GLOBAL EMPLOYMENT CANDIDATE PRIVACY NOTICE

INTRODUCTION

As part of our recruitment process, we collect and process personal data relating to employment  candidates. We are dedicated to meeting our data protection obligations and are committed to  being transparent with you about how we collect, use, disclose and retain your personal data. We  know that confidentiality is important to you, and we safeguard the data that we collect as part of  the recruitment process. The Global Employment Candidate Privacy Notice (“Notice”) applies to all employment  candidates of Polycor Inc. and each of its subsidiaries (“Polycor”). The purpose of the Notice is  to inform employment candidates how their personal information is processed, including how it is  collected, used, disclosed and retained, and to advise them of their privacy rights. Employment  candidates should be aware that data protection and privacy laws vary between the jurisdictions  in which Polycor operates.

UPDATES TO THIS POLICY

Polycor may change this Notice at any time. Please take a look at the “Date Updated” at the top  of this page to see when this Notice was last revised and in effect.

PRIVACY NOTICE

1. USEFUL INFORMATION

We have appointed a person in charge of the protection of Personal Information, also  commonly known as a Privacy Officer or Data Protection Officer. This individual ensures that  we are clear and fair about how we use your personal information and comply with privacy laws  in all jurisdictions in which we operate. You can contact our Privacy and Data Protection Officer  at: 

Privacy and Data Protection Officer 
Polycor Inc.
100-76, rue Saint-Paul, 
Québec (Québec) G1K 3V9
privacy@polycor.com 

This is a global Notice, when we say “we”, “our”, or “us” we are referring to the specific Polycor  legal entity with which you are seeking employment. 

By personal information (also called personal data), we mean any information that relates to  an identifiable individual, like your name, address, employment details, or a combination of  information. In certain jurisdictions, privacy rights extend posthumously. 

If you are a resident of the European Economic Area (the “EEA”), the data controller of your  personal information is the Polycor legal entity with which you interact as a candidate for  employment. This means that they decide why, how and where your personal information is  processed.

Processing your personal information means anything we do with it – collecting it, using it, storing  it, sharing it, and deleting it. 

2. THE PERSONAL INFORMATION WE COLLECT

Personal information marked with an asterisk (*) may be considered special category information  (in the EEA) or sensitive information. We may collect the following categories of personal  information about you:

• Contact information, like your name, physical address, e-mail address, telephone  number and preferred language. 

• Identification, like a driver’s license*, passport* or other form of government ID*. 

• Your likeness, like a camera image or video if you are in an area monitored by CCTV or a meeting that is being recorded, or voice recordings if we record a call in which you are participating. 

• Resume (CV) and interview information, like details of your qualifications, skills,  experience and employment history. 

• Pay and benefit information, like your expected level of remuneration, including benefit  entitlements. 

• Accommodations information, like whether or not you have a disability* for which the  organization needs to make reasonable adjustments during the recruitment process. 

• Entitlement information like your entitlement to work in the jurisdiction in which you are  applying, and whether you have a criminal record*. 

• Employment equity and diversity information only as permitted by law, like data about  your ethnic origin*, sexual orientation* and religion* or beliefs*. 

• Other information that you provide to us through any channel.

Where the personal information we ask you to provide is mandatory, we will inform you of this at  or prior to collection. The failure to provide mandatory information will mean that we cannot  perform necessary Human Resource functions that may affect your employment with us. 

If you submit any personal information relating to anyone other than yourself, you represent that  you have obtained any necessary consent from that individual for the use and disclosure of that  individual’s personal information as described in this Notice. 

Polycor does not intentionally collect or process the personal information of minors. Please do  not submit an application of employment if you are under 16 years of age.

3. HOW WE COLLECT YOUR PERSONAL INFORMATION 

We may collect your personal information in a number of ways: 

• Directly from you or through other people who know about you, such as your personal  references.

• From third parties or service providers like recruitment firms or companies who provide  criminal record checks.

 • From publicly available or online sources where you have chosen to share your data  subject to their privacy policy, like LinkedIn, CV (resume) databases or other platforms.

4. HOW WE USE PERSONAL INFORMATION 

If you live in the EEA, the use of personal data must be justified under one of a number of legal  bases. The principal legal bases that justify our use of your personal data are: 

• Consent – You have given consent to the processing of your Personal Information for one  or more specific purposes. 

