1 INTRODUCTION

1.1 The purpose of this group-wide recruitment privacy notice (hereinafter the “Notice”) is to provide information on how the relevant Frankenburg Group Company (as defined below in Section 1.2) processes your personal data in connection with the recruitment process.

1.2 For the purposes of this Notice, a “Group Company” means any of the following legal entities:

1.2.1 Frankenburg Technologies OÜ, a company established and operating under the laws of Estonia, having its registered office at Sepise 7, 11415, Estonia, registry code 16901751 (hereinafter “Frankenburg Estonia”);

1.2.2 Frankenburg Technologies SIA, a company established and operating under the laws of Latvia, having its registered office at Jēkabpils iela 10, Rīga, LV-1003, Latvia, registration number 40203595640 (hereinafter “Frankenburg Latvia”);

1.2.3 Frankenburg Technologies UAB, a company established and operating under the laws of Lithuania, having its registered office at Vilniaus g.33, Vilnius LT-01402, Lithuania, registration number 307088326 (hereinafter “Frankenburg Lithuania”);

1.2.4 Frankenburg Technologies GmbH, a company established and operating under the laws of Germany, having its registered office at Cosimastr. 121, Müncen, 81925, Germany, registration number HRB 308287 (hereinafter “Frankenburg Germany”);

1.2.5 Frankenburg Technologies Sp.z.o.o, a company established and operating under the laws of Poland, having its registered office at Zabrska 17, Katowice, 40-083, Poland, company number 16350270 (hereinafter “Frankenburg Poland”);

1.2.6 Frankenburg Technologies ApS, a company established and operating under the laws of Denmark, having its registered office at Pilestræde 58, 6., København, 1112, Denmark, company number 45515842 (hereinafter “Frankenburg Denmark”);

1.2.7 Frankenburg Technologies Ltd, a company established and operating under the laws of England and Wales, having its registered office at 1 Bow Churchyard, London, United Kingdom, EC4M 9DQ, company number 16350270 (hereinafter “Frankenburg UK”).

1.3 This Notice applies to the Group Companies, which form part of the of the Frankenburg group. The Group Companies operate under a matrix organisational structure. As a result, more than one Group Company may be involved in the recruitment process and may process your personal data where necessary to support the assessment of your application, for example for recruitment, HR, or managerial purposes. For recruitment-related processing, the Group Company responsible for the relevant recruitment process acts as the data controller for the processing of your personal data.

1.4 The processing of your personal data is carried out in accordance with applicable data protection legislation. This includes the General Data Protection Regulation (EU) 2016/679 (“GDPR”), and other data protection legislation governing the processing of personal data in the jurisdictions in which the relevant Group Company is established or in which the processing takes place, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 for Frankenburg UK.

1.5 If you have any questions about the processing of your personal data, please contact the data protection officer of the Group Companies by e-mail at privacy@frankenburg.tech.

2 CATEGORIES AND SOURCES OF PERSONAL DATA

2.1 Personal data is any information that can be used to directly or indirectly uniquely identify you as a private individual. The Group Companies process the following categories of personal data, including its collection, use, storage, and transmission:

2.1.1 Basic Data: given name and surname, personal address, personal e-mail address, personal (mobile) phone number, personal identification code, area of specialisation ("Basic Data");

2.1.2 Recruitment Data: data submitted when applying for a job, including personal photo, data on experience, education, qualifications, employment history, language skills and other skills, certificates and training, transcript of study results, CV, motivation letter or cover letter and/or introductory video, video recordings submitted by the candidate (such as video CVs or video responses to application questions), responses to application questions, homework results, data collected during job interviews, including salary expectations, preferred work location, information from LinkedIn profiles, data received from references, other data obtained during the recruitment process, including data publicly from available sources and registers, the result of the recruitment process ("Recruitment Data");

2.1.3 Reference Data: given name and surname, position, e-mail address, phone number, LinkedIn profile, relationship with the candidate ("Reference Data");

