HÖEGH CAPITAL PARTNERS

Updated February 2021

This policy is adopted by and relates to each of Höegh Capital Partners Limited and Arts Alliance Productions Limited (referred to below individually and collectively as "HCP", we, us, our). These companies jointly determine the purposes and means of processing personal data and are joint data controllers under the UK General Data Protection Regulation (UK GDPR).

This Privacy Notice is intended to ensure that you are aware of what personal data HCP holds in relation to you, and how we use that data as data controller. Please read the following carefully to understand our use of your personal data.

Scope

This Privacy Notice applies to all candidates (including those that may be unsuccessful in the application process) and third parties whose information you provide to us in connection with any application.

Where we refer to 'candidate personal data', 'employee' or 'employment' in this Privacy Notice, we do so for convenience only and this should in no way be interpreted as purporting to confer employment status. This Privacy Notice does not form part of any contract of employment and does not confer any contractual right on you or place any contractual obligation on us.

This Privacy Notice applies to all personal data collected, maintained, transmitted, stored, retained, or otherwise used (i.e. processed) by us regardless of the media on which that personal data is stored.

What is Personal Data?

'Personal Data' is defined as any data relating to a living individual who can be identified directly from that data or indirectly in conjunction with other information. We hold some or all of the following types of personal data in relation to candidates:

• name, address, date of birth, civil status;
• bank details, salary, benefit details;
• educational details and previous employment background;
• curriculum vitae and/or application form;
• criminal record checks;
• photo;
• interview records;
• general correspondence, including references from previous employers; and
• signed confidentiality agreements.

Purpose and Basis for Processing

We will hold, process and may disclose personal data provided by you and recruitment agencies for the purpose of recruitment/appointment including assessing your job application, communicating with you about the recruitment process, monitoring and promotion of equal opportunities, including the review of gender breakdown and progression, and exercising our right

to defend, respond or conduct legal proceedings. We will only process your personal data for the purposes set out above, to the extent necessary:

• for recruitment purposes;
• in order for you to be engaged by us as an employee, contractor, worker or otherwise;
• in order to comply with any legal or regulatory obligations; and
• for HCP's legitimate business interest in managing its business including legal, personnel, administrative and management purposes and for the prevention and detection of crime provided our interests are not overridden by your interests.

Where you do not provide your Personal Data

If you and/or the relevant recruitment agency do not provide us with your personal data we may not be able to process your job application, or suitability for a particular role, comply with our legal obligations or manage our business. We will tell you when we ask for information which is a contractual requirement or needed to comply with our legal obligations.

Recipients of Your Personal Data

We may disclose your personal data to members of our HR team, the relevant team managers in respect of the role you are applying for in order to take hiring decisions. It may be necessary from time to time for us to disclose your personal data to third parties or agents, including without limitation to the following:

• third parties or agents to assist in the administration, processing and management of certain activities pertaining to prospective employees including external reference agencies (such as employee vetting and screening agencies) and travel and expense management service providers;
• individuals or companies employed by HCP to carry out specific services, functions or consultancy work and other financial institutions;
• relatives or legal representatives of prospective employees;
• regulatory bodies to whom we are obliged or required to disclose information including Workplace Relations Commission, Courts and Court-appointed persons; and
• relevant Government departments and agencies.

We will inform you in advance if we intend to further process or disclose your personal data for a purpose other than the purposes set out above. We take all reasonable steps, as required by law, to ensure the safety, privacy and integrity of such data and information and, where appropriate, enter into contracts with such third parties to protect the privacy and integrity of such data and any information supplied.

Transfer of Personal Data outside the UK

The personal data that we collect from you may be transferred to, and stored at, a destination outside the UK, for the purposes described above. Those countries may not provide an adequate level of protection in relation to processing your personal data. We will ensure appropriate safeguards are in place to protect the privacy and integrity of such personal data. You can obtain information concerning such safeguards from the HR Department, where applicable.

Special Categories of Personal Data

Certain categories of your personal data are regarded as 'special'. We only process such data where necessary for the purpose of carrying out the obligations, and exercising specific rights, of

HCP or of an employee under employment law or for the assessment of your working capacity. If we wish to process your special personal data for any further purpose, we will seek your explicit consent to do so. You have the right to withdraw your consent to that processing at any time.

Sensitive data includes information relating to an employee's:

• physical and mental health;
• religious, philosophical or political beliefs;
• trade union membership;
• ethnic or racial origin;
• biometric or genetic data; and
• sexual orientation.

We will only process data relating to a candidate's criminal convictions or involvement in criminal proceedings when permitted by law, or where provided voluntarily by a candidate. A copy of the personal data HCP holds relating to you is available on request from the HR Department.

Security and Storage of Personal Data

We securely store your personal data in a centralised database, with controlled access to such database. Access to personal data (including special data) in both electronic and paper form is restricted to members of the HR Department and employees who have a legitimate and justifiable reason to view such data.

Data Retention

A candidate's data will be retained to the extent necessary to enable HCP to comply with any legal obligations or for the exercise or defence of legal claims following the application process. Unsuccessful candidates' personal data will be stored for 12 months then destroyed in accordance with our legal obligations.

Candidate Responsibilities

You should use all reasonable endeavours to keep us informed of any changes to your personal and special personal data. If you become aware of a data breach or a potential data breach in respect of personal data please report the matter immediately to the Data Privacy Representative at dpr@hoegh.co.uk.

Your Data Rights

You have several rights in relation to your personal data. You have a right to:

• access a copy of your personal data held by HCP;
• request rectification of your personal data if it inaccurate or incomplete;
• request erasure of your personal data in certain circumstances;
• restrict our use of your personal data in certain circumstances;
• move (or port) personal data which you have given us to process on the basis of your consent; and
• object to the processing of your data where our legal basis for processing your data is our legitimate interests.

However, these rights may not be exercised in certain circumstances, such as when the processing of a candidate's data is necessary to comply with a legal obligation or for the exercise or defence of legal claims. If you wish to exercise any of your rights in this regard please contact the HR Department. We will respond to your request in writing, or orally if requested, as soon as practicable and in any event not more than within one month after of receipt of your request. We may request proof of identification to verify your request.

Complaints

You have the right to lodge a complaint with the UK's Information Commissioner's Office if you are unhappy with how your personal data is being handled.

Further Information

If you require any further clarification regarding this Privacy Notice, please contact the Data Privacy Representative at dpr@hoegh.co.uk.