CONSENT PRIVACY POLICY

GAC Group and its direct and indirect subsidiaries (“GAC”) acts as a data controller, as we are responsible for deciding how we hold and use Personal Data about you. GAC respects the privacy of all applicants and is committed to protecting the information you share in accordance with applicable privacy laws. GAC handles the Personal Data you submit when applying for job opportunities (whether as a worker or contractor) or provided by third parties for recruitment purposes. Please read this Consent Privacy Policy carefully.



I. INFORMATION YOU PROVIDE

This Consent Privacy Policy applies to any Personal Data provided in order to apply, search or be recruited for a position at GAC. This Personal Data may include the following:

• Identifiers, such as your name and general contact details

• Gender

• Authentication information, for use on our careers site

• Professional or employment-related information, including that which you included in your CV/Resume or cover letter, such as job history, academic background, skills and competencies, personal interest, employee preferences, willingness to relocate, current and historic salary details and salary expectations

• Languages and other relevant skills

• Awards and professional memberships

• Professional and other work-related licenses, permits and certifications

• Eligibility to work in country where job applied for is located

• Available start date



We do not require, but you may also choose to voluntarily provide additional relevant data as part of your application. GAC prefers to only collect Sensitive Personal Data where it is legally required or for compliance with diversity and anti-discrimination policies. GAC requires that written consent be obtained for the collection, storage and use of an applicant’s Sensitive Personal Data. Categories of Sensitive Personal Data include the following:

• Race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or criminal charges or convictions

• Health information, genetic, biometrics, or sexual orientation

• or any number that can reasonably lead to identity theft, such as a social security, identity or passport number.



You are responsible for information you provide to GAC and for its accuracy, and for not knowingly omitting any related information of an adverse nature. Providing any inaccurate information may make you ineligible for employment.



II. INFORMATION COLLECTED ABOUT YOU

We collect Personal Data about applicants and prospects from several sources to verify information about their credentials, follow-up on references provided and to conduct background investigations. It is GAC ’s approach to collect such information from third parties only with your knowledge and agreement. The sources of collection include:

• You, the applicant

• Recruitment agencies

• Career networks, online employment service providers (e.g., LinkedIn)

• Selection assessments providers

• Background check providers



III. HOW WE USE INFORMATION ABOUT YOU

The application data you submit on our careers site and Personal Data provided by employment service providers will be stored in the European Union jurisdictions. The application data will be collected, used, transferred, and disclosed to GAC and its consultants for the following purposes:

• Processing your application

• Assessing your skills, qualifications, and suitability for the role

• Conducting interviews

• Carrying out background and reference checks, where applicable

• Communicating with you about the recruitment process

• Keeping records related to our hiring process

• Providing any service available to you on our careers site

• Complying with legal or regulatory requirements

• To answer any queries, you may send us by email



Where collected through GAC ’s careers site, GAC relies on legitimate interest as the legal basis for the collection and use of your Personal Data. GAC relies on consent as the legal basis for the collection and use of your Personal Data from an employment service provider.

GAC in order to make a decision to appoint an applicant to a vacant role, will need to process your Personal Data to decide to make you an offer and enter into an employment agreement with you.

In completing the application process, you will have a profile that will allow you to self manage your preferences.

Information about you will be added to GAC’s applicant database and will be used for the purpose of considering whether your profile meets the requirements of a vacant role at GAC. If we choose to make you an offer, Personal Data you have submitted will be incorporated into GAC ’s HR Information System and will be used to manage the new hire process.

If you become a GAC employee, your Personal Data will be managed in accordance with the GAC Employee Privacy Notice.

GAC will conduct the recruitment process in a fair and transparent way.

IV. DISCLOSURES OF PERSONAL DATA AND INTERNATIONAL TRANSFERS

Personal Data about you will be shared internally for the purposes of filling a vacant role. This may include sharing with GAC s and agents who have a business need to know, such as: recruiters, human resource personnel, interviewers, managers or their designees, and technical service personnel, if access to the data is necessary for the performance of their roles.

We only transfer your Personal Data internationally or to a third party when we are satisfied that adequate levels of protection are in place to protect the integrity and security of any information being processed, in compliance with applicable data protection laws. To provide adequate protection for international transfers, which may include executing appropriate contractual clauses.

Some parties that process or store personal information may be located in jurisdictions outside of your country of residence. Therefore, your information may be processed and stored in these jurisdictions and, as a result, foreign governments, courts, or law enforcement or regulatory agencies may be able to obtain disclosure of your information through the laws in these countries.

V. DATA SECURITY

We have put in place reasonable security measures to prevent your Personal Data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

VI. HOW LONG WILL WE USE YOUR DATA

We will retain your Personal Data for no longer than is necessary to fulfill the purpose of filling the vacant role and for other potential opportunities that may be of interest to you and in accordance with applicable law. We also retain your Personal Data for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your Personal Data in accordance with GAC ’s Data Retention Policy, applicable laws and regulations.

In completing the application process, you will have a profile that will allow you to self-manage your preferences. If you decided to opt-out of our continued storage and use of your application data, you can submit a request for deletion on our career site.

VII. RIGHTS YOU MAY HAVE

If you choose to register on our careers site, you may access, review, change, and delete some of the Personal Data collected about you and stored on our careers site by logging in and updating your account information. The updated profile will be used as the default the next time you apply for a job using your account online.

To change Personal Data that you have already submitted for consideration for a specific position, please resubmit your application to update your Personal Data. We encourage you to promptly update your Personal Data if it changes or is inaccurate.

Upon request, we will delete your Personal Data from our active database, although some information may be retained as required by law.

Consistent with applicable law, you may have the right to be informed about our data practices, as well as about public and private entities with which we have shared your Personal Data and the possibility of denying consent and the consequences of such denial. Depending on applicable law, you may also have the right to restrict processing by requesting anonymization, blocking or deletion of data and to withdraw your consent to future processing, the right to data portability, and the right to object to processing carried out in violation of applicable laws.

If you would like to exercise your rights, or have any questions, concerns, or objections to how we process your Personal Data, please contact GAC ’s Group GDPR Coordinator at [email protected]. You may log into your profile to access and modify your Personal Data. Please contact us at [email protected] if the site does not support your request. Please note that certain Personal Data may be exempt from such access, correction, deletion, or objection rights pursuant to law. If you are not satisfied with our response to your request, you may make a complaint to the relevant privacy regulatory body in your country of residence.

If GAC carries out automated decisions which affect your interests, you have the right to require the review of such decisions. You can exercise these rights by contacting [email protected].

Submitting your application is voluntary, and you are under no statutory or contractual obligation to provide Personal Data to GAC during the recruitment process. However, if you decline to submit requested applicant data our ability to consider you as a candidate may be limited.

By submitting your application, you declare that you have read and understood this Consent Privacy Policy.

This policy was last updated in September 2021.