then you cancontact: privacy@epredia.com.
For any other questions related to the protection of your personal data by Epredia or regarding thisPrivacy Notice in general, you can contact the Data Protection Officer at privacy@epredia.com or bymail to Epredia, 20 Post Rd., Portsmouth, NH 03801. We will process any request in line with any
local laws and our policies and procedures. If you in the EEA, Switzerland or the United Kingdom you
have the right to lodge a complaint about how we process your personal data with the supervisory
authority in your country. In the EEA, the relevant authority would be the Autoriteit Persoonsgegevens
in the Netherlands.
12) Your Responsibilities: We would like to remind you that it is your responsibility to ensure, to thebest of your knowledge, that the personal data you provide us with are accurate, complete, and up-todate. Furthermore, if you choose to share personal data of other people (such as dependents) withus, it is your responsibility to collect such personal data in compliance with local legal requirements.
For instance, you should inform such other people, whose personal data you provide to Epredia,
about the content of this Privacy Notice and obtain their consent (provided they are legally competent
to give consent) for the use of that personal data by Epredia as set out in this Privacy Notice(including transfer and disclosure).
13) Changes to this Privacy Notice: Any changes we make to our Privacy Notice in the future will be
posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently
to see any updates or changes to our Privacy Notice.
14) Contact Us: Questions, comments and requests regarding this Privacy Notice are welcomed andshould be addressed to the Data Protection Officer at privacy@epredia.com or to Epredia, 20 Post
Rd., Portsmouth, NH 03801. If you contact us, we will do our utmost to address any concerns you
may have about our processing of your personal data.
California Privacy Rights
Our California Privacy Disclosure explains how Epredia collects, uses and discloses the personal
information of California residents subject to the California Consumer Privacy Act, amended by the
California Privacy Rights Act (“California Privacy Rights Act”). This Disclosure also applies toresidents of other US States with similar privacy laws, as applicable.
For more information about how we collect, disclose and secure information about our customers,
please refer to our Privacy Statement.
To the extent this notice conflicts with our Privacy Statement, this Disclosure takes precedence for
California residents.
California Disclosure
Personal Information under the California Privacy Rights Act: Under the California Privacy Rights Act,
“Personal Information” is information that identifies, relates to, or could reasonably be linked to aparticular California resident or household.

Personal Information We Collect: We collect Personal Information about California residents in avariety of contexts. The main reason we collect Personal Information about California residents is toprovide products and services. However, the Personal Information that we collect, use and disclose
about a California resident will depend on our relationship with that resident. In the previous 12
months, we have collected the following types of Personal Information about California residents
subject to the California Privacy Rights Act:
1. Identifiers, such as name and email address
2. Internet or network activity information, such as browsing history and interactions with our
website
3. Inferences drawn from any of the Personal Information listed above to create a profile about anindividual’s characteristics
How We Use Personal Information: The purposes for which we use the Personal Information that wecollect about California residents depends on our relationship with the specific individual. Generally,
we may use Personal Information to operate, manage and maintain our business, to provide our
products and services, and to achieve our business objectives. For example, we use Personal
Information to assess job applicants. We do not use sensitive personal information, such as medical
information, to provide this Careers Website. Additional information on how we may use personal
information can be found in the section titled “How we use your data” above.
How We Share Personal Information: We share Personal Information about California residents forour business purposes in a variety of contexts. For example, we disclose Personal Information about
California residents to our recruitment service providers. In the past 12 months, we have disclosed tothird parties, such as our recruitment partners, the following categories of Personal Information about
California residents that are subject to the California Privacy Rights Act: (1) Identifiers, such as name,and email address; (2) Internet or network activity information, such as interactions with our website;(3) Inferences drawn from any of the Personal Information listed above to create a profile about anindividual’s characteristics, for example.
How Long We Keep Personal Information: We keep your Personal Information for as long as neededor permitted taking account of the purpose(s) for which it was collected, and we will also consider (i) if
you successfully applied for a job; (ii) if retention is required by a relevant legal obligation; or (iii) if it islegally advisable (such as litigation or regulatory investigations, or the time available to bring a legal
claim). We may remove Personal Information for inactive accounts from our database, subject to any
applicable legal or regulatory obligations. Similarly, we may delete Personal Information at any time
and without providing a reason.
How to Access, Correct or Delete Your Personal Information: please see the general privacy rights
section below.
We Do Not Sell Personal Information: As stated in this Disclosure, in the past 12 months we have not“sold” Personal Information about California residents. In this Disclosure, “sold” means the disclosureof Personal Information for monetary or other valuable consideration, and “shared” means thebusiness sharing, renting, releasing, disclosing, disseminating, making available, transferring, orotherwise communicating orally, in writing, or by electronic or other means, an individual’s Personal

Information to a third party for cross-context behavioral advertising, whether for monetary or othervaluable consideration.
Sharing Personal Information and Opt-Out Right In the past 12 months, we have shared the following
types of Personal Information about California residents that are subject to the California Privacy
Rights Act, with third parties for cross-context behavioral advertising: (1) Identifiers, such as nameand email address; (2) Internet or other electronic network activity information, including, but notlimited to, IP address, unique device identifier, browsing history and information regarding an
individual’s interaction with our website. The main third party with which we share the above
categories of Personal Information for cross-context behavioral advertising is LinkedIn.
For more information about how we collect, disclose and secure information obtained throughepredia.com and other websites operated by us and through our “Social Media Pages” and “Targeted
Advertising” activities, please review our Privacy Statement.
CPRA Annual Metrics: Under the CPRA, we provide on request a copy of the Annual Report thatprovides requested metrics for the previous calendar year. To access the metrics, contact
privacy@epredia.com. Epredia does not sell personal information and therefore does not have any
statistics for Opt Out requests.
Privacy Rights – requests to access, correct and delete personal information
Requests for Access to and Correction of Personal Information: If you are a resident of California you
may request that we provide to you the following information covering the 12 months preceding yourrequest: (1) the categories of Personal Information that we collected about you and the types ofsources of such Information; (2) the business or commercial purpose for collecting Personal
Information about you; (3) the categories of Personal Information about you that we disclosed to third
parties for a business purpose and the categories of third party recipients (if applicable); and (4) the
Personal Information we collected about you.
Residents of California can also request correction of inaccurate personal information that we haveabout you. In some cases, we may refuse your request. For example:•••

If we cannot verify your identity
If we cannot confirm that the Personal Information that we hold relates to you
If an exception under the relevant state laws applies, such as where the disclosure of Personal
Information would adversely affect
Requests to Delete Your Personal Information: If you are a resident of California, you may also
request that we delete Personal Information that we collected about you. We may refuse your request
where an exception under the relevant state laws applies.
If you are a resident of California, or any other US State offering similar rights, you can request
access, correction, deletion or any of your other privacy rights by contacting privacy@epredia.com orcalling (800) 522-7270. We will let you know if the rights do not apply to you.
Your request must:••Provide sufficient information to allow us to reasonably verify you are the person about whom
we hold personal information, or an authorized representative.
Describe your request with sufficient detail that allows us to properly understand, and respondto it.

We cannot provide you with personal information if we cannot verify your identity or authority to makethe request or we cannot confirm the personal information relates to you.