PRIVACY NOTICE FOR JOB APPLICANTS

1. Background

Nordic Capital[1] respects your privacy and is committed to protecting your personal data. This privacy notice (the “Privacy Notice”) will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you when you apply for a job position with Nordic Capital.

Nordic Capital Services AB is responsible for recruitment within all Nordic Capital entities. The recruiting Nordic Capital entity is the data controller for the recruitment process, while Nordic Capital Services AB is a data processor processing personal data on behalf of the recruiting Nordic Capital entity. Nordic Capital, including both the recruiting Nordic Capital entity and Nordic Capital Services AB, has a joint contact point for any questions relating to the processing of your personal data in connection with your job application for a job position with Nordic Capital (see contact information below).

We respect your right to privacy and to the protection of your personal data. The purpose of this Privacy Notice is to explain how we collect and use personal data in connection with your job application. Personal data means any information identifying you (either by itself or when it is combined with other information).

1. Where does nordic Capital collect your personal data from?

We collect personal data either directly from you or from a recruitment agency which you have been in contact with. If you apply for a position with the “Apply with LinkedIn” plugin or if you use the “Connect with Facebook” plugin, we receive personal data about you from your respective profile.

The recruitment agency, which we may collaborate with, is solely responsible for its processing of your personal data including the collection of personal data from you and/or other sources and for the transfer of your personal data to us. Please refer to the relevant recruitment agency’s Privacy Notice for further information regarding its processing of your personal data.

Nordic Capital is responsible for the processing of personal data when we have received personal data about you and process such data in the context of our own recruitment process which is administrated on our recruitment platform or another communication platform such as email.

Further, the current employees of Nordic Capital have the possibility to refer or recommend potential candidates on our recruitment platform and therefore we may receive certain personal data about you from our current employees.

We will limit the collection and processing of personal data to information which is necessary to achieve one or more purposes of processing as identified in this Privacy Notice.

1. How does Nordic Capital process your personal data?

Nordic Capital processes your personal data for the following purposes:

1. To administrate the process of reviewing job applications and selecting relevant candidates for a given position or spontaneous job applications.
2. To interview and select candidate to be offered the position.
3. To conduct personality and intelligence tests in order to provide measurable insights about a candidate and thus supporting Nordic Capital to offer the position to the most suitable candidate for a given position.
4. To gather references for relevant candidates.
5. To share your personal data with our background screening provider and to review the information provided by the background screening provider in their report for the purposes of concluding that there are no obstacles for the recruitment.
6. To draft employment agreement that will be concluded if you are hired.
7. To save your job application in order to be able to contact you if a relevant position is available in the future, if you have opted in for such processing.
8. To handle potential claims relating to the recruitment process (e.g. discrimination claims).

Below you can find more information about our processing of your personal data in relation to our purposes of processing:

Purpose (1): To administrate the process of reviewing job applications and selecting relevant candidates for a given position or spontaneous job applications.

Categories of personal data:

• Contact details (e.g. name, address, email and telephone number),
• Personal data included in the documentation related to a job application, for example information which is included in the CV and cover letter (e.g., information regarding prior working experience and education, picture if included).

What we do:

We collect, store and review your application provided by you or by a recruitment agency. We use our recruitment platform Teamtailor for these purposes.

The provision of your personal data is necessary for us to evaluate whether or not you are suitable for the advertised position. If you do not provide us with your personal data, we will not be able to include you in the recruitment process.

Legal basis:

Legitimate interest.

Nordic Capital has a legitimate interest in administrating the recruitment process and reviewing you job application for a given position as well as spontaneous job applications. Since you have submitted your job application directly to us or through a recruitment agency, we consider your interests to be consistent with our interest in processing necessary personal data relating to the job application. Hence, Nordic Capital’s interests outweighs your interest with regards to your rights to privacy.

Retention period:

Rejected job applications are saved for this purpose until the recruitment process is concluded.

Please see purpose 7 for the applicable retention period if you opt-in that we save your application for potential future job positions (by opting in for the “Connect” function on our recruitment platform).

