PRIVACY POLICY – RECRUITMENT

When applying for a position within any of the entities in the Stillfront Group (“Stillfront”, “we” or “us”) you have been required to submit information relating to you. In order for Stillfront to be able to process your application, we need to process certain personal data relating to you. Failure to provide such data can entail in that your application cannot be processed. Stillfront is committed to safeguarding your privacy. This privacy policy will inform you about the processing we undertake with your personal data in connection with your application. The controller of your personal data will be Stillfront Group AB (publ) registration no. 556721-3078, address Kungsgatan 38, 111 35 Stockholm.

Throughout this privacy policy the terms "controller", "processor" "processing" and "personal data" shall have the same meaning as in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR").

"Candidate" means you as an individual who has applied for a position with Stillfront.

"Reference person" means you as an individual who has been named as a reference by a Candidate in connection with the recruitment process.

FROM WHOM DO WE RECEIVE YOUR PERSONAL DATA

If you choose to apply for a position within Stillfront on our career page, we will collect your personal data directly from you when you submit your application. We may also collect further information from and about you if we chose to conduct interviews and tests with you as part of the recruitment process.

We will collect information from the relevant Stillfront Group company if you have consented for processing in connection with future recruitment processes.

We will also collect personal data from other sources as appropriate for the position such as social networks, e.g. LinkedIn.

If you are a Reference person we will collect your personal data directly from you but also from the Candidate that has named you as reference in their job application.

WHEN AND WHY DO WE PROCESS YOUR PERSONAL DATA

Handle the recruitment process

We will process your personal data to handle the recruitment process, for example to collect and review documents relating to your application (such as your CV and cover letter), to evaluate the application, making reference checks and to communicate during the recruitment process.

Categories of Personal data

Legal basis

• Name

• Contact details

• Photo

• Date of birth

Contract. The processing is necessary in order to take steps at your request prior to entering into a potential employment contract with you.

• Experience description

• Education description

• CV

• Work certificate(s)

• Feedback data from Reference person • Other information from connected LinkedIn page and cover letter

Legitimate interest. To the extent you have not requested a specific action the processing is necessary in order fulfil our legitimate interest to handle the recruitment process.

The processing of personal number will only be made if necessary for a secure identification or similar circumstances.

We will only process special categories of data, for example health data and information on trade union membership, if you freely have submitted such data to us and if you have given your consent.

Retention period: Personal data processed for this purpose is retained during the recruitment process and for a period up to 12 months thereafter to fulfil our legitimate interest to establish, exercise and defend any legal claims.

Future recruitment and talent pool

If you give your consent, we will save your application documents to evaluate you for other positions within Stillfront which may become vacant within the relevant period set out below. It is optional to give your consent to this processing, it will not affect your chances in the initial recruitment process and you may at any time withdraw such consent.

Categories of Personal data

Legal basis

• Name

• Contact details

• Photo

• Location data

• Personal number

• Experience description

• Education description

• CV

• Personal letter

• Work certificate(s)

• Feedback data from Reference person • Other information from connected LinkedIn page, social media page and cover letter

Consent. The processing is based on your given consent.

The processing of personal number will only be made if necessary for a secure identification or similar circumstances.

We will only process special categories of data, for example health data and information on trade union membership, if you freely have submitted such data to us and if you have given your consent.

Retention period: Personal data is retained during a period of 12 months from the time of the recruitment process for the position you have applied for has ended. Provided that you give your consent in each case, personal data will be retained for additional 12 months' periods.

Conduct reference checks

We will process your personal data while conducting reference checks in connection with the

recruitment process, for example in order to receive feedback on you as a candidate and evaluate you for the applied position.

Reference person

Categories of Personal data

Legal basis

• Name

• Contact details

• Position/title

• Feedback data

• Other information of relevance for the purpose

Legitimate interest. The processing is necessary in order to fulfil our legitimate interest in contacting you and to collect feedback from you regarding the Candidate as part of the recruitment process.

Retention period: Personal data processed for this purpose is retained during the recruitment process and for a period up to 12 months thereafter to fulfil our legitimate interest to establish, exercise and defend any legal claims.