2.1.4 General Background Check Data: for candidates outside Estonia and Latvia, who have reached an advanced stage of the recruitment process, data obtained through background screening services, including given name and surname, position, date of birth, personal address, personal e-mail address, personal (mobile) phone number, gender, country of birth, birth certificate number, town of birth, nationality, driving licence details, national insurance number, overseas identification code, personal identity document details, personal photo, criminal record screening outcome, global fraud and sanctions screening outcome, and, for senior executive positions, social media and adverse internet screening results (“Background Check Data”);

2.1.5 EE Background Check Data: for candidates in Estonia, who have reached an advanced stage of the recruitment process, given name and surname, criminal record screening outcome (“EE Background Check Data”);

2.1.6 LV Background Check Data: for candidates in Latvia, who have reached an advanced stage of the recruitment process, given name and surname, position, date of birth, personal identification code, CV (“LV Background Check Data”).

2.2 The relevant Group Company may receive your personal data: (i) directly from you if you disclose it to the Group Companies; (ii) from your references; (iii) from publicly available sources (including professional social networking platforms and public registers, where applicable); (iv) from public registers, databases or other third-party sources accessed through background screening service providers acting on behalf of the relevant Group Company; and (v) from public authorities conducting background checks required under applicable law.

2.3.The processing of the above personal data is necessary in order to carry out the recruitment process, which is why if you do not provide the personal data required for these purposes, the relevant Group Company may not be able to carry out the recruitment process or perform other related tasks.

3 PURPOSES AND LEGAL BASES FOR PROCESSING PERSONAL DATA

3.1. The Group Companies process your personal data for the following purposes and on the following legal grounds:

3.1.1 Consent

Your consent is required for the processing of personal data for the purposes outlined below. You have the right to withdraw your consent at any time by contacting the data protection officer of the Group Companies using the contact details provided in Section 1 of this Notice.

Purpose of processing:

Storing data on unrecruited candidates for the purpose of sending new job offers or invitations to apply, including sharing such data with other Group Companies

Categories of personal data: Basic Data, CV

3.1.2 Performance of the contract

The processing of personal data is necessary in order to take steps at your request prior to entering into an employment or other contractual relationship.

Purpose of processing: Taking pre-contractual measures to conclude an employment or other type of contract in the final stage of the recruitment process, including conducting pre-contractual negotiations and concluding the contract
Categories of personal data: Basic Data, Recruitment Data

3.1.3 Compliance with a legal obligation

The Group Companies process your personal data in order to comply with a legal obligation, where such an obligation arises from a law or other legal act.

Purpose of processing: Compliance with requirements and obligations arising from legislation and responding to inquiries from public sector, law enforcement and supervisory authorities
Categories of personal data: All data categories

Purpose of processing: Background check of Estonian candidates' criminal record through the Estonian Police and Border Guard Board (PPA), including forwarding candidate data to PPA in encrypted form and, where the candidate has resided abroad, forwarding the candidate's certificate of no criminal convictions to PPA

Categories of personal data: EE Background Check Data

Purpose of processing: Background check of Latvian candidates' criminal record through the Latvian Ministry of Defence, including forwarding candidate data to the Latvian Ministry of Defence

Categories of personal data: LV Background Check Data

3.1.4 Vital interests

The Group Companies process your personal data in order to protect the vital interests of you or of another natural person.

Purpose of processing:

Processing personal data (including disclosing it to relevant health authorities and/or healthcare providers) to protect your vital interests, for example in the event of a medical emergency

Categories of personal data: Relevant data categories, depending on the nature of the matter and to the extent necessary for the specific purpose

3.1.5 Legitimate interests

For these purposes, the Group Companies process your personal data based on legitimate interests. You have the right to request an explanation regarding the processing of your personal data based on legitimate interests by sending a request using the contact details provided in Section 1 of this Notice. You also have the right to object if you believe that the processing of your personal data for the purposes outlined below affects your rights.

Purpose of processing:

Identification of the candidate, including the collection of data through publicly available sources and/or references

Categories of personal data: Basic Data, Reference Data

Purpose of processing: Conducting background checks in accordance with applicable law, namely (i) identity verification; (ii) credit check; and (iii) criminal record and fraud check through a third-party background screening service provider. For senior executive positions, conducting background checks may additionally include social media and adverse internet screening. The legitimate interest of the relevant Group Company in conducting background checks is to verify the accuracy of information provided by candidates, to assess their suitability for the relevant position, and to protect the relevant Group Company from potential risks, including fraud, financial misconduct or reputational harm.

