Global Job Applicant Privacy Notice

Scope and Overview

This Global Job Applicant Privacy Notice (“Privacy Notice”) describes how Balsam Brands Inc. and its affiliates (collectively, "Balsam Brands," "we," or "us") collect and process personal data about you during the application and recruitment process. This Privacy Notice applies only to individuals applying and/or are being considered for work with us, whether as an employee, intern, consultant, contractor, or other type of worker (“you” or “Applicant”).

This Privacy Notice describes the categories of personal data that we collect, how we use your personal data, how we secure your personal data, how long we keep it, and when we may disclose your personal data to third parties. This Privacy Notice also describes your rights regarding the personal data that we hold about you including how you can access, correct, and request erasure of your personal data.

The entity responsible for the collection and processing of your personal data is the Balsam entity to which you submit your application form. You can identify the Balsam entity to which you submit your application form by consulting the relevant local entities listed in Annex A of this Privacy Notice.

We will only process your personal data in accordance with this Privacy Notice unless otherwise required by applicable law. We take steps to ensure that the personal data that we collect about you is adequate, relevant, not excessive, and processed for limited purposes.

Collection and Use of Personal Data

For the purposes of this Privacy Notice, personal data means any information about an identifiable individual collected in connection with the recruitment process. Balsam Brands may collect personal data directly from you, as a job applicant, or may receive personal data from third parties, for example, in connection with a background, employment, or reference check, subject to your consent where required by law. Balsam Brands also collects personal data from recruitment agencies and from publicly available online resources. Personal data excludes anonymous or de-identified data that is not associated with a particular individual.

We only process your personal data where applicable law permits or requires it in connection with carrying out our application and recruitment process, to take steps necessary to enter into an employment contract with you, where the processing is necessary to comply with a legal obligation that applies to us, for our legitimate interests or the legitimate interests of third parties, or with your consent if applicable law requires consent.

In addition to using your personal data for the position for which you have applied, we may retain and use your personal data to inform you about and consider you for other positions that may be appropriate for you with your consent. If you want us to consider you for other positions, you may contact us as specified below under Contact Us and we will retain your personal data for that purpose.

We will only process your personal data for the purposes we collected it for or for compatible purposes. If we need to process your personal data for an incompatible purpose, we will provide notice to you and, if required by law, seek your consent. We may process your personal data without your knowledge or consent only where required by applicable law or regulation.

The information below identifies what personal data we process about you, our processing purposes, and the lawful basis for processing your personal data.