The retention period for applications which are considered for a job position (advertised job position or spontaneous application), please see purpose 2.

Your rights:

You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.

You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.

As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.

Information about what these rights entail in practice and how you can exercise your rights is found in Section 6 of this privacy notice.

Purpose (2): To interview and select a candidate to be offered a position at Nordic Capital.

Categories of personal data:

• Contact details (e.g. name, address, email and telephone number),
• Personal data included in the documentation related to a job application, for example information which is included in the CV and cover letter (e.g. information regarding prior working experience and education, picture if included) and
• Notes from interviews with you.

What we do:

Nordic Capital will select some job applicants to be interviewed. In such case Nordic Capital may internally share your personal information with those persons involved in the recruitment process.

The provision of your personal data is necessary for us to evaluate whether or not you are suitable for a given position. If you do not provide us with your personal data, we will not be able to include you in the recruitment process.

Legal basis:

Legitimate interest.

Nordic Capital has a legitimate interest in processing personal data which is necessary to interview and select a candidate to be offered a position at Nordic Capital. Since you have expressed your interest in being considered for a position and accepted an invite to an interview, we consider your interests to be consistent with our interest in processing necessary personal data for this purpose. Hence, Nordic Capital’s interests outweighs your interest with regards to your rights to privacy.

Retention period:

The personal data will be retained until the recruitment process is concluded.

After a recruitment process is concluded, the relevant personal data is archived for a period of 2 years which entails that only persons with specific authorization are able to access the personal data. Please see purpose 8 for more information about processing of personal data for the purposes of handling potential claims relating to the recruitment process (e.g. discrimination claims).

Please see purpose 7 for the applicable retention period if you opt-in that we save your application for potential future vacancies.

Your rights:

You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.

You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.

As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.

Information about what these rights entail in practice and how you can exercise your rights is found in Section 6 of this privacy notice.

Purpose (3): To conduct personality and intelligence tests in order to provide measurable insights about a candidate and thus supporting Nordic Capital to offer the position to the most suitable candidate for a given position.

Categories of personal data:

• Contact details (e.g. name, address, email and telephone number),
• City of residence,
• CV and
• A report consisting of results and feedback from a personality test, test of logical thinking, a performance-based personality test, and a structured interview with the candidate conducted by the provider of the intelligence and personality test.

What we do:

Nordic Capital engages an external provider for conducting intelligence and personality tests. Nordic Capital will provide information about you to the provider which will then contact you for relevant tests and if applicable an interview. Nordic Capital will then receive a report of the tests which will be used as material for the recruitment decision.

The provision of your personal data is necessary for us to evaluate whether or not you are suitable for the advertised position. If you do not provide us with your personal data, we will not be able to include you in the recruitment process.

Legal basis:

Legitimate interest.

Nordic Capital has a legitimate interest in processing personal data which is necessary to gain measurable insights about candidates and thus supporting Nordic Capital to offer the position to the most suitable candidate. Since you have expressed your continued interest for a position at Nordic Capital, we consider your interests to be consistent with our interest in processing necessary personal data for this purpose. Hence, Nordic Capital’s interests outweighs your interest with regards to your rights to privacy.

Retention period:

The personal data will be retained until the recruitment process is concluded.

After a recruitment process is concluded, the relevant personal data is archived for a period of two years which entails that only persons with specific authorization are able to access the personal data. Please see purpose 8 for more information about processing of personal data for the purposes of handling potential claims relating to the recruitment process (e.g. discrimination claims).

Please see purpose 7 for the applicable retention period if you opt-in that we save your application for potential future vacancies.

Your rights:

You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.

You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.

As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.

Information about what these rights entail in practice and how you can exercise your rights is found in Section 6 of this privacy notice.

Purpose (4): To gather references for relevant candidates.

Categories of personal data:

• Contact details of the references provided by the candidate.
• CV and cover letter.
• Notes regarding the candidate.
• Notes from the interview with the reference person.

