Recruitment Privacy Notice

i) Introduction
The purpose of this Notice is to explain how we, Gunnebo, handle Personal Data about our job applicants and to explain the rights that applicants have under data protection law. In this Notice, we refer to this type of information as "Application Data".

This Notice applies to applications submitted via job pages, LinkedIn, Gunnebo's website or intranet, and those submitted via third parties, such as recruitment agencies and job boards. It also applies to applications submitted via other means, such as by post and email.

Please refer to the Glossary below for an explanation of the defined terms in this Policy.

ii) Overview: the Gunnebo 10 Data Protection Principles
Gunnebo observes the Gunnebo 10 Data Protection Principles in relation to Application Data:

1. Fairness and Transparency: Give people information about how Gunnebo processes their Application Data.
2. Lawful Processing: Make sure we always have a good, lawful reason to process Application Data.
3. Purpose Limitation: Only collect Application Data for a specific business need of Gunnebo. If we want to want to reuse the Application Data for a new purpose, we must make sure the two are compatible.
4. Data Minimisation: Only process as much Application Data as we need, and no more.
5. Accuracy: Keep Application Data accurate, complete, and up-to-date.
6. Retention: Only keep Application Data for as long as we need it. If we don't need the Application Data anymore, we must delete it or anonymise it.
7. Security: Protect Gunnebo's Application Data from getting lost or stolen. Make sure our service providers protect our Application Data as well.
8. Individual Rights: Allow individuals the right to access, correct or erase their Application Data, or object to it being used for certain purposes.
9. Application Data Transfers: Put in place safeguards before sending Application Data outside Europe.
10. Accountability: Gunnebo will take steps to make sure our processing of Application Data complies with these 10 Data Protection Principles.

iii) What Application Data does Gunnebo collect?
Gunnebo will generally only collect Application Data in the recruitment process that is necessary to assess you for the post applied for. This may include the following categories:

• Information you provide in order to set up an account ("Profile") on job pages, such as your email address;
• Information you provide in order to apply for a job vacancy with Gunnebo to tell us who you are and to build a picture of your capabilities and suitability for certain positions, such as your name, contact information, nationality, professional qualifications, previous employment history, personal interests, experiences and a copy of your résumé;
• Information collected by Gunnebo as a result of the recruitment process, such as your performance at assessment centres, interview or in other assessments and information provided by your referees; and
• Information related to your use of our website, for example your IP address. This information may be collected by using cookie technology. For more information about how Gunnebo uses cookies please see our Privacy Policy.

Personal Data about criminal convictions or medical information will only be sought where permitted by local law.

We will indicate where the information we have requested is mandatory or optional.

iv) What will Gunnebo do with your Application Data?
The main purposes for which we use Application Data include:

• Supporting and Processing your job application, for example, so we can assess your ability to meet the job specification, in order to shortlist applicants and to verify references and professional qualifications provided by those applicants;
• Improving our application process, for example to ensure that our website, intranet and job-page portal are user-friendly and contain appropriate and helpful information; and
• [Ensuring compliance with our Code of Conduct, for example to ensure that we are living up to our values and, in particular for equal opportunities monitoring purposes.]

We may verify the Application Data you provide during the recruitment process and/or collect Personal Data about you from sources other than you to assist with our 'Pre-Employment Checks'. This may include checking your qualifications, directorships, financial history (e.g. bankruptcy) and if you have a criminal record. If this occurs:

• You will be told in advance which aspects of your Application Data will be verified including an explanation of how the Pre-Employment Checks will be carried out; and
• Information about criminal convictions (if collected) or medical information will only be collected through official authorised sources and in accordance with applicable law.

Where it is necessary and appropriate to you're the role you have applied for, we may also require you to undertake drug and alcohol testing prior to commencing your employment with us.

IMPORTANT: If you indicate that you do not have the right to work in the country in which you are applying for a position, the system will automatically drop your application and it will not be reviewed by Gunnebo. However, if you would like to explain your circumstances to us, please contact us using the contact information set out in paragraph 9 below.