• Performance of a Contract – Processing is necessary for the performance of a contract  with you. 

• Legal Obligation – Processing is necessary for compliance with a legal obligation to  which Polycor is subject. 

• To Protect a Vital Interest – Processing is necessary in order to protect the vital interests  of you or of another person. 

• For the Public interest – Processing is necessary for the performance of a task carried  out in the public interest or in the exercise of official authority. 

• Legitimate Interests of Polycor or a Third Party – Processing is necessary for the  purposes of the legitimate interests of Polycor or by a third party except where these  interests are overridden by your interests or fundamental rights and freedoms. 

Generally, Polycor relies on legitimate interests for the processing of your Personal  Information for employment candidacy. Where we rely on your consent, we will inform you at  the time of collection. 

Regardless of where you live, we may use your information for the following purposes: 

• To communicate with you about your employment application in your preferred  language. 

• To complete the recruitment process by processing information collected as part of the  recruitment process, we are able to assess and confirm your suitability for employment.  We need to process data prior to and during the recruitment process until an offer has  been presented and accepted. For some roles, we obtain data about criminal convictions  and offenses to carry out our obligations and exercise specific rights in relation to  employment. This may occur at any time during the process, but only if we intend to or  have extended an offer of employment.  

• To provide recruitment accommodations if you provide information to us about a  disability or other personal circumstance, to allow us to make reasonable adjustments or  accommodations. 

• For employment equity purposes, we may process special categories of data, such as  data about ethnic origin, sexual orientation or religion or beliefs, to monitor recruitment statistics. We process such data to carry out our obligations and exercise specific rights  in relation to employment. 

• To address claims, issues or concerns and defend against legal claims, pursue  available remedies or to limit the damages that we may sustain. 

• To comply with our legal obligations, for example, to check a successful applicant’s  eligibility to work in the jurisdiction before employment starts.

5. HOW YOUR PERSONAL INFORMATION IS DISCLOSED 

Your personal information may be disclosed by Polycor: 

• To employees and contractors of Polycor. Access will be limited to those who have a  need to access your personal information to perform their role, such as: 

▪ Human Resources employees and contractors who manage the recruitment process  and workforce management. 

▪ Hiring managers and interviewers who are involved in the recruitment process. ▪ Information technology employees and contractors who manages recruitment  systems. 

▪ Other employees or contractors who may have a legitimate need to review your  personal data to perform their duties. 

• To third party service providers to process personal information on our behalf. We only  use service providers who limit their processing to the purpose described in the agreement  and implement appropriate technical and organizational measures to meet the privacy  requirements of the jurisdiction in which they are providing the service, and our  requirements. These may include:  

▪ Recruitment firms to help us find and assess employment candidates. ▪ Background check firms to assess the appropriateness of your employment with us,  depending on the role for which you have applied. 

▪ References and former employers if your application for employment is successful and  we make you an offer of employment, to provide a reference for you. 

▪ Information technology providers to allow you access to and manage platforms we use  as part of the recruitment process. 

• To comply with legal or regulatory obligations, as we believe to be necessary or  appropriate under applicable law, including laws outside your country of residence to  comply with legal process. 

6. SAFEGUARDING YOUR PERSONAL INFORMATION 

We seek to use reasonable organizational, technical and administrative measures all designed to  protect personal information under our control. For example, we seek to use Secure Sockets  Layer (“SSL”) technology for the placement of orders. Unfortunately, no data storage system or  data transmission over the Internet can be guaranteed to be 100% secure. We may use third party cloud service providers that provide hosting, data storage and other services pursuant to  standard terms and conditions that may be non-negotiable. These service providers have  informed us or have publicly confirmed that they apply security measures they consider adequate  for the protection of information within their system, or they have a general reputation for applying  such measures.

7. CROSS BORDER TRANSFERS OF YOUR PERSONAL INFORMATION 

As an international company, we cannot limit our processing of your personal information to the  country where you are based. Your personal information may be transferred outside of the country  where you were a candidate for employment and may be subject to the laws governing privacy in  those countries. Polycor will only transfer your personal information outside of the jurisdiction  where you were a candidate for employment if we are confident that the same data protection  safeguards that we deploy will be put in place, for example we may take contractual or other  measures to ensure that your personal information is protected in accordance with applicable  privacy laws.