What we do:

We gather references for relevant candidates by contacting persons indicated by the candidate. CV, cover letter and notes taken during the recruitment process may be consulted in connection with the communication with the reference person. We may take notes about the conversation with the reference person.

The provision of your personal data is necessary for us to evaluate whether or not you are suitable for the advertised position. If you do not provide us with your personal data, we will not be able to include you in the recruitment process.

Legal basis:

Legitimate interest.

Nordic Capital has a legitimate interest in processing personal data which is necessary to receive insights about your previous experience from persons you have indicated as reference persons.

Since you have expressed your continued interest for a position at Nordic Capital, we consider your interests to be consistent with our interest in processing necessary personal data for this purpose. Hence, Nordic Capital’s interests outweighs your interest with regards to your rights to privacy.

Retention period:

The personal data will be retained until the recruitment process is concluded.

After a recruitment process is concluded, the relevant personal data is archived for a period of two years which entails that only persons with specific authorization are able to access the personal data. Please see purpose 8 for more information about processing of personal data for the purposes of handling potential claims relating to the recruitment process (e.g. discrimination claims).

Please see purpose 7 for the applicable retention period if you opt-in that we save your application for potential future vacancies.

Your rights:

You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.

You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.

As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.

Information about what these rights entail in practice and how you can exercise your rights is found in Section 6 of this privacy notice.

Purpose (5): To share your personal data with our background screening provider and to review the information provided by the background screening provider in their report for the purposes of concluding that there are no obstacles for the recruitment.

Categories of personal data:

• Name, email address, potential title at Nordic Capital,
• Information included in your CV,
• Personal number,
• A report consisting of the background screening provider’s investigation, which is based on information acquired by the service provider, including information about you and your partner’s personalia, private economy, business engagements, legal proceedings and information gathered from media and internet.

What we do:

We provide your personal data to a provider of background screenings who conducts such screenings as a data controller. Please refer to our provider’s privacy notice for further information.

We receive a report consisting of the background screening provider’s investigation. In case of any matches in the criminal records of the candidate, the provider will only orally inform Nordic Capital about a match and this information is not further processed by Nordic Capital.

The provision of your personal data is necessary for us to evaluate whether or not you are suitable for the advertised position. If you do not provide us with your personal data, we will not be able to include you in the recruitment process.

Legal basis:

Legitimate interest.

Nordic Capital operates in a sensitive and to large extent regulated industry where it is of utmost importance that our employees who have access to confidential information can be trusted with such information. For this reason, it is necessary to conduct background screenings of both prospective candidates as well as their partners. We consider that this interest overweighs your right to privacy as the data processing is necessary for Nordic Capital to be able to ensure that the sensitive information is not abused by Nordic Capital’s employees or their partners.

Retention period:

The personal data will be retained until the recruitment process is concluded.

After a recruitment process is concluded, the relevant personal data is archived for a period of 2 years which entails that only persons with specific authorization are able to access the personal data. Please see purpose 8 for more information about processing of personal data for the purposes of handling potential claims relating to the recruitment process (e.g. discrimination claims).

Please see purpose 7 for the applicable retention period if you opt-in that we save your application for potential future vacancies.

Your rights:

You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.

You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.

As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.

Information about what these rights entail in practice and how you can exercise your rights is found in Section 6 of this privacy notice.

Purpose (6): To draft employment agreement that will be concluded if you are hired.

Categories of personal data:

• Name, personal number, mobile phone number, address and
• Information about salary.

What we do:

We will collect information which is necessary to draft an employment agreement with you.

The provision of your personal data is necessary for us to conclude the employment agreement with you for the advertised position. If you do not provide us with your personal data, we will not be able to enter into an employment agreement with you.

Legal basis:

Performance of contract.

Retention period:

The personal data will be retained as long as you are employed at Nordic Capital and after that to the extent it is necessary for any of the purposes provided for in the privacy notice which you will receive when entering into an employment agreement with Nordic Capital.

