Last updated: 2023

Thank you for your interest in employment opportunities with us. This Privacy Statement describes how Instar Research (“we”) will collect, process and use the personal data you submit when applying for a position with us. The specific entity you are applying to work for is part of a wider group of affiliated companies (the “P\S\L Group Family”). In this Privacy Statement, “personal data” means any information that identifies you, or could reasonably be used to identify you. If you are located in the European Economic Area (“EEA”) or United Kingdom (“UK”), please also see our Supplemental GDPR Employment Candidate Privacy Statement below.

In summary, we will collect and use the personal data you provide to process your application for employment and comply with statutory obligations we have in relation to your application. Your personal data will be used and disclosed only for the legitimate business purposes of administering and evaluating your application and completing the on-boarding/new hire process, should you be offered and accept a position with us.

We will use your personal data for a variety of reasons linked to processing your application as set out below:

• Administering and processing your application, including your identification, experience and other information you submit and, if your application progresses, any interview information and background check information;

• Determining your suitability for the role for which you have applied or for similar roles within the P\S\L Group Family, including your identification, experience and other information you submit and, if your application progresses, any interview information and background check information;

• Conducting background checks as part of your application, subject to applicable law, including your identification, experience and other information you submit and, if your application progresses, any interview information and background check information; and

• Complying with applicable laws and employment-related requirements, including identification information and information required to initiate employment, for purposes such as confirming ability to legally work, setting up payroll, withholdings and benefits, and complying with statutory reporting requirements.

Your personal data may be shared with the following parties as necessary for the above purposes:

• Other P\S\L Group Family companies: P\S\L Group Family companies share human resources and management decisions in certain circumstances, and we may transfer your personal data to other P\S\L Group Family entities as necessary to ensure that any decision made with respect to your application reflects the input of all appropriate internal stakeholders and takes into account the internal forecasting, planning and other interests of all relevant P\S\L Group Family companies. We also share your personal data with other P\S\L Group Family entities to monitor and assure compliance with applicable policies and procedures and applicable laws. P\S\L Group Family entities only process your personal data for the purposes outlined in this paragraph.

• Third-party service providers: Our service providers may carry out instructions relating to IT hosting services or similar functions, recruitment or workforce administration. Where required, they will be subject to contractual obligations to implement appropriate technical and organizational measures to safeguard personal data, and to process it only as instructed.

• Regulators, authorities and other recipients: These parties include courts and other public authorities, independent external advisers and internal compliance and investigation teams.

Only authorized P\S\L Group Family personnel (talent acquisition, human resources, legal, and appropriate managers) will have access to your personal data for the legitimate business purposes described in this Privacy Statement.

P\S\L Group Family entities will retain personal data no longer than is necessary to carry out the processing purposes described in this Privacy Statement and/or as required by applicable law. If you are offered and accept an employment position with us, the personal data we collected about you during the recruitment process will form part of your employee file and be subject to a separate Privacy Statement. We may, with your consent, and also subject to different retention requirements under any applicable law, retain your information after the recruitment process is complete for longer period to contact you about potential future opportunities. We will delete your personal data when we no longer need it for the purposes outlined herein.

If you are located in the EEA or UK, please see the Supplemental GDPR Employment Candidate Privacy Statement below. Under applicable laws, you may have rights to access, update, rectify, port or erase certain personal data that we have about you or restrict or object to certain activities in which we engage with respect to your personal data. If you have such rights and your request complies with the requirements under applicable laws, we will give effect to your rights as required by law.

If you have questions or comments about how we will use your personal data, please contact privacy@instarresearch.com.

This Supplemental EEA and UK Employment Candidate Privacy Statement describes how P\S\L Group as data controller will collect, process and use the personal data of candidates in the EEA and UK. If you are located in the EEA, the EU General Data Protection Regulation applies to the processing of your personal data. If you are located in the UK, the UK General Data Protection Regulation applies to the processing of your personal data. References to the “GDPR” are references to the General Data Protection Regulation as it applies to the country where you are located.

P\S\L Group Family entities process any personal data that you provide during the recruitment process to comply with applicable legal obligations, pursuant to GDPR Art. 6(1)(c), and to pursue legitimate interests, including to evaluate your credentials to determine whether to hire you and assure compliance with applicable policies and procedures and applicable laws, pursuant to GDPR Art. 6(1)(f).

Some recipients of your personal data located outside of the EEA or UK are located in countries for which the adequacy decisions have been issued, namely: Canada. In each case, the transfer is thereby recognized as providing an adequate level of data protection under GDPR Art. 45.

Some recipients of your personal data are located in the following countries for which the European Commission or UK have not issued an adequacy decision or adequacy regulations in respect of the level of data protection there: The US and Mexico. By entering into appropriate data transfer agreements based on approved Standard Contractual Clauses or other adequate means (pursuant to Article 46 of the GDPR), we have established that all such recipients will provide an adequate level of data protection and that appropriate technical and organizational security measures are in place to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or access, and against other unlawful forms of processing. Any onward transfer (including to our affiliates outside the EEA and UK) is subject to appropriate onward transfer requirements as required by the applicable contract or law.

You can ask for a copy of such appropriate data transfer agreements by contacting us as set out at the bottom of this Privacy Statement.

Subject to the conditions set out under the GDPR, you have the following rights:

• Right of access: You have the right to know whether your personal data is being processed, and, where that is the case, to request access to the personal data. The access information includes, among other things, the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. You have the right to obtain a copy of the personal data undergoing processing.

• Right to rectification: You have the right to rectify inaccurate personal data concerning you. Depending on the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• Right to erasure (to be forgotten): You have the right to have your personal data erased in certain cases.

• Right to restriction of processing: You have the right to have the processing of your personal data restricted in certain cases.

• Right to data portability: You have the right to receive your personal data which you provided in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity.

• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data, in which case such processing may be required to cease.

• Right to withdraw your consent: If you declared your consent regarding certain types of processing activities, you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.

• Right to submit complaints: You have a right to lodge a complaint with a supervisory authority. You may view a list of supervisory authorities in the EEA and their respective contact information here: https://edpb.europa.eu/about-edpb/board/members_en. You may view the UK supervisory authority’s contact information here: https://ico.org.uk/global/contact-us/.

Please note that these rights might be limited under applicable national data protection laws. If you would like to exercise any of these rights, please contact us via the details listed below.

If you have questions or comments about how we will use your personal data, please contact privacy@instarresearch.com.