Recruitment Privacy Notice

For the purpose of this Privacy Notice:

• “Data Protection Law” means data protection law applicable in Luxembourg, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) and the Law of 1 August 2018 on the organisation of the CNPD and the general data protection framework;
• “Personal Data”, “Processing”, “Purposes”, “Controller”, “Processor”, “Data Subject”, “Recipient”, “Appropriate Safeguards” and “Supervisory Authority” shall have the meaning ascribed to them in the GDPR;
• “we”, “us” and “our” shall refer to the Bank; and
• “you” and “your” shall refer to the recruitment candidate.

2. Controller Identity and Contact Details

We are:
FundBank (Europe) S.A.
13 Rue Jean Fischbach,
3372 Leudelange,
Luxembourg
Email: dataprivacy_lux@fundbank.com

3. Personal Data We Process

We collect and process personal data relating to recruitment candidates, which may include:

• Identification and contact details (e.g. name, address, email, phone number).
• CV/resume, cover letter, education history, employment history, qualifications.
• Interview notes and assessment results.
• References and background check results.
• Extract of criminal records.
• Documents required under immigration laws (such as citizenship, passport or national ID, residency or work permit).
• Professional preferences: your salary expectations, job roles preferences, willingness to relocate and other information you decide to share with the Bank in the course of the recruitment or placement process.
• Technical data: if applying through our recruitment website, your IP address; your browser type and language; access logs.
• Your image as registered on our CCTV system upon attendance of an interview at our premises.

We collect personal data directly from you, from recruitment agencies, from professional networking platforms (e.g. LinkedIn), and from referees or background check providers. Please note that in case you provide us with the personal data of another person (such as referees), you are responsible for ensuring that this person is made aware of the content of this privacy notice and that the person has given you his/her consent for sharing his/her personal data with the Bank and for getting contacted by the Bank for the purpose of this recruitment.

As part of the interview process, we may use the Microsoft Teams transcription feature to help improve the accuracy of interview note-taking. This tool generates a written transcript of the discussion. The transcription is used solely to support the assessment process and is not shared externally. We always seek the candidate’s explicit consent before activating the feature. Both the audio and transcript are deleted within 7 days after the interview. No copy is stored or retained beyond this period.

As part of the recruitment process and information gathered, we will not ask you to provide any special category of personal data (e.g. race or ethnicity, religious or philosophical belief, political opinions, trade union membership, sexual orientation, genetic data, health data). Please do not share this information with us unless necessary and relevant to consider for the position (e.g. you have disability).

4. Purpose of Processing and Legal Basis

We use the personal data you provide:

1. 1. or the fulfilment of contractual obligations (Art. 6 para.1b GDPR)

These processing activities are necessary for the establishment of the contract and include:

• • • • To assess your application and qualifications for the role.
      • To schedule and conduct interviews and assessments.
      • To communicate with you throughout the recruitment process.
      • To prepare offer letters and employment contracts if your application is successful.

1. 2. due to legal requirements (Art. 6 para. 1c GDPR)

These activities are required to comply with legal obligations under Luxembourgish or EU employment and regulatory law and include:

• • • • To verify your identity and right to work in Luxembourg.
      • To conduct background checks required for regulated roles (e.g. in financial services).
      • To comply with anti-discrimination and equal opportunity obligations.
      • To retain recruitment records in accordance with applicable labour and data protection laws.

1. 3. in the context of our legitimate interest not overriding your interests or fundamental rights and freedoms (Art. 6 para. 1f GDPR)

Processing is based on the bank’s legitimate interests, provided these do not override the interests or rights of candidates and include:

• • • • To evaluate and improve our recruitment processes.
      • To prevent fraud and ensure the integrity of our hiring practices.
      • To ensure IT, data and physical security during the recruitment process.

1. 4. based on your consent (Art. 6 para. 1a GDPR)

Used when none of the other lawful bases apply, particularly for optional or non-essential processing and include:

• • • • To retain (up to 24 months) your profile information (after recruitment concluded and if your candidacy was not retained) and to contact you in the case of other current or future suitable openings matching your profile.

5. Sharing Your Personal Data

Set out below are the parties with which FundBank may share personal data:

• Internal HR and hiring managers.
• Background check providers and referees.
• Regulatory, law enforcement, judicial, or other competent authorities, and other parties (such as in response to a court order) under lawful request or legal obligation.
• FundBank affiliates or members of our corporate group or under common majority ownership with us involved in the recruitment process.
• Our outsourced service providers where involved in processing personal data on our behalf (i.e., acts as data processor), including, for example, our information technology service providers. Data shared is limited to what is required for the execution of the service.
• When we believe it is appropriate to do so to investigate, prevent, or take action regarding suspected illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our internal policies, or violations this Privacy Policy, or as evidence in litigation in which we are involved.

Each data sharing is thoroughly assessed to ensure adequate mechanisms are implemented prior to data disclosure i.e. establishment of employment contract, use of consent, implementation of data processing agreements with service providers, etc.

6. Third Country Transfer

Recipients referred to in previous section can be located outside of Luxembourg and the European Economic Area. In those cases, except where the relevant country has been determined to provide an adequate level of protection, we require such recipients to comply with appropriate measures designed to protect personal data including use of standard contractual clauses where applicable.

7. Data Security

FundBank has implemented a comprehensive information security framework consisting of strategies, policies, procedures, IT protocols and tools to duly and adequately protect Bank information assets including personal data and IT assets including IT systems processing personal data. We have also put in place procedures to deal with any suspected data security breach and will notify you and competent data protection authority of a suspected breach when regulatory conditions are met.

8. Retention of Personal Data

FundBank will retain your personal data for up to 24 months after the recruitment process concludes following your explicit consent, unless a longer retention period is required by law.

9. Your Rights

You have the following rights regarding your personal data (under certain circumstances, and without prejudice to applicable laws and regulations):

• The right to access your personal data.
• The right to correct any inaccurate or incomplete personal data.
• The right to request the deletion of your personal data.
• The right to restrict the processing of your personal data.
• The right to object to the processing of your personal data.
• The right to data portability.
• The right to withdraw your consent at any time (only where consent is used as legal basis).

To exercise these rights, please contact us at dataprivacy_lux@fundbank.com.

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights) to the extent the request is clearly founded and not excessive.

You also have the right to lodge a complaint with the Data Protection Authority at: https://cnpd.public.lu/en/particuliers/faire-valoir/formulaire-plainte.html

10. Changes to This Privacy Notice

We may update this Privacy Notice from time to time. If we make any material changes to reflect changes to our practices or for other operational, legal, or regulatory reasons, we will bring this to your attention and may do so by any means such as by e-mail or via our recruitment website and update the “Last Updated” date at the bottom of this Privacy Notice. A copy of the latest version may be requested from dataprivacy_lux@fundbank.com at any time.

11. Contact Us

If you have any questions about this Privacy Notice, please contact us. Please refer to contact details under section 2.

Last Updated: June 3, 2025