Your rights:

You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.

You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.

As the legal basis of this data processing is performance of a contract, you have the right to data portability.

Information about what these rights entail in practice and how you can exercise your rights is found in Section 6 of this privacy notice.

Purpose (7): To save your job application in order to be able to contact you if a relevant position is available in the future, if you have opted in for such processing.

Categories of personal data:

• Contact details (e.g. name, address, email and telephone number) and
• Personal data included in the documentation related to a job application, for example information which is included in the CV and cover letter (e.g. information regarding prior working experience and education, picture if included).

What we do:

If you are not selected for a given position at Nordic Capital, you may opt-in that we save the documentation related to your application to be considered in future recruitment processes.

Legal basis:

Consent.

Retention period:

You may always withdraw your consent for this purpose of processing and in such case, we will erase your personal data, which is not necessary for any other purpose such as purpose 9, as soon as we have handled your withdrawal.

Your rights:

You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.

You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.

You have always right to withdraw your consent at any time which entails that we will cease processing of personal data for this purpose. The withdrawal does not affect the legality of processing before your withdrawal.

As the legal basis of this data processing is consent, you have the right to data portability.

Information about what these rights entail in practice and how you can exercise your rights is found in Section 6 of this privacy notice.

Purpose (8): To handle potential claims relating to the recruitment process (e.g. discrimination claims)

Categories of personal data:

• Contact information,
• Personal data included in the documentation related to a job application, that is information which is included in your CV and cover letter (e.g. information regarding prior working experience and education, picture if included),
• Your results in the intelligence and personality tests,
• Your results in the background control,
• Notes from interviews with you and
• Notes from interviews with your references.

What we do:

After a concluded recruitment process, we will archive your personal data which has been relevant for the recruitment process. The access to these personal data is heavily restricted and may be accessed by authorized persons only in case it is necessary to handle concrete claims relating to the recruitment process.

Legal basis:

Legitimate interest.

Nordic Capital has a legitimate interest in being able to handle and defend themselves in claims relating to a recruitment process. We consider that this interest overweighs your right to privacy as the data processing is necessary for Nordic Capital to be able to handle and investigate any claims you may present.

Retention period:

Your personal data will be stored in archived form for this purpose for two years from the conclusion of the recruitment process.

Your rights:

You always have the right to request access to your personal data and that we rectify your personal data if it is incorrect.

You may also have right to request that we restrict the processing of your personal data and that we erase personal data concerning you.

As the legal basis of this data processing is legitimate interest, you have the right to object to processing of your personal data.

Information about what these rights entail in practice and how you can exercise your rights is found in Section 6 of this privacy notice.

1. How does Nordic Capital keep your personal data secure?

We have implemented appropriate technical and organisational measures to protect your personal data against loss, accidental and unlawful access and unauthorized disclosure of your personal data. The number of persons with access to your personal data is limited. Only individuals that need to process your personal data in accordance with the purposes above will have access to your personal data.

1. Data retention- how long do we keep your personal data?

Your personal data will only be stored as long as the purpose for which it is processed exists and as long as permitted or required under Swedish law. We have provided more detailed information about the retention periods for each data processing in the table in Section 7.

If we process your personal data after the recruitment process is completed for the purposes of drafting and administering your employment agreements if you are hired, your personal data will be stored in accordance with our privacy notice for employees which you will be provided with when we conclude your employment agreement.

When we process your personal data based on your consent, we will stop the processing if you withdraw your consent.

1. What are your rights regarding your personal data?

You have certain rights in relation to the personal data Nordic Capital processes about you. Those rights and how and when you can exercise them are set out in the table below. If you would like to exercise your rights or have any questions, please contact Nordic Capital’s Data Protection Manager at dataprotection@nordiccapital.com.

Rights/When do I have this right?

Access – You have a right to get access to the personal data we process about you (also referred to as a “Data Subject Access Request” or “D-SAR”).

This means that you have the right to be provided, at no cost, information about which personal data we are processing about you.

