Recruitment Privacy Policy

RHR collects your personal information during the application and recruitment process from applications, CVs or resumes, public social media, assessments, interviews, and third parties (e.g., recruitment agencies, references, and educational institutions). When we obtain information from third parties, we take steps to ensure they are legally permitted to disclose it.

The information RHR collects from you and these sources includes:

• your name, contact information, demographic data, and details in your CV or resume (including your educational background, work history, and other qualifications);
• employment objectives, skills and certifications, memberships, and community involvement;
• results of assessments, surveys, questionnaires, and interviews, including psychometric assessments, personality inventories, and behavioral evaluations administered by RHR or third-party providers;
• job performance, professional reputation, and references;
• details regarding any accommodation requests you make throughout the recruitment process;
• details of your ability to work in certain locales (including work permits, nationality, and residency details);
• educational, criminal, and financial background checks for certain roles, where permissible by local law (these background checks may mean a third party contacts you and obtains information);
• information in relation to sex/gender, race, nationality, ethnicity, and health, for legal compliance and equal opportunities monitoring;
• financial details (where necessary for travel reimbursement or onboarding);
• medical and health information (e.g., information in relation to any medical condition, health and sickness records, to the extent that you require adjustments to be made to our assessment and interview processes);
• information about your use of our information and communication systems; and
• any other information you may voluntarily disclose to us during the application process.

You are not required to provide personal information, but failure to do so may prevent us from processing your application. Do not share unnecessary sensitive information. If you provide information about references, previous employers, emergency contacts, or family members, please ensure they are aware of this Policy and consent to us contacting them.

RHR uses your personal information in the following ways:

• manage the recruitment process and assess your candidacy, including through assessments conducted by RHR or third-party providers;
• communicate with you about the recruitment process;
• monitor and improve our recruiting and hiring processes;
• verify whether you are legally entitled to work in the relevant jurisdiction;
• enter into contractual arrangements with you and administer your ongoing relationship with RHR;
• comply with our health and safety obligations;
• make adjustments to our recruitment processes;
• deal with any legal disputes;
• prevent fraud and detect and investigate activities that may be fraudulent or otherwise illegal or prohibited, including in connection with cybersecurity and physical security;
• ensure network and information security, including preventing unauthorized access to our computer and electronic communications systems and preventing malicious software distribution;
• carry out equal opportunities monitoring and to support inclusivity;
• comply with legal or regulatory requirements; and/or
• in connection with regulatory inquiries, audits, legal claims, subpoenas, warrants, or other government/judicial processes or requests.

We may process personal information in anonymized or pseudonymized form to improve our recruitment processes. When data cannot identify you, this Policy does not apply. Information that could be used to re-identify you remains personal information subject to this Policy.

We collect and process your personal information where necessary to take steps toward a potential employment relationship with you, to comply with legal obligations, for purposes connected to legal claims, or based on our legitimate interests in recruiting qualified candidates. When relying on legitimate interests, we balance our interests against potential impacts on your rights. You may contact us for more information on this balancing assessment. In specific circumstances, we may seek your consent.

RHR may process sensitive personal information such as demographic data if you provide us with that information and collection is permitted in your local jurisdiction. This data may be processed to ensure meaningful equal opportunity monitoring and reporting or to provide appropriate accommodations if needed during the recruiting process.

Where we carry out background checks, such checks may involve the processing of sensitive personal data, and we will only do so with your explicit consent or as permitted or required by law. Background checks may also involve the processing of criminal record data, which will only be processed where specifically authorized or required by law.

We may share personal information with our subsidiaries worldwide in connection with your application and in accordance with the conditions of this Policy.

We may disclose personal information to service providers such as auditors, IT providers, background check vendors, recruitment agencies, assessment providers, and references to support the recruitment process. These providers may access your personal information only as necessary to perform their functions.

We may also disclose personal information:

• to fraud prevention agencies and law enforcement agencies;
• to courts and governmental and non-governmental regulators;
• to organizations or other certifying bodies for the purposes of equal opportunities monitoring and to support inclusivity;
• to anyone expressly authorized by you to receive personal information about you
• to prospective or actual purchasers and their personnel in connection with a corporate transaction, reorganization, or financing, and to our investors to enable them to exercise oversight of our operations or to potential investors as part of purchase-related diligence; or
• as required or permitted by law, including to comply with a subpoena or similar legal process or government request, or when RHR believes in good faith that disclosure is legally required or otherwise necessary to operate and maintain the security of our business, services, property, employees, suppliers, clients, partners, or others.

RHR maintains procedural and technical safeguards designed to protect your personal information from loss, unauthorized access, disclosure, alteration, or destruction. These include access management technologies, security policies, training, and program reviews. We require third-party service providers to maintain reasonable security measures and use personal information only in accordance with our instructions and applicable law.

Personal information may be stored and processed in your region, the United States, or any country where RHR or its contractors maintain facilities. Because our HR function is centralized in the United States, recruitment data from all jurisdictions is transferred to and processed there. Your information may be processed in countries with different data protection standards than your home country.

For transfers out of the UK/European Economic Area, we use safeguards required by applicable law, such as transferring only to countries deemed adequate by the UK Information Commissioner or European Commission, or using approved standard contractual clauses. Contact us for more information about our transfer safeguards.