Personal Information	Processing Purposes Lawful Basis for Processing
Contact Information Name* Address* Email address* Phone number*	Processing Purposes Administering your application and considering your suitability for the role. Lawful Basis for Processing Legitimate interest – to administer and correspond with you regarding your application and enable Balsam Brands to recruit suitable employees. Processing Purposes Making a job offer and entering into a contract of employment with you. Lawful Basis for Processing It is necessary to enter into and perform your employment contract and to comply with legal obligations or to exercise rights in employment law. Processing Purposes Retaining appropriate recruitment process records. Lawful Basis for Processing Legitimate interest – to process your application and, where an offer is made, to enter into an employment contract with you. To carry out legal obligations or exercise rights under employment law. To establish, exercise or defend any legal claims relating to your recruitment.
Personal Information Date of birth Gender Personal information contained in your CV, cover letter, or application form*	Processing Purposes Administering your application and considering your suitability for the role. Lawful Basis for Processing Legitimate interest – to administer and correspond with you regarding your application and enable Balsam Brands to recruit suitable employees. Processing Purposes Making a job offer and entering into a contract of employment with you. Lawful Basis for Processing It is necessary to enter into and perform your employment contract and to comply with legal obligations or to exercise rights in employment law. Processing Purposes Developing, operating, and collecting recruitment and employee selection process feedback. Lawful Basis for Processing Legitimate interest – to enable Balsam Brands to improve its ability to select the best candidates for open positions. Public interest reasons – ensuring equal opportunities and treatment. Processing Purposes Retaining appropriate recruitment process records. Lawful Basis for Processing Legitimate interest – to process your application and, where an offer is made, to enter into an employment contract with you. To carry out legal obligations or exercise rights under employment law. To establish, exercise or defend any legal claims relating to your recruitment.
Identity and Background Information Details of education, academic and professional qualifications, and results* Career history, experience, and skills* CV and professional profile* Application form* Evaluative notes and decisions from phone screenings and interviews Salary preferences, willingness to relocate, job preferences, and other information relating to compensation and benefits* Referee details* Information obtained about you from previous employers, education providers, for example in references provided to us*	Processing Purposes Administering your application and considering your suitability for the role. Lawful Basis for Processing Legitimate interest – to administer and correspond with you regarding your application and enable Balsam Brands to recruit suitable employees. Processing Purposes Administering and reviewing your skill testing results. Lawful Basis for Processing Legitimate interest – to enable Balsam Brands to recruit suitable employees. Processing Purposes Making a job offer and entering into a contract of employment with you. Lawful Basis for Processing It is necessary to enter into and perform your employment contract and to comply with legal obligations or to exercise rights in employment law. Processing Purposes Developing, operating, and collecting recruitment and employee selection process feedback. Lawful Basis for Processing Legitimate interest – to enable Balsam Brands to improve its ability to select the best candidates for open positions. Public interest reasons – ensuring equal opportunities and treatment. Processing Purposes Retaining appropriate recruitment process records. Lawful Basis for Processing Legitimate interest – to process your application and, where an offer is made, to enter into an employment contract with you. To carry out legal obligations or exercise rights under employment law. To establish, exercise or defend any legal claims relating to your recruitment.
Financial Information Salary, compensation, and other remuneration information Government identification number	Processing Purposes Administering your application and considering your suitability for the role. Lawful Basis for Processing Legitimate interest – to administer and correspond with you regarding your application and enable Balsam Brands to recruit suitable employees. Processing Purposes Making a job offer and entering into a contract of employment with you. Lawful Basis for Processing It is necessary to enter into and perform your employment contract and to comply with legal obligations or to exercise rights in employment law.
Special Categories of Personal Data Racial or ethnic origin, including nationality and visa information	Processing Purposes Developing, operating, and collecting recruitment and employee selection process feedback. Lawful Basis for Processing Legitimate interest – to enable Balsam Brands to improve its ability to select the best candidates for open positions. Public interest reasons – ensuring equal opportunities and treatment. Processing Purposes Retaining appropriate recruitment process records. Lawful Basis for Processing Legitimate interest – to process your application and, where an offer is made, to enter into an employment contract with you. To carry out legal obligations or exercise rights under employment law. To establish, exercise or defend any legal claims relating to your recruitment.
Special Categories of Personal Data Criminal record and financial data from pre-employment checks, where relevant for the role	Processing Purposes Administering your application and considering your suitability for the role. Lawful Basis for Processing Legitimate interest – to administer and correspond with you regarding your application and enable Balsam Brands to recruit suitable employees. Processing Purposes Making a job offer and entering into a contract of employment with you. Lawful Basis for Processing It is necessary to enter into and perform your employment contract and to comply with legal obligations or to exercise rights in employment law. Processing Purposes Retaining appropriate recruitment process records. Lawful Basis for Processing Legitimate interest – to process your application and, where an offer is made, to enter into an employment contract with you. To carry out legal obligations or exercise rights under employment law. To establish, exercise or defend any legal claims relating to your recruitment.
Employment Administration Information Terms and conditions of employment Your working preferences Your preferences in relation to our use of your personal data	Processing Purposes Administering your application and considering your suitability for the role. Lawful Basis for Processing Legitimate interest – to administer and correspond with you regarding your application and enable Balsam Brands to recruit suitable employees. Processing Purposes Making a job offer and entering into a contract of employment with you. Lawful Basis for Processing It is necessary to enter into and perform your employment contract and to comply with legal obligations or to exercise rights in employment law. Processing Purposes Retaining appropriate recruitment process records. Lawful Basis for Processing Legitimate interest – to process your application and, where an offer is made, to enter into an employment contract with you. To carry out legal obligations or exercise rights under employment law. To establish, exercise or defend any legal claims relating to your recruitment.
Travel and Expenses Information Visa, passport and insurance details Flight and accommodation booking information Travel itinerary information Driving license as part of the post-offer onboarding process	Processing Purposes Administering travel and accommodation arrangements. Lawful Basis for Processing Legitimate interest - to ensure you can reach required locations as needed for interview or work purposes.
Security and Access Control Data Personal data, including image, captured or recorded by electronic card access systems, CCTV, and other security control systems.	Processing Purposes Monitoring the security of Balsam Brands’ physical premises. Lawful Basis for Processing It is necessary for Balsam Brands to comply with a legal obligation and for our legitimate interests. Processing Purposes Operating, reviewing, and responding to CCTV surveillance of Balsam Brands’ premises, including monitoring footage if required. Lawful Basis for Processing Legitimate interest – protection of Balsam Brands’ premises, business, assets, employees, the public and loss prevention. Processing Purposes Retaining appropriate recruitment process records. Lawful Basis for Processing Legitimate interest – to process your application and, where an offer is made, to enter into an employment contract with you. To carry out legal obligations or exercise rights under employment law. To establish, exercise or defend any legal claims relating to your recruitment.

