Privacy Policy and Personal data protection for Job Applicants and Employees

1. HUBEXO Commitment

HUBEXO entities (hereinafter jointly referred to as “HUBEXO”) are committed to protecting the privacy of Data Subjects and ensuring the security of their personal data.

In this context, this Privacy Policy reflects our commitment to and respect for privacy and personal data protection rules. It ensures that Data Subjects are informed about how HUBEXO processes the personal data provided during the recruitment and selection process, as well as throughout the entire course of the employment relationship.

HUBEXO undertakes to demonstrate the application of principles relating to the processing of personal data, namely lawfulness, purpose limitation, data minimization, accuracy, and storage limitation, as well as best practices in information security, ensuring integrity, confidentiality, availability, and resilience of the information in its possession.

HUBEXO recognizes the importance of protecting the personal data of its employees and undertakes to ensure its processing in accordance with the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679) and other applicable legislation.

2. Scope

This policy applies to the processing of personal data of HUBEXO employees and former employees, including data collected through digital platforms used for human resources management purposes, such as internal platforms for administrative human resources management, talent, performance and training management.

3. Data Controller

The HUBEXO entity with which you have entered into an employment agreement, or submitted a job application, is the controller of the processing activities described herein. As part of its integration within the HUBEXO entities, personal data may also be processed by other HUBEXO entities, acting as joint controllers or processors, whenever such processing is necessary and lawful. The HUBEXO entities and their contact information are listed below:

4. Why Do We Process Your Personal Data?

The purposes for which we process your personal data, the corresponding legal bases, the categories of data subjects, and the types of personal data involved are outlined below.

These processing activities may vary depending on the relevant Hubexo entity and/or applicable local legislation.

5. How Do We Protect Your Personal Data?

HUBEXO applies technical and organizational measures to ensure a high level of security, using a set of physical and logical security technologies and procedures appropriate to the protection of personal data, including the following security measures:

• Access control (logical and physical)
• Authentication and access management
• Data encryption
• Profile segregation
• Multi-factor authentication
• Daily and incremental backups
• Multi-layer firewalls
• Clear screen and acceptable use policies
• Segregation of productive and non-productive environments
• Malicious code control
• Malicious software precautions
• Vulnerability management
• Incident management
• Alerts and monitoring of events and incidents
• Pen testing
• Disaster recovery
• Secure development policy
• Cryptographic policies
• Collection, maintenance, and protection of logs and audit evidence on the platform
• Infrastructure monitoring
• VPN (site to site)
• TSA services
• High availability infrastructure 99.5%
• Patches update
• Risk management
• Data masking

HUBEXO applies audit and control mechanisms to ensure compliance with its security policies and the protection of personal data.

6. Data Retention

HUBEXO is committed to complying with the personal data retention periods established by legal and regulatory standards or, in the absence of these, what is necessary for the pursuit of the purpose that legitimized the collection or for the declaration, exercise, or defense of a right in a judicial process.

7. Data Sharing and International Data Transfers

HUBEXO may share personal data within the HUBEXO entities, in accordance with the law and when necessary for the legitimate interests of the Group, namely in the context of shared services, improvement of service offerings, satisfaction surveys, and internal and external reporting.

HUBEXO may also share personal data with third-party service providers and suppliers, to fulfil contracts entered into, and with administrative entities and public authorities, including courts, in accordance with the law.

The processing of personal data may involve the transfer of personal data to third countries (located outside the European Union or the European Economic Area) or international organizations, within the purposes provided for in this Policy, in relation to which there is no adequacy decision adopted by the European Commission. In such cases, we undertake to adopt appropriate security measures to ensure the confidentiality and protection of personal data, in accordance with applicable data protection legislation complying with the requirements and measures that follow from the General Data Protection Regulation or Other Regulatory Regime regarding third country transfers. In particular, the transferred data will be subject to the appropriate safeguards provided by law, and supplementary measures will be ensured to guarantee that personal data enjoys a level of protection essentially equivalent to that existing in the European Union.

Payroll data is not included in international transfers.

8. Subcontracting

HUBEXO may use subcontractors for the processing of personal data of employees, namely in the context of information technology services, human resources management, payroll processing, training, or internal communication.

These entities act on behalf of HUBEXO, under contracts that ensure compliance with legal obligations regarding data protection, including security measures, confidentiality, and respect for the rights of data subjects.