Carry out background checks

As part of the recruitment process we may, depending on the position you have applied for, perform background checks on you in order to further evaluate and validate your application. Such background checks may include credit reports and public social media checks etc.

Candidate

Categories of Personal data

Legal basis

• Name

• Personal number

• Educational/professional background • Financial data (such as credit reports) • Other information of relevance in public social media profiles

Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to further evaluate and validate your application.

The processing of personal number is necessary with regard to the purpose of the processing.

Personal data relating to credit reports and public social media profiles will only be processed when necessary due to the hiring for a position with a certain financial responsibility within Stillfront.

Retention period: Personal data processed for this purpose is retained during the recruitment process and for a period up to 12 months thereafter to fulfil our legitimate interest to establish, exercise and defend any legal claims.

Conduct personality and ability tests

Depending on the position you have applied for we may conduct personality and ability tests as part of the recruitment process. If such tests are relevant for your applied position we will, before conducting the tests, ask for your consent.

Candidate

Categories of Personal data

Legal basis

• Name

• Personal number

• Test data

Consent. The processing is based on your given consent.

The processing of personal number is necessary with regard to the purpose of the processing.

Retention period: Personal data processed for this purpose is retained during the recruitment process and for a period up to 12 months thereafter to fulfil our legitimate interest to establish, exercise and defend any legal claims.

Evaluate recruitment process and follow-ups

We process Personal data to evaluate and follow-up the recruitment process, for example in order to create reports and statistics of the number of applications per position.

Candidate

Categories of Personal data

Legal basis

• Name

• Contact details

• Photo

• Location data

• Personal number

• Experience description

• Education description

• CV

• Feedback data from Reference person • Other information from connected LinkedIn page and cover letter

Legitimate interest. The processing is necessary to fulfil our legitimate interest in following up and evaluating the recruitment process.

Retention period: Reports and statistics on aggregated level which do not contain personal data will be saved until further notice.

Reference person

Categories of Personal data

Legal basis

• Name

• Contact details

• Position/title

• Feedback data

• Other information of relevance for the purpose

Legitimate interest. The processing is necessary to fulfil our legitimate interest to follow up and evaluate the recruitment process.

Retention period: Reports and statistics on aggregated level that do not contain personal data will be saved until further notice.

Establish, exercise and defend legal claims

For the purpose of establish, exercise and defend legal claims (for example in connection with a dispute or legal process) we will process your personal data.

Candidate and Reference person

Categories of Personal data

Legal basis

All data collected that is necessary to establish, exercise or defend the legal claim.

Legitimate interest. The processing is necessary in order to fulfil our legitimate interest to establish, exercise or defend the legal claim, for example in connection with a dispute or legal process.

The processing of personal number will only be made if necessary for a secure identification or similar circumstances.

We will only process special categories of data, for example health data and information on trade union membership, to fulfil our legitimate interest to establish, exercise or defend legal claims.

Retention period: Your personal data is retained for the period required in order for us to establish, exercise or defend the legal claim.

Fulfil legal obligations

We will process your personal data to fulfil legal obligations which apply to Stillfront. Candidate and Reference person

Categories of Personal data

Legal basis

All data collected that is necessary to fulfil each legal obligation.

Legal obligation. The processing is necessary in order to fulfil Stillfront's legal obligations, for example within the area of book-keeping and taxation.

Retention period: Personal data is retained for the period as necessary to fulfil the legal obligations which apply to Stillfront.

WHOM DO WE SHARE YOUR DATA WITH

Stillfront will, if necessary, transfer your personal data to external parties such as vendors and service providers which process personal data under the instructions of Stillfront such as:

Recipient

Purpose of transfer

Legal basis

Recruitment agencies

To administer and handle the recruitment process

The processing is

necessary in order to

take steps at your

request prior to entering into a potential

employment contract with you.

Our legitimate interest to internally administer and handle the

recruitment process.

IT-service providers

To administer and handle the recruitment process

Our legitimate interest to internally administer and handle the

recruitment process.