You always have the right to request access to your personal data.

Rectification – You have the right to request that we will correct, anonymize, delete or complement personal data, which is inaccurate, incomplete or misleading. You have also the right to complete any incomplete personal data if something relevant is missing.

You always have the right to request rectification of your personal data.

We will take all reasonable measures possible to notify everyone who has received personal data as stated in Section 7 if we have rectified your personal data after you have requested us to do so.

Erasure – You have the right to request that we delete your personal data if there is no compelling reason for us to continue processing the personal data. Personal data should therefore be erased if:

• It is no longer needed for the purpose for which we collected it,
• We process your personal data on consent provided by you and you withdraw your consent,
• You object to us processing your personal data based on a legitimate interest assessment and we have no compelling interest that overrides your interests and rights,
• We have processed the personal data unlawfully (without an appropriate legal basis) or
• We have a legal obligation to erase personal data.

However, there may be legal requirements or other compelling reasons that prevent us from immediately erasing your personal data. We will then cease processing of your personal data for purposes other than processing which is in compliance with the law or where there are no compelling legitimate grounds for doing so.

You have the right to request erasure if one of the conditions described in the column on the left is fulfilled.

We will take all reasonable measures possible to notify everyone who has received personal data as stated in Section 7 if we have erased your personal data after you have requested us to do so.

Restriction – You have a right to request us to restrict the processing of your personal data when:

• You consider your data to be inaccurate and you have requested rectification as defined above, while we establish the accuracy of the personal data,
• The processing is unlawful and you do not want the data to be erased but want the processing be restricted instead,
• We do no longer, as a data controller, need the personal data for our processing purposes, but you need them to establish, exercise or defend a legal claim, or
• You have objected to processing, while waiting for us to consider whether our legitimate interests override yours.

Where processing has been restricted, we will only process your personal data for the purposes or storing your personal data or (if applicable) to establish, exercise or defend legal claims or for the protection of the rights or another natural or legal person or for reasons of important public interest of the Union or of a Member State unless you have consented for the processing.

You have the right to request restriction if one of the conditions described in the column on the left is fulfilled.

We will take all reasonable measures possible to notify everyone who has received personal data as stated in Section 7 if we have restricted the processing of your personal data after you have requested us to do so.

Data portability – You have the right to data portability. This means the right to receive your personal data in a structured, commonly used and machine-readable format, and to request that these data are transferred to another personal data controller.

The right to data portability only applies when the processing is being carried out by automated means and our lawful basis for processing your personal data is the performance of a contract between you and us or your consent. Your right to data portability applies thus when we process your personal data for the following purposes:

• (6) To draft employment agreements that will be concluded if you are hired.
• (7) To save your job application in order to be able to contact you if a relevant position is available in the future, if you have opted in for such processing.

Objection – You have a right to object to the processing of your personal data if our processing is based upon our legitimate interest. If you object to such processing, we will only continue to process your data if we can demonstrate that we have compelling reasons for doing so which overrides your interests.

You have the right to object when we process your personal data on the basis of our legitimate interest, i.e. when we are processing your personal data for the following purposes:

• (1) To administrate the process of reviewing job applications and selecting relevant candidates for a given position or spontaneous job applications.
• (2) To interview and select a candidate to be offered the position.
• (3) To conduct personality and intelligence tests in order to provide measurable insights about a candidate and thus supporting Nordic Capital to offer the position to the most suitable candidate for a given position.
• (4) To gather references for relevant candidates.

• (5) To share your personal data with our background screening provider and to review the information provided by the background screening provider in their report for the purposes of concluding that there are no obstacles for the recruitment.
• (8) To handle potential claims relating to the recruitment process (e.g. discrimination claims).

Withdraw consent – You have a right to withdraw your consent at any time by contacting Nordic Capital (details above).

You have the right to withdraw your consent when the legal basis for our processing is your consent:

• (7) To save your job application in order to be able to contact you if a relevant position is available in the future, if you have opted in for such processing.