A non-exhaustive list of key third-party systems currently used by HUBEXO in the processing of personal data under this policy is provided below. Additional systems may be added or updated as necessary:

9. Use of Artificial Intelligence Systems

HUBEXO may use artificial intelligence (AI) systems in processes such as:

• Recruitment and screening of applications;
• Competencies evaluation;
• Productivity tools.

Whenever a system uses AI, a clear indication will be provided to the employee. The processing will be carried out in accordance with Regulation (EU) 2024/1689 (AI Act), which imposes requirements such as:

• Impact assessment on fundamental rights;
• Transparency and human oversight;
• Risk mitigation.

10. Rights of Data Subjects

You can exercise the following rights free of charge and at any time, in accordance with the GDPR:

• Right of access to your personal data to know which data is being processed and the processing operations carried out with it
• Right to rectification or completion of any inaccurate or outdated personal data
• Right to erase your personal data, except in cases where there is a legal or contractual obligation for retention
• Right to request the restriction of processing of your personal data when the accuracy, legality, or necessity of the data processing is doubtful, and there may be an obligation to retain it for the exercise or defense of claims
• Right to data portability, when the legal basis for processing is the contractual relationship or consent
• Right to object to the processing of your personal data, including the request to cancel the sending of advertising communications related to a product/service and the request to cancel all advertising communications
• Right to withdraw previously given consent

11. Contact Details – PRIVACY

For any questions or to exercise your rights, employees may contact the Local Team using the contact details provided below:

In your request, you must indicate your identification data, the right you wish to exercise, and the respective basis.

Proof of your identity may be requested to ensure that the sharing of personal data is only done with the data subject.

The request, once analyzed, will be responded to within the legal deadlines (usually within 30 days).

You also have the right to lodge a complaint with the Supervisory Authority of the country in which you are located. A list of the relevant authorities and their contact details can be found below:

12. Responsibilities of Data Subjects

Employees are responsible for ensuring that any personal data they provide to HUBEXO is accurate, complete, and kept up to date.

They must promptly notify HUBEXO of any changes to their personal data to ensure continued compliance with applicable data protection obligations.

Employees are also responsible for ensuring that any personal data relating to third parties (e.g., emergency contacts, dependants) that they provide to HUBEXO has been collected lawfully and, where required, with the appropriate consent.

Furthermore, employees must handle any personal data to which they have access in the course of their duties in accordance with HUBEXO’s internal policies and applicable data protection laws, including maintaining confidentiality and reporting any suspected data breaches or unauthorized disclosures without undue delay.

13. Local Policies and Legal Precedence

13.1 Awareness and Acceptance of Local Policies and Legal Requirements

All employees and job applicants shall be informed of, and are required to acknowledge and comply with, any internal policies, procedures, or regulations applicable to the specific HUBEXO entity with which they have a contractual or pre-contractual relationship. This includes any specific obligations arising under the local laws and regulations of the relevant jurisdiction.

13.2 Prevalence of Local Policies

In the event of any conflict or inconsistency between this Global Privacy Policy and any local policies, procedures, or regulations issued by the relevant HUBEXO contracting entity, the provisions of the applicable local policies and legal requirements shall prevail to the extent required by local law.

14. Confidentiality

HUBEXO recognizes the confidential nature of the data shared by its Data Subjects. HUBEXO does not make the personal data commercially or otherwise available to any third party, and undertakes not to disclose, copy, reproduce, or distribute any part of the confidential information without the prior written consent of the Data Subject (except for communications required by law, for the purposes of compliance with obligations arising therefrom).

HUBEXO preserves the confidentiality and integrity of the Data Subject’s data and protects it in accordance with this privacy policy and the legislation in force.

15. Changes to the Privacy and Personal Data Protection Policy

Without prejudice to the legal rights granted to the Data Subjects, HUBEXO reserves the right at any time, without prior notice and with immediate effect, to alter, add to, or revoke this Privacy Policy in whole or in part.

Any changes will be disclosed via the normal communications channels. Should HUBEXO substantially change the way in which it processes their personal data and, therefore, this Privacy Policy, HUBEXO shall notify the Data Subjects of said changes through the means of contact it has obtained from the Data Subjects.

Document Control

• Version: 2.0
• Effective Date: 18 August 2025
• Approved by: Chief People Officer

Background history