Categories of personal data: Background Check Data

Purpose of processing: Conducting the recruitment process, including collecting data through submitted applications, conducting interviews

Categories of personal data: Basic Data, Recruitment Data

Purpose of processing: Collecting feedback from previous employers and other references, including verifying data submitted through previous employers and/or references

Categories of personal data: Basic Data, Recruitment Data, Reference Data

Purpose of processing: Assessing the strengths and weaknesses of the candidate, including conducting homework and its assessing

Categories of personal data: Basic Data, Recruitment Data

Purpose of processing: Making a recruitment decision, including assessment of qualifications and suitability

Categories of personal data: Basic Data, Recruitment Data

Purpose of processing: Informing the candidate of the results of the recruitment process

Categories of personal data: Basic Data, Recruitment Data

Purpose of processing: Storing information containing personal data in the backup systems of the relevant Group Company

Categories of personal data: All data categories

Purpose of processing: Disclosure of data to service providers and professional advisers

Categories of personal data: All data categories

Purpose of processing: Disclosure of data to successors and/or potential acquirers

Categories of personal data: All data categories

Purpose of processing: Disclosure of data to public, law enforcement and supervisory authorities

Categories of personal data: All data categories

Purpose of processing: Establishing, exercising or defending legal claims, whether in court proceedings or in administrative or out-of-court procedures

Categories of personal data: All data categories

Purpose of processing: Arranging the sale, merger or other corporate restructuring involving the relevant Group Company and providing information for the purposes of conducting legal, financial or other audits (including related data exchange), where necessary
Categories of personal data:

4 RECIPIENTS OF PERSONAL DATA AND DATA TRANSFERS

4.1 In certain cases, in order to comply with applicable legal or contractual obligations or, where applicable, to pursue legitimate interests, the relevant Group Company may transfer your personal data to the following categories of recipients, who process such personal data as independent controllers:

Category: Public authorities and law enforcement agencies

Purpose and legal basis of disclosure: Where required by applicable law, court orders or legally binding requests, the relevant Group Company may disclose your personal data to public authorities, supervisory authorities or law enforcement agencies in order to comply with legal obligations or to establish, exercise or defend legal claims.

Category: Other Frankenburg group companies

Purpose and legal basis of disclosure: Where necessary, the relevant Group Company may disclose your personal data to other Frankenburg group companies in order to enable the use of shared technical infrastructure, provide centralised support functions or perform internal administrative tasks, based on legitimate interests and subject to appropriate safeguards.

Category: Professional advisors

Purpose and legal basis of disclosure: Where necessary, the relevant Group Company may disclose your personal data to professional advisers, such as auditors, accountants, legal advisers or other consultants, for the purposes of obtaining professional advice, ensuring compliance with legal obligations or the proper conduct of business operations.

Category: Successors and/or potential acquirers of the Group Companies

Purpose and legal basis of disclosure: Where necessary for the purposes of a transfer, merger, acquisition or other corporate restructuring involving the relevant Group Company, your personal data may be disclosed to potential acquirers or successors and their professional advisers, based on legitimate interests and subject to confidentiality obligations.

4.2. The relevant Group Company may engage processors to process personal data on its behalf. Such processors process personal data solely on the documented instructions of the relevant Group Company and only for the purposes of performing services under the applicable contract. The categories of processors engaged by the relevant Group Company include:

Category: IT service providers

Purpose and legal basis of disclosure: The relevant Group Company may engage IT service providers (such as data hosting, backup, storage, system maintenance and support service providers) who process personal data on its behalf for the purposes of operating, maintaining and securing the Group Company’s IT systems and technical infrastructure.

Category: Recruitment platform providers

Purpose and legal basis of disclosure: The relevant Group Company may engage recruitment platform providers who process personal data on its behalf for the purposes of managing and facilitating the recruitment process.

Category: Background screening service providers

Purpose and legal basis of disclosure: The relevant Group Company may engage background screening service providers to conduct pre-employment background checks on candidates from outside Estonia and Latvia who process personal data on its behalf for the purposes of conducting such background checks.

