Candidate Privacy Notice

1. Introduction

This privacy notice applies to all employment candidates of Clearcourse Acquireco Finance Limited. (“we”, “us” or “our”) and its affiliated businesses in the United Kingdom, the European Economic Area (EEA) and Switzerland. It details what personal data ClearCourse processes about you, why it is processed, and the lawful basis relied upon. It also communicates the rights you have in relation to the data we process including a right to object to some of the processing which ClearCourse carries out. Regardless of which business you have applied to for employment, the central HR function will be managing your recruitment and as such, ClearCourse will be the controller of your personal data. This means ClearCourse will decide the means and purposes of the processing and will be responsible for adhering to the basic principles of the UK GDPR and facilitating your rights.

We may also provide you with additional information when we collect personal data, where we feel it would be helpful to provide relevant and timely information.

2. Personal data we process

We collect and use the following categories of personal data from and about our candidates.

• Personal identification and communication information: your name, home address, phone number, email address, date of birth, gender, immigration status, and information about your entitlement to work;

• Application related information: Curriculum Vitae (CV), cover letter, employment history, education history, qualifications and skills, reference contact information, position preferences, willingness to relocate, desired salary, work preferences, interests and aspirations, background screening information if relevant (including responses to screening questions), information relating to your recruitment such as job interview notes and assessment results and travel-related records, and bank account information if we re-imburse expenses; and

• Special category data: for example, information about your health and disabilities where we need to make any reasonable adjustments; and equal opportunities monitoring information, including information about your ethnic origin where permitted by applicable law. For candidates in Northern Ireland, we may also process the following additional information to comply with our obligations under the Fair Employment & Treatment (NI) Order 1998.

o Religion

o Sexual Orientation

• We may also seek information on your criminal record history in accordance with applicable laws.

We collect most of this information from you directly. For example, data is collected through our application portal and CVs; from correspondence with you; or through interviews, meetings or other assessments. We also collect some information about you from other people e.g., recruiters, referrals), your referees or organisations (e.g., job boards, various recruitment agencies and publicly available candidate profiles where applicable, we also collect data from our third-party background screening provider during the pre-employment screening process).

3. Why we collect, use and store this personal data

We have to have a legal basis to process your data. We explain each of these legal bases below. We also set out the purposes for which we process your data. For each purpose, we explain the lawful basis for that processing, the processing operations that we carry out and the categories of data that we process.

Legal basis

Consent – sometimes we ask for your consent to use your data.

Legitimate interest – we can process your data when this is necessary for us to achieve a business purpose, or where this is necessary for someone else to achieve their purpose. We explain below what interests we, or others, are trying to achieve when we process your data. Where we process personal data on the basis of a legitimate interest, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of the notice.

Legal obligation – we have obligations to comply with legal and regulatory requirements under applicable laws.

Purposes

We have set out below why we process your data and what data we use:

Processing your application – (legitimate interests)

We collect and use your personal data so we can process your application. We store, and where needed, update, your personal information to make informed decisions on recruitment and assess your suitability for the role, to communicate with you about your application, to respond to your inquiries and schedule interviews, and to reimburse you for any agreed expenses incurred in the application process.

To do this we use your personal identification and communication information. If we need to make adjustments for you during the recruitment process, we process special category data for this purpose.

This information will be shared with companies who host our recruitment portal and systems, as well as our affiliates if you are applying for a role within their business. If we re-imburse expenses, we share information with financial service providers.

Keeping in touch – (consent)

With your consent, we use your data to contact you about future career opportunities at ClearCourse. This includes storing your data and keeping it up to date and using it to contact you.

We use your personal identification and communication information and application-related information for this.

This information will be shared with companies who host our recruitment portal and systems.

Improving our recruitment process – (legitimate interests)

We have an interest in improving our recruitment processes. To achieve this, we analyse your data and compare it to past recruitment processes.

We use your personal identification and communication information and application-related information for this purpose.

This information will be shared with companies who host our recruitment portal and systems.

Verifying information – (legitimate interests, consent for criminal records checks)

We have an interest in carrying out appropriate checks to verify the information provided by candidates. We verify the details you have supplied and, where applicable, conduct pre-employment background checks.

We use your personal identification information and communication related information, and application related information for this. In the event that we carry out criminal records checks, unless these are required by law, we rely on your consent.

This information will be shared with our affiliates if you are applying for a role within their business, and with companies who host our recruitment portal and systems and with background screening companies. Wherewe check references or previous employment and education, we disclose the fact that you have applied to us to educational institutions and to previous employers or other referees you have named.

Business interests – (legitimate interests)

We have an interest in protecting our business interests and legal rights, including, use in connection with legal claims, compliance, regulatory, auditing, investigative and disciplinary purposes and ethics and compliance reporting requirements.

We also have an interest in analysing and monitoring the diversity of the workforce in accordance with applicable laws including, for example, compliance with equal opportunity employment laws.

To do this, we store, use and may transmit your personal identification and communication information, application-related information and sensitive information.

This information will be shared with companies who host our recruitment portal and systems. Information used for diversity monitoring will be shared with a specialist company that advises us on diversity. We share information with legal and other advisers if there are investigations or potential claims.

Compliance with law – (legal obligation)

We use your data to comply with legal, regulatory, and other requirements under applicable laws by analysing and possibly transmitting your personal information.