8. RETENTION OF YOUR PERSONAL INFORMATION 

Unless a longer retention period is required by law, we will keep your personal information for as  long as we need in order to fulfill the purposes outlined in this Notice. When we have no ongoing  legitimate business need (or legal basis for processing in the EEA) to process your personal  information, we will either delete or anonymize it in accordance with our retention processes  wherever possible. 

We keep your personal information while you’re going through the recruitment process so we can  manage your application. If you’re offered a job, we’ll keep your personal information as part of  your employment record and you will receive a copy of the Global Employee Privacy Notice to tell  you how we’ll use and retain your personal information as an employee. 

We keep some of your information even if you don’t get a job with us. Sometimes we keep it to  comply with a legal obligation. Often, we have legitimate reasons for keeping your personal data  such as being able to review your recruitment history with us, consider you for future opportunities,  respond to questions or even defend against claims.  If you live in the EEA and your application for employment is unsuccessful, if you do not object to  the retention of your personal information, the information will be automatically deleted or  destroyed no longer than two years after the last contact with you, except where you expressly  consent to a longer retention period.

9. YOUR PRIVACY RIGHTS AS AN EMPLOYEE CANDIDATE 

At Polycor, we respect privacy rights. Individual privacy rights vary based on where you are  located, therefore the extension of the rights explained in this section will depend on the nature  of the personal information processing activity and the jurisdiction in which the processing takes  place. If you contact us to exercise any of these privacy rights, we may ask for identification and check your entitlement.

• The right to be informed about how Polycor uses your personal information, including  the existence of automated decision making and profiling. 

• The right to access a copy of the personal information that Polycor holds about you. 

• The right to rectification, to ask Polycor to correct any inaccuracies or incompleteness  in the personal information being held. We may also seek to verify the information before  rectifying it. 

• The right to withdraw consent for certain uses of your personal information, subject to  legal and contractual requirements. In some cases, your withdrawal of consent may mean  that we will no longer be able to continue our relationship with you, for example, we require your e-mail address to contact you. We will inform you of the likely consequences of your  withdrawal of consent. 

• The right to be informed of a decision based solely on automated processing (Quebec) and to not be subject to such a decision (EEA). 

• The right to deletion of personal information held about you, in certain circumstances. Where you have access, you can delete your personal information from the relevant  systems (although it may remain in back-ups and linked systems until it is deleted in  accordance with our retention procedures). You can contact us to request the deletion of  certain personal information (see Section 10 – Challenging Compliance and Exercising  Your Privacy Rights). 

• The right to request the transfer of certain pieces of your personal information to another  organization in a common electronic format. Also known as the right to portability. 

• The right to make a complaint to a regulatory authority or challenge Polycor’s  compliance with privacy laws (see Section 10 – Challenging Compliance and Exercising  Your Privacy Rights). 

• The right to restrict processing of your personal information in scenarios where you  require us to retain the data but not use it, and the right to object to processing of  personal information, in certain circumstances, such as where we have used legitimate  interest as a legal basis for processing (EEA only).

We do not sell your personal information. We do not make employment decisions based on  automated decision making or profiling. 

We do our best to respond within a month, however it may take us longer if your request is  complex. We may ask you for clarification about your request to speed up our response and to  make sure that we meet your needs. If we suspect our response to take more than a month, we  will let you know. We do not discriminate against individuals who exercise their privacy rights. 

In some instances, we may be permitted to refuse compliance with your request. For example,  where the data relates to another individual, where an access exception applies, like legal  privilege, where we cannot delete your personal information for legal reasons or other permitted  exceptions. If we refuse your request, we will inform you of the reason, and you can challenge  our refusal.

10. CHALLENGING COMPLIANCE AND EXERCISING YOUR PRIVACY RIGHTS 

You can make a request to exercise your privacy rights, as any questions about this Notice or  challenge our compliance with applicable privacy laws by contacting the person in charge of the  protection of personal information at:

Privacy and Data Protection Officer 
Polycor Inc.
100-76, rue Saint-Paul, 
Québec (Québec) G1K 3V9
privacy@polycor.com