Lodge complaints – You have a right to lodge a complaint with the data protection authority.

If you wish to lodge a complaint on how we have handled your personal data, you can contact us in accordance with the contact details above. We hope that we can address any concerns you may have, but you always have the right to contact the data protection authority (or equivalent) in your relevant country.

Sweden: https://www.imy.se/

Denmark: https://www.datatilsynet.dk

UK: https://ico.org.uk/

Germany: https://www.ldi.nrw.de/mainmenu

Finland: https://tietosuoja.fi/en/home

Norway: https://www.datatilsynet.no/en/

You always have the right to lodge a complaint with the data protection authority in your country of residence.

1. How does Nordic Capital share your personal data?

We will share your personal data with companies within the Nordic Capital Group, for the purpose of recruitment to different entities within the Nordic Capital Group. Each Nordic Capital entity recruiting for a position is a data controller for its processing personal data and processes your personal data in accordance with this privacy notice. Nordic Capital Services AB which is a company in the Nordic Capital Group provides recruitment services to the different entities within the Nordic Capital Group and acts as a data processor to the recruiting Nordic Capital entity.

We use the recruitment platform Teamtailor, acting as a sub-processor to Nordic Capital Services AB and will thus only process your personal data according to Nordic Capital Services AB’s instructions. Our Teamtailor platform includes “Apply with LinkedIn” and “Connect with Facebook” plugins. These plugins entail that LinkedIn and Meta receive information about your visits on the platform. See LinkedIn’s and Meta’s privacy policies for further information regarding its processing of personal data.

We use independent third-party providers for certain parts of the recruitment process which entails that we share your personal data with such service providers. We share your personal data (name, email address and mobile phone number) with Omino for the purposes of conducting personality and intelligence tests. Omino conducts the personality and intelligence tests independently, without any influence from Nordic Capital, which entails that Omino processes your personal data as a data controller. See Omino’s privacy policy for further information regarding its processing of personal data.

We also share your personal data (name, email address, CV and personal number, if received by Nordic Capital) to the service provider 2Secure, for the purposes of conducting background controls. 2Secure conducts the background control independently, without any influence from Nordic Capital, which entails that 2Secure processes your personal data as a data controller. See 2Secure’s privacy policy for further information regarding its processing of personal data.

1. Transferring your personal data to third countries

Depending on which Nordic Capital entity is recruiting, there are some situations where personal data may be shared between a Nordic Capital entity outside of the EU/EEA (a third country), primarily in the United Kingdom, Jersey, United States or South Korea, and Nordic Capital Services AB, established in Sweden, which is the entity responsible for the recruitment process. The personal data is in such cases only shared for the purposes of recruiting candidates to Nordic Capital entities established in a third country. The Nordic Capital entities outside of the EU/EEA are not subject to the GDPR and thus there is no transfer of personal data where Nordic Capital Services AB established in Sweden returns personal data of the candidates to the relevant recruiting Nordic Capital entity outside of the EU/EEA.

Nordic Capital Services AB, which is a processor to Nordic Capital AB, only uses sub-processors which are established within the EU/EEA.

1. Changes to the Privacy Notice

If any changes are made concerning the processing of your personal data, we will inform you by publishing an updated version of this privacy notice on the recruitment platform.

Effective date
September 2021, Version 1
June 2022, Version 2

[1] The term Nordic Capital includes Nordic Capital AB, Nordic Capital Services AB, NC Advisory AB, NC Advisory A/S, NC Advisory Oy, NC Advisory AS, NC Advisory GmbH, NC Advisory (UK) LLP, Nordic Capital Investment Advisory AB, Nordic Capital Investment Advisory A/S, Nordic Capital Investment Advisory Oy, Nordic Capital Investment Advisory AS, Nordic Capital Investment Advisory GmbH, Nordic Capital Investment Advisory LLP, Nordic Capital Investment Advisory LLC, Nordic Capital Operations Advisory AB (including its Danish branch) and Nordic Capital Operations Advisory Ltd.