For candidates in Northern Ireland, we may also process the following additional information regarding your religion to comply with our obligations under the Fair Employment & Treatment (NI) Order 1998. In certain cases, we have to use your data to meet these obligations.

To do this we use your personal identification and communication information, and application-related information and special category data.

This information will be shared with companies who host our recruitment portal and systems. We share this information with our screening services provider as it will be necessary for us to verify the details you have supplied (for example, in relation to your identity, employment history, academic qualification and professional credentials) and to conduct pre-employment background checks (for example, in relation to previous criminal convictions or financial standing). The level of checks will depend on your role, in particular whether you will occupy a regulated role, and will be conducted at as late a stage as is practicable in the recruitment process and often only after you have been selected for the position. If your application is successful, we will provide further information about the checks involved and will obtain any necessary consent prior to completing such checks.

4. Sharing personal data

Personal data will primarily be processed by employees in our Human Resources, IT and finance, and facilities departments.

Your personal data will be shared with companies providing services, such as technology services including hosting, maintenance, insurance providers, external advisors (such as legal advisors, accountants, and auditors), employee benefits providers, administration, and analysis, as well as other agencies (e.g., SAP SuccessFactors), under contract to ClearCourse as part of the recruitment process. When we share your data with these companies, we have explained this according to each purpose under section 3 above.

Your personal data also will be shared with government authorities and/or law enforcement officials if mandated by law or if required for the protection of our legitimate interests in compliance with applicable laws. In the event that a ClearCourse business is sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchaser’s adviser and will be passed to the new owners of the business.

5. Retention

If your application for employment is successful and you commence employment with ClearCourse, your personal data will be maintained consistent with ClearCourse’s employee data retention policies.

If your application for employment is not successful and you have not provided consent to our keeping your information on file, we will keep your personal data beyond the end of the application process for a limited period specific to the country where the job is located (i) to meet recordkeeping requirements, and (ii) for potential use in legal proceedings. We will keep assessment data and master candidate data for a period of up to three years to avoid unreasonable duplications of recruiting efforts.

If your application for employment is not successful and you have provided consent to our keeping your information on file, we will keep your data for up to two years for the purpose of considering and contacting you for future job opportunities.

6. Overseas data transfers

On some occasions, for example, when we or one of our service providers have employees or operate equipment in other countries, we will transfer your personal data to countries outside the country/region where you work and outside the EEA. For all such transfers, we provide appropriate safeguards through valid international transfer mechanisms, including Standard Contractual Clauses or International Data Transfer Agreements as approved under applicable data protection laws. You may request a copy of these safeguards by using the contact details below.

7. Your rights

You have several rights that can be exercised

• The Right to be informed (what data is being collected and why) [Article 13 & 14]

• The Right of access (you may see the data being processed and request a copy) [Article 15]

• The Right to rectification (you may request your data be changed if it is otherwise incorrect) [Article 16]

• The Right to erasure (in certain circumstances, you may request some of your personal data be erased [Article 17]

• The Right to restrict processing (you may request that processing is restricted if data is inaccurate, unlawful, or no longer necessary) [Article 18]

• The Right to data portability (you may request that your data is transferred to another data controller where the processing requires consent or given as part of a contract and is wholly automated and where technically feasible) [Article 20]

• The Right to object (you may object to processing if there are no longer legitimate grounds) [Article 21]

If you make a request of us (in our role as a controller), we will normally have one month to respond to you. If we need something from you to be able to deal with your request (e.g., an ID document, or to clarify the request), the time limit will begin once we have received this. This time limit may also be extended in certain circumstances so, if there is any reason our response to you might take longer than a month, we will let you know.Where you have provided us with consent to use your data, you may withdraw this consent at any time. We will make this clear when requesting your consent and explain how you go about withdrawing consent if you wish to do so.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. These exemptions may be set out in the GDPR or in local law.

If you have unresolved concerns, you have the right to complain to a data protection authority. In the UK, this will be the Information Commissioner.

Where we collect personal data to administer a contract with you or to comply with our legal obligations, this is mandatory and we will not be able to manage the application/employment relationship without this information. In all other cases, provision of the requested personal data is optional, but this may affect your ability to participate in certain programs or systems, where the information is needed for those purposes.

8. Updates to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

9. Contact us

The data controller for your personal data will be Clearcourse Acquireco Finance Limited. If you have questions about this privacy notice or wish to contact us for any reason in relation to our personal data processing, please contact our DPO by:

• Email: DPO@clearcourse.co.uk

• Telephone: 020 717 30500

• Post: ClearCourse, 107 Cheapside, London EC2V 6DN

EU Data Protection Representative

There are circumstances where the EU GDPR requires us to have an EU Representative to act as a point of contact to: facilitate the exercise of data subjects’ rights within the EEA; and co-operate with the competent supervisory authorities in respect of any action, investigation or claim under the EU GDPR.

To that end, we have appointed an EU Representative, which is Portrilio Solutions, part of Trillium Limited, which is a member of the ClearCourse group of companies. If you wish to contact them (instead of our DPO directly) they can be contacted as follows:

• Email: euprivacy@clearcoursellp.com

• Telephone: +351 21 122 6881

• Post: Portrilio Solutions, Rua Julio Dinis, Centro Empresarial Sala 402, n561, 4 4050-460 Porto, Portugal