For Canadian applicants, we may transfer your personal information to affiliates or third parties in other countries, including the United States and United Kingdom. These countries have different privacy laws, and their governments, courts, or regulatory agencies may be able to access your information under foreign law.

RHR retains personal information for as long as necessary to fulfill collection purposes, comply with legal obligations, resolve disputes, and enforce agreements, and as required or otherwise permitted by law. Resumes and application materials may be retained longer to support future recruitment opportunities and comply with legal requirements. Where we do not delete information, we may anonymize or de-identify it.

Retention periods are based on: (i) the duration of the application process; (ii) any ongoing relationship with you; (iii) the nature and sensitivity of the information; (iv) legal obligations; and (v) our legal position regarding statutes of limitations, litigation, or regulatory matters.

If your application is unsuccessful and you do not object, we may retain your materials to consider you for future openings. If hired, information gathered during recruitment will be transferred to Human Resources and retained during your employment, subject to a separate privacy notice.

RHR strives to maintain accurate and current personal information. If your information changes, please update it. Where required by applicable law, you have the right to:

• access or obtain a copy of your personal information;
• correct the personal information we hold;
• require RHR to restrict, delete, or stop processing your personal information;
• request your personal information in a portable, commonly used format, or ask us to transfer it directly to another provider;
• object to the processing of your personal information where RHR is relying on its legitimate interest as the legal grounds for its processing;
• withdraw consent where consent is the legal basis for processing (withdrawal does not affect prior processing and may prevent us from continuing your recruitment);
• lodge a complaint with the data protection authority in your jurisdiction; and
• not be subject to automated decisions where the decision produces a legal effect or a similarly significant effect.

As a rule, RHR does not make use of solely automated decision-making when considering you for a position.

We may retain certain personal information as required by applicable law and may decline requests that would violate law or result in incorrect information. If we cannot fulfill a request, we will explain why, subject to legal or regulatory restrictions.

If you reside in the United Kingdom or the European Economic Area, we will endeavor to respond to all legitimate requests within one month. If your request is particularly complex or you have made a number of requests, it may take us longer, in which case we will notify you and keep you updated. If you wish to lodge a complaint with a data protection authority, further information is available here for EU residents and here for UK residents.

Additional Rights Applicable to Residents of California

The following describes how we collect, use, and disclose California residents' personal information, including in the previous 12 months:

We may collect, use, and disclose for our business and commercial purposes, the following categories of personal information as set forth in applicable California law: identification, professional or employment information, commercial information, Internet and other network activity information, audio and visual information, education information, inferences, and location information. We may collect categories of sensitive personal information as set forth in applicable California law, including racial or ethnic origin, citizenship or immigration status, or sexual orientation.

We do not "sell" or "share" your personal information, including sensitive personal information, for cross-context behavioral advertising under the California Consumer Privacy Act. We have not done so in the preceding 12 months and do not knowingly "sell" or "share" the personal information of individuals under the age of 16.

We use and disclose sensitive personal information collected in connection with the recruitment process for our recruitment purposes, for legal compliance purposes, for security purposes, and as otherwise permitted by applicable law.

The table that follows provides the categories of personal information we collect and process, along with the categories of third parties with whom such information is shared.

California residents have the right to know, access, correct, delete, and limit processing of their personal information, and to receive a portable copy. You will not be discriminated against for exercising these rights.

To submit a request to exercise these rights you may use one of these methods:

• Email: dataprotection@rhrinternational.com
• Phone: +1 (888) 355-3855

For all requests, clearly state you are exercising privacy rights, indicate the type of request, and provide your name, address, and contact information. We will verify your identity as required by law; verification steps vary based on the sensitivity of the information.

We cannot respond to certain requests if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

You may designate an authorized agent to submit requests on your behalf. We may require written proof of the agent's authority and may verify your identity directly. We may deny or partially fulfill requests based on our legal rights and obligations.

To appeal a decision regarding a consumer rights request, please submit your appeal using one of the two methods above. Your appeal should include an explanation of the reason you disagree with our decision.

We do not charge fees for consumer requests unless they are excessive, repetitive, or unfounded. If a fee applies, we will explain why and provide a cost estimate first.

RHR does not discriminate on protected grounds in recruitment. Where permitted by law, former offenders may apply regardless of historic convictions unrelated to the role.

As provided in this Policy, we may ask you for information in relation to sex/gender, race, nationality, ethnicity, religion, health, and sexual orientation. We use this data for equal opportunities monitoring.

RHR and its service providers use "cookies" and similar technologies on our websites. Please see our Cookies & Similar Technologies Policy and our Privacy Policy for more information.

RHR may use artificial intelligence ("AI") and automated tools to assist with recruitment, including AI features in LinkedIn's recruiting platform and tools like Google Gemini. These tools do not serve as the sole basis for hiring decisions, which are always subject to human oversight.

To exercise any rights you may have under applicable law in connection with RHR's use of AI or automated tools, please contact dataprotection@rhrinternational.com.

We may update this Policy as laws, regulations, or our business change. Changes will be posted here. If changes materially affect your privacy rights, we will provide additional notice as required by law.

If you have questions or concerns about this Policy, or wish to file a complaint, contact us:

Email: dataprotection@rhrinternational.com

Phone: +1 (888) 355-3855

Mail: Legal Department, RHR International LLP, 233 South Wacker Drive, 95th Floor Chicago, IL 60606