4.3 Given the international nature of the Group Companies, it may be necessary for the relevant Group Company to transfer your personal data to, or make it accessible by, recipients located in countries outside the EU/EEA or the UK, including other Frankenburg group companies or service providers established in such countries.

4.4 Where personal data is transferred outside the EU/EEA, the relevant Group Company ensures that appropriate safeguards are in place in accordance with applicable data protection legislation, such as standard contractual clauses approved by the European Commission or other legally recognised transfer mechanisms, to ensure a level of protection essentially equivalent to that applicable in the EU/EEA. Similarly, where personal data is transferred outside the UK, the relevant Group Company ensures that appropriate safeguards are in place, such as the UK International Data Transfer Agreement or standard contractual clauses, to ensure a level of protection essentially equivalent to that applicable in the UK. You may obtain further information about the applicable safeguards by using the contact details provided in this Notice.

4.5. Where personal data is transferred between Group Companies established in different jurisdictions, including between Group Companies established in the EU/EEA and the UK, such transfers take place in accordance with the respective roles of the Group Companies as independent controllers, joint controllers or controllers and processors, as applicable. Such transfers are governed by appropriate intra-group agreements and safeguards reflecting these roles and ensuring compliance with applicable data protection legislation.

5 PERSONAL DATA RETENTION PERIODS

5.1 The relevant Group Company retains your personal data for as long as necessary to fulfil the purposes described in this Notice and in accordance with applicable statutory retention periods. Retention periods are determined by the relevant Group Company acting as a controller, unless a specific retention period is required by applicable law. In determining appropriate retention periods, the relevant Group Company takes into account the nature, scope and sensitivity of the personal data, the purposes of the processing, the potential risks associated with unauthorised use or disclosure, and applicable legal or regulatory requirements.

5.2 If you would like to receive further information about applicable retention periods or the retention of a specific category of personal data, you may contact the data protection contact person using the contact details provided in Section 1 of this Notice.

5.3 Upon expiry of the applicable retention period, or where the relevant Group Company no longer needs the personal data for the purposes for which it was collected, the personal data will be deleted or anonymised, unless further retention is required or permitted by applicable law, including for the establishment, exercise or defence of legal claims.

6 NO AUTOMATED DECISIONS

6.1 We do not envisage that you will be subject to decisions or profiling that will have a significant impact on you based solely on automated decision-making.

7 RIGHTS OF THE DATA SUBJECT

7.1 You have the right to contact the data protection contact person using the contact details provided in Section 1 of this Notice in order to exercise the following rights in accordance with applicable data protection legislation, including the GDPR and the UK GDPR:

7.1.1. The right to access your personal data, including the right to obtain a copy of your data and information about how it is being processed.

7.1.2 The right to request the rectification of inaccurate or incomplete personal data that the Group Companies process.

7.1.3. Right to erasure of personal data (“right to be forgotten”), for example, if the data is no longer necessary for the purpose for which it was collected, you withdraw your consent and no other legal basis for processing exists, or if the processing is unlawful.

7.1.4. The right to request the restriction of the processing of your personal data, for example, if you contest its accuracy, the processing is unlawful, or the Group Companies no longer need the data for processing purposes, but you require the personal data to establish, exercise or defend legal claims.

7.1.5 The right to data portability, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to have it transmitted to another controller, where technically feasible, if the processing is carried out by automated means and is based on your consent or a mutual contractual relationship.

7.1.6 The right to object to the processing of your personal data, for example, where the processing is based on the Group Companies’ legitimate interests.

7.1.7 The right to withdraw your consent at any time. The withdrawal of your consent does not affect the lawfulness of the processing of personal data prior to the withdrawal.

7.1.8 The right to contact the supervisory authority, to submit your claim to the data protection authority. For European Union national data protection authorities (with contact details of each supervisory authority), please see the list here. For candidates whose personal data is processed by Frankenburg UK, you may also contact the UK Information Commissioner’s Office (ICO) at https://ico.org.uk.

8 CHANGES TO THIS NOTICE

This Notice may be updated from time to time to reflect changes in applicable law or in the way the relevant Group Company processes personal data. Where material changes are made, the updated version of the Notice will be made available to you through appropriate means.

Version: 24 September 2026