Gunnebo will only process your Application Data where we have a legal basis for doing so. Gunnebo's processing of Application Data is generally because it is necessary for us to decide whether to enter into a contract of employment with you. In addition, certain data processing may be based on your consent (which you have the right to withdraw) or because it is necessary to comply with a legal obligation or to enable us to pursue our legitimate business interests (for example where it is necessary to understand our applicants in sufficient detail so we can deliver an effective recruitment service).

v) Who is your Application Data disclosed to?

a. Within Gunnebo

Gunnebo restricts access to Application Data to people within Gunnebo who have a "need to know" that information. For example, certain individuals throughout Gunnebo will have access to your Application Data in order to process your job application and manage the recruitment cycle.

b. Outside Gunnebo

Gunnebo shares Application Data with authorised third party service providers, in order to conduct and manage recruitment. For example, we may share your personal information with these service providers in order to conduct screening and verification of your application and the information you have provided to Gunnebo. This includes verifying academic and professional qualifications.

Generally, Gunnebo will only disclose your Application Data to third parties outside Gunnebo and its suppliers:

• when required to do so by law;
• in response to a legitimate request for assistance by the police or other law enforcement agency; and
• to seek legal advice from Gunnebo's external lawyers or in connection with litigation with a third party.

vi) How long will Gunnebo retain your Application data?
We keep your Application Data in accordance with our internal retention policies and procedures. Typically, if you are unsuccessful in your job application with us (or if you reject the position), your Application Data will be destroyed usually within [6-18 months] (depending on the jurisdiction) in order to comply with our legal obligations and so that we may contact you again if another suitable position arises. If you would like more information on our retention of your Application Data, please contact us.

If you are successful in your application and join Gunnebo we will retain your Personal Data in accordance with our internal data retention guidelines and procedures. More information will be provided when you start.

vii) Where does Gunnebo store your Application data?
Applicants should be aware that their Application Data may be transferred to, and stored at, a destination outside their country of residence, which may have have less strict, or no data protection laws, when compared to those of their country of residence. It may also be processed by staff operating outside of their country of residence, who work for us or for one of our suppliers, for example in the provision of support services.

Whenever we transfer your Application Data outside of your country of residence, we will take legally required steps to ensure that adequate safeguards are in place to protect your Application Data and to make sure it is treated securely and in accordance with this Notice. If you are located in the EEA or the UK, you may contact us for a copy of the safeguards which we have put in place to protect your Application Data and privacy rights in these circumstances.

viii) Exercising your rights
You may have the right to request access to, rectification or erasure of, the Application Data Gunnebo holds about you. You may also have the right to object to or restrict certain types of processing of your Application Data and request to receive a machine-readable copy of the Application Data you have provided to Gunnebo. Remember that you can up-date your contact information in your online account Profile.

Any request to exercise one of these rights will be assessed by Gunnebo on a case by case basis. There may be circumstances in which we are not legally required to comply with your request because of the laws in your jurisdiction or because of relevant legal exemptions provided for in data protection legislation.

ix) Contact us
Please contact the Gunnebo Legal Team at privacy@gunnebo.com if you would like to find out more about any matters relating to this Notice or to exercise your rights as outlined in paragraph 8 above. if you would like to find out more about any matters relating to this Notice or to exercise your rights as outlined in paragraph 8 above.

If you have concerns about the way in which Gunnebo has handled your Application Data, you have the right to complain to your Data Protection Authority. However, if you have concerns we encourage you to raise this with Gunnebo in the first instance.

Last updated 5 February 2018.

Glossary

Application Data: Personal Data relating to job applicants.

Data Protection Authority: The relevant supervisory authority with responsibility for privacy or data protection matters in the jurisdiction of Gunnebo and/or a Gunnebo Group Company;

European Economic Area (EEA): The EEA includes all European Union member states and Iceland, Liechtenstein and Norway.

Personal Data: Information which relates to an identified or identifiable individual (i.e. data about Gunnebo employees, contractors, applicants, employees of vendors and suppliers, contractors, customers, patients using our products and individuals who use our website or service centres). It includes names, addresses, email addresses, job applications, user account information, and correspondence. Personal Data can also include web browsing information (e.g. data associated with a particular cookie) and IP addresses, when such information can be linked to an individual.

Pre-Employment Checks: Personal Data relating to a potential Gunnebo employee collected from sources other than the candidate. For example, directorships, financial history, qualifications and criminal record.

Processing Doing anything with Personal Data; this includes collecting it, storing it, accessing it, combining it with other data, sharing it with a third party, or even deleting it.