The personal data in this notice/identified above with an (*) is mandatory in connection with our recruiting activities. Failure to provide or allow us to process mandatory personal data may affect our ability to accomplish the purposes stated in this Privacy Notice.

Automated Processing

We may use certain artificial intelligence tools (“AI Tools”) for our legitimate business interests. These interests include improving the efficiency, quality, and speed of our recruitment processes. These tools use artificial intelligence services that we license from third parties, including LinkedIn, Metaview, Greenhouse, and OpenAI. Personal data may be contained within the documents (such as your CV) and information uploaded to our AI Tools to assist with our recruitment processes; however, they are not used to solely automate decision making and the AI Tools will not be relied upon without human review for accuracy and appropriateness.

Data Sharing

We will only disclose your personal data to third parties where required by law or to our employees, contractors, designated agents, or third-party service providers who require such information to assist us with administering the recruitment process, including third-party service providers who provide services to us or on our behalf. We may use third-party service providers for various purposes, including, but not limited to, obtaining employment verification and background checks, applicant tracking, data storage, data hosting. These third-party service providers may be located outside of the country in which you live or the country where the position you have applied for is located.

We require all our third-party service providers, by written contract, to implement appropriate security measures to protect your personal data consistent with our policies and any data security obligations applicable to us. If we disclose your personal data to third parties, we will only disclose the personal data necessary to meet our business need or legal requirement. We do not permit our third-party service providers to process your personal data for their own purposes. We only permit them to process your personal data for specified purposes in accordance with our instructions.

We may also disclose your personal data for the following additional purposes:

• To our affiliates (including outside of your home jurisdiction) for the purposes set out in this Privacy Notice and as necessary to administer the application and recruitment process, and as part of our regular reporting activities to our affiliates.
• To regulators, law enforcement, public authorities or other third parties where necessary to comply with legal obligations or valid legal processes such as search warrants, subpoenas, or court orders. When we disclose your personal data to comply with a legal obligation or legal process, we will take reasonable steps to ensure that we only disclose the minimum personal data necessary for the specific purpose and circumstances.
• To law enforcement, public authorities or other third parties to protect the rights and property of Balsam Brands.
• To law enforcement, emergency services, public authorities or other third parties during emergency situations or where necessary to protect the safety of persons.
• Where the personal data is publicly available.
• To third parties to whom we may choose to sell, transfer, or merge parts of our business or assets if the disclosure is necessary to complete the transaction. In these circumstances, we will limit data sharing to what is absolutely necessary, and we will anonymize the data where possible.
• For additional purposes with your consent where such consent is required by law.

Data Security

We have implemented appropriate physical, technical, and organizational security measures designed to secure your personal data against accidental loss and unauthorized access, use, alteration, or disclosure. In addition, we limit access to personal data to those employees, agents, contractors, and other third parties that have a legitimate business need for such access.

Data Retention

Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, as required to satisfy any legal, accounting, or reporting requirements, or as necessary to resolve disputes. To determine the appropriate retention period for personal data, we consider our statutory obligations, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes we process your personal data for, and whether we can achieve those purposes through other means. We do not retain your personal data longer than 2 years, unless you have been hired/engaged by Balsam Brands.

If you are offered and accept employment with Balsam Brands, the personal data we collected during the application and recruitment process will become part of your employment record, and we will use it in connection with your employment consistent with our employee personal data policies. If you do not become an employee, or, once you are no longer an employee of Balsam Brands, we will retain and securely destroy your personal data in accordance with our document retention policy and applicable laws and regulations.