Courts and outside counsels

In order to exercise,

establish or defend legal claims

Our legitimate interest in having disputes settled by competent courts

External auditors

To fulfil legal obligations (such as accounting and auditing obligations)

To fulfil legal obligations

Authorities

To fulfil legal obligations (for example due to

requests from competent authorities)

To fulfil legal obligations

Group companies of the Stillfront Group

To administer and handle the recruitment process

Our legitimate interest to internally administer, evaluate and handle the recruitment process

Group companies of the Stillfront Group

To share candidate

information for possible future recruitment within Stillfront.

Consent for the purposes of future recruitment

processes

Trade unions

To fulfil legal obligations within the field of

employment, e.g.

consultation obligations

To fulfil legal obligations within the field of

employment

Appropriate safeguards for transfers outside the EU/EEA-area

Where a disclosure as mentioned above entails transfers of personal data outside the EU/EEA, Stillfront will ensure that the EU Commission's standard contractual clauses have been entered into between the transferring Stillfront entity and the receiving external party. Alternatively, other safeguards will be put in place prior to such transfers such as an active EU-commission

adequacy decision.

You are entitled to receive a copy of any documentation demonstrating that appropriate safeguards have been taken in order to protect your personal data during a transfer outside the EU/EEA.

If you would like to know more about the processing of your personal data and whether your personal data is transferred outside the EU/EEA, please contact us on the contact details as set out below.

WHAT ARE YOUR RIGHTS

Under the GDPR you may be entitled to:

(i) Access

You may request confirmation whether your personal data is processed and if that is the case have access to your personal data and additional information such as the purposes of the processing. You are also entitled to receive a copy of the personal data undergoing processing. If the request is made by electronic means the information will be provided in a commonly used electronic format if you do not request otherwise.

(ii) Rectification

Stillfront will take steps to keep your personal data accurate, complete and up-to-date. If you identify that any personal data related to you is inadequate, incomplete or incorrect, you are entitled to have the personal data corrected.

(iii) Object to certain processing

You may object to the processing of your personal data processed on the basis of a legitimate interest, on grounds relating to your particular situation and to processing for direct marketing purposes.

(iv) Erasure

You may have your personal data erased under certain circumstances such as when your personal data it is no longer needed for the purposes for which it was collected.

(v) Restriction of processing

Under certain circumstances, you may ask us to restrict the processing of your personal data to only comprise storage, if you do not want your personal data erased.

(vi) Withdrawal of consent

You have the right to at any time withdraw your consent to processing of personal data to the extent the processing is based on your consent, for example if your personal data is kept for the purpose of evaluating you for other open positions.

(vii) Data portability

As regards personal data that you have provided to Stillfront, you may ask to receive a machine-readable copy of the data, in so far the data is processed on the basis of your consent or on the basis that the processing is necessary in order to perform an agreement with you. You also have the right to ask for such data to be transferred to another controller (where possible).

Complaints to the supervisory authority

You acknowledge that you always have the right to lodge complaints pertaining to the processing of your personal data to the competent data protection authority.

Data collected from recommendations

If you refer a friend for a vacant job position in Stillfront, it is your responsibility to make sure that the person you refer has given the consent to be referred and his/her data submitted.

SECURITY

We will ensure that the access to your data is accurately secured by applying appropriate safeguards, depending on the circumstances taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk.

In support of this commitment, we have implemented appropriate technical, physical and organizational measures to protect your personal data against unauthorized or accidental destruction, alteration or disclosure and misuse, damage, theft or accidental loss or unauthorized access.

CONTACT INFORMATION

If you have any questions or concerns regarding the processing of your personal data or if you wish to exercise any of your rights as set out below, please contact Stillfront on the contact details set forth below.

Stillfront Group AB (publ)

Kungsgatan 38,

111 35 Stockholm

[email protected]

The data protection officer of the Controller for the purposes of the GDPR is:

Name: Peter Birgersson

Contact details: [email protected]

OTHER NOTICES

We reserve the right to update this privacy policy, if necessary, for example to comply with legislative changes, regulatory changes, new practices and procedures, or requirements imposed by any authority. The revisions will apply from the date of their publication or via the position page on the website. The date on which this text was last changed can be found in the header of the document.