Recruitment

This Candidate Privacy Policy describes how Marshall Group AB (556757-4610), data controller, and its company group (“Marshall Group”), processes personal data related to hiring job applicants and sourced candidates (jointly ”Candidates”).

What kind of personal data do we use?

Marshall Group processes Candidates’ personal data that is relevant to Candidates’ job opportunities at Marshall Group.

Such personal data may broadly be grouped into the following categories:

• Identification data (e.g., photograph and date of birth)
• Contact details (e.g., address and telephone number)
• Recruitment-related information (e.g., CVs, cover letters, work experience, qualifications, educational background, language skills, professional skills and talents, professional memberships, geographic mobility interests)
• Publicly accessible personal data (e.g., information available on social media and information that appears in search results)
• Reference data (e.g., contact details to reference persons and information provided by such persons)
• Test results (e.g., from personality tests and logical reasoning tests)
• Interview notes (e.g., notes taken during interviews)
• Communication details (e.g., content from correspondence)
• Reports from candidate sourcing firms and executive search firms (including the above mentioned types of data, and assessments and recommendations) and
• Connect with us account data (if you register in our candidate pool Connect with us, we will process Identification data, contact details, date of registration and what positions you have applied for.

Why do we use personal data and why do we have the right to do so?

The main purpose for us using the personal data is to manage our process for recruiting staff. The data is used to communicate with candidates, assess applications and descriptions and decide who to offer positions to. Personal data may also be used to coordinate applications internally across relevant Marshall Group companies.

The legal ground for this processing is our legitimate interest in managing the recruitment process. Marshall Group considers this legitimate interest to outweigh the individual’s interest in not having their personal data processed for this purpose.

Personal data processed for the purpose of future career opportunities is based on the Candidate’s consent.

Who do we share candidate data with?

Personal data may be transferred between group companies for the purposes set out in this Candidate Privacy Policy.

We use externally provided IT-systems or services to facilitate the recruitment process. Personal data may be made available to such suppliers. Where this is the case, these are subject to appropriate data processing agreements.

Our suppliers may act as either data processors, i.e., processing personal data on our behalf, or as data controllers, i.e., processing data on their own behalf. Where our vendors act as data controllers, they are responsible for providing you with accurate information about their privacy practices. We encourage you to review that information carefully.

For EU citizens: Personal data may be provided to parties that are located outside the European Economic Area (“EEA”), for example if an applicant applies for a position with a Marshall Group company that is not located in the EEA. In such cases, we will ensure that the personal data is subject to measures that provide an equivalent level of protection as provided by data privacy laws in the EU (such as the EU General Data Protection Regulation; GDPR). For further information about what safeguards we apply with respect to transfer to countries outside of the EEA, you may contact us on the details provided below under the Candidates’ rights and how to contact us section below.

Only persons involved in the recruiting of a specific Candidate will have access to that Candidate’s personal data. This may include persons in the HR department as well as other departments.

How long do we keep personal data?

Personal data is stored by us, or by other parties on our behalf, as long as necessary for the performance of our obligations and achieving the purposes for which the information was obtained.

The personal data will be removed from our records or properly anonymized when it is no longer needed. The main principle is that personal data pertaining to a job application will be deleted as soon as a decision has been made in respect of the job and any applicable

period to appeal or otherwise dispute the decision, e.g., based on discrimination, has expired.

If you have created an account with us, you can delete data registered in your account by yourself.

Where the processing of personal data is based on consent, we will retain the personal data encompassed for the validity term of the consent, which is twelve (12) months or until the consent is withdrawn.

How do we protect your personal data?

We have technical, administrative, and physical safeguards to protect your personal data from being processed unlawfully.

How do we collect your personal data?

For recruitment purposes, you will most likely provide us with the personal data we process. In some cases, we may process personal data related to you by visiting your social media platforms, namely LinkedIn, and by receiving recommendations from recruiters or colleagues.

Candidates’ rights and how to contact us

If you are located in the EU/EEA, or if your personal data is otherwise being processed by a Marshall Group entity within the EU/EEA, you have the following rights:

1. Right of access: a right to ask whether or not we have personal data about them and, if that is the case, request information on what personal data we have. We will also have to respond to questions about why we are using personal data, details about what data we have and to whom we have provided access to the data.
2. Right to rectification: We are required to rectify inaccurate personal data, or to complete personal data that is incomplete.

• Right to erasure (right to be forgotten): We are in some circumstances required to erase personal data on request by the candidate concerned.

1. Right to restriction of processing: We are in some circumstances required to restrict our use of personal data on request by the person concerned. In such cases, we may only use the data for certain limited purposes set out by the law.
2. Right to data portability: Under certain circumstances, candidates may have the right to receive their personal data to which we have access, in a structured, commonly used and machine-readable format and to transmit those data to another entity without hindrance from us.

• Right to object: In some cases, individuals are entitled to object to our use of their personal data. We may then be required to stop using the personal data.

In addition to the above, a consent to process personal data can always be withdrawn. Please note that these rights may be subject to national restrictions.

You are welcome to contact us if you have any questions about this Candidate Privacy Policy or if you have any other questions regarding how we process Candidate personal data.

Marshall Group AB

Zound Industries Smartphones AB

Zound Industries International AB French Branch

Zound Industries UK Ltd

For privacy related questions, you can contact us by sending a mail to: gdpr@marshall.com

Candidates may also lodge a complaint with the relevant data protection authority.

Data Protection Authorities

Sweden: Integritetsskyddsmyndigheten (IMY) https://www.imy.se/

France: Commission nationale de l’informatique et des libertés (CNIL) https://www.cnil.fr/

United Kingdom Information Commissioner’s Office (ICO) https://ico.org.uk/

Last updated June 15, 2023.