Once we no longer have a legal right to hold your personal data, we will delete, or in some circumstances, we will anonymize your personal data so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent.

In some circumstances, you can ask us to delete your personal data, see below for more information.

Rights of Access, Correction, Erasure, and Objection

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during the recruitment process. By law you may have the right to request access to, correct, and erase the personal data that we hold about you, or object to the processing of your personal data under certain circumstances. You may also have the right to request that we transfer your personal data to another party. If you want to review, verify, correct, or request erasure of your personal data, object to the processing of your personal data, or request that we transfer a copy of your personal data to another party, please contact us at privacy@balsambrands.com with the subject line “Job Applicant Privacy Request.” Any such communication must be in writing.

We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal data that we hold about you or make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal data that we hold about you, or we may have destroyed, erased, or anonymized your personal data in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal data, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Changes to This Privacy Notice

We reserve the right to update this Privacy Notice at any time, and we will provide you with a new Privacy Notice when we make any updates, where required by applicable law. If we would like to use your previously collected personal data for different purposes than those we notified you about at the time of collection, we will provide you with notice and, where required by law, seek your consent, before using your personal data for a new or unrelated purpose. We may process your personal data without your knowledge or consent only where required by applicable law or regulation.

Contact Us

If you have any questions about our processing of your personal data or would like to make an access or other request, please contact us at privacy@balsambrands.com.

ANNEX A

Balsam Brands Entity

Balsam Brands Entity	Candidate
Balsam Brands Entity Balsam Brands Inc.	Candidate United States
Balsam Brands Entity Balsam Brands Canada Ltd.	Candidate Canada
Balsam Brands Entity Balsam International Unlimited Company	Candidate EU; UK
Balsam Brands Entity Balsam International Unlimited Company-Philippine ROHQ	Candidate Philippines

If you are a resident of a country not covered above, the job description will indicate the hiring Balsam Brands entity.

ANNEX B

California-Resident Job Candidates Privacy Notice

This California Job Applicant Privacy Notice supplements the Global Job Applicant Privacy Notice and describes the types of personal information we collect about California residents who apply for jobs with Balsam Brands (“Job Applicants”). Certain terms used in this Notice have the meanings given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA”).

Sale or Sharing of Personal Information

The CCPA requires us to disclose whether we sell or share your personal information. We do not sell or share your personal information.

Categories of Sensitive Personal Information We Collect

The Global Job Applicant Privacy Notice describes the categories of personal information that we collect, the sources of collection and how we use it. We also collect certain types of sensitive personal information, as defined by CCPA, from you.

The categories of sensitive personal information include:

• Data you provide for us to process your application, verify your information and carry out reference or background checks (where applicable) (e.g., SSN, driver’s license)
• Self-ID data (e.g., race, ethnicity, sexual orientation, or disability status) you choose to provide, which we use to comply with anti-discrimination laws and meet our government reporting obligations, to help ensure equal employment opportunities at LinkedIn and to provide accommodations during the recruiting process

California Consumer Privacy Rights

If you are a California resident Job Applicant, you may have certain choices regarding your personal information:

• Right to notification
• Right to access to your information
• Right to correct your information
• Right to delete your personal information
• Right to limit the use or disclosure of your sensitive personal information
• Nondiscrimination for exercising your rights

How to Submit a Request

To submit an access, correction, or deletion request, you can send us an email at privacy@balsambrands.com.

Verifying Requests

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your access, deletion, or correction request. We may verify your identity by requiring you to authenticate your e-mail address or provide information about your prior interactions with us, such as positions for which you have applied. In addition, if you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the Job Applicant whose personal information is the subject of the request.

Additional Information

If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

ANNEX C

EU-Resident Job Candidates Privacy Notice

Specific data protection laws in the European Union, including the General Data Protection Regulation (GDPR), require that we give our European candidates some more detailed information.

The following special categories of personal data are considered sensitive under the GDPR and may receive special protection:

• Racial or ethnic origin.
• Political opinions.
• Religious or philosophical beliefs.
• Trade union membership.
• Genetic data.
• Biometric data.
• Data concerning health.
• Data concerning sex life or sexual orientation.
• Data relating to criminal convictions or offences.

Where we have a legitimate need to process special categories of personal data about you for purposes not identified in the Global Job Applicant Privacy Notice, we will only do so only after providing you with notice and, if required by law, obtaining your prior, express consent.