Trax Global Job Candidate and Recruitment Privacy Notice

Effective from 12th August 2023

Here at Trax we are fully committed to being open and transparent with you, our job
candidates and applicants, about how we use your personal information throughout the
recruitment and application process. We recognize and value the importance of ensuring any
personal information we collect, use, store and share (‘process’) about you is done in a way that
protects your privacy rights and meets our legal requirements.
This Privacy Notice explains in detail how we process your personal information. It applies to all
individuals that apply for a job at Trax and that go through our recruitment process.

Where can I access a copy of this Privacy Notice?

You can access and download a copy of this Privacy Notice from the Careers page of our
website here.

Who is Trax
Where we refer to ‘Trax’ in this Privacy Notice, we are referring to the Trax group of companies
and the separate business entities that sit under Trax Ltd (this includes the business entities
that sit under Trax Technology Solutions PTE. Ltd, BET Information Systems Inc. and Shopkick
Management Company Inc.).
The data controller for your personal data will be the Trax corporate entity that you apply to for
a job and that is responsible for recruiting you.

Some terms we use in this Privacy Notice explained:

The term “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code §§
1798.100 et. Seq. “CPRA” means the California Privacy Rights Act of 2020 as it amends and
extends the provisions of the CCPA.

The term “data controller” means the Trax entity that alone or jointly with others, makes the
decisions about why and how your personal information is collected, used, stored and shared
by Trax.
The term “job candidate” means all individuals that show an interest in, apply for or otherwise
contact us about roles and opportunities at Trax.
The term “EU Standard Contractual Clauses” mean the Standard Contractual Clauses set
out in the Annex of Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
These are a set of ‘rules’ or ‘safeguards’ that protect the personal information of EU
persons when it is transferred outside of the EU to countries without a similar or
‘adequate’ level of data protection.

The term “GDPR” means the Regulation (EU) 2016/679 of the European Parliament and of the
Council of 27 April 2016 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive 95/46/EC
(‘General Data Protection Regulation’).
The term “personal information” means any information about or that identifies you as an
individual.
The term “sensitive personal information” means personal information about physical or
mental health, racial or ethnic origin, political or religious views, trade union membership,
sexual orientation, genetic data, biometric information, the commission or alleged commission
of a crime or related proceedings, personal data of children, and also includes in some
countries also includes, financial information, personal identification numbers, exact
geolocation and contents of private correspondence. Sensitive personal information is usually
subject to stricter controls and protections.
The term "UK GDPR" means the Data Protection Act 2018, as well as the GDPR as it forms part
of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the
European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and
Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419).
The term “UK Standard Contractual Clauses” means the International Data Transfer Addendum
to the EU Commission Standard Contractual Clauses as issued by the UK Information
Commissioner’s Office under S119A(1) of the UK Data Protection Act 2018. These are a set of
‘rules’ or ‘safeguards’ that protect the personal information of UK persons when it is
transferred outside of the UK to countries without a similar or ‘adequate’ level of data
protection.
If you have any questions having read this Privacy Policy about how Trax uses your personal
information please contact: [email protected]

This Privacy Policy is split into the following sections:

1. How do we collect your personal information?
2. What personal information do we process about you and why?
3. What lawful basis do we use for processing your personal information (for Trax job
candidates based in the EU/EEA and the UK).
 4. How long do we keep your personal information for?
5. Who do we share your personal information with?
6. International operations and transfers out of your home jurisdiction.
7. The EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy
Framework – how do we comply with it and what are your rights?
8. How can you request access to your personal information?
9. What other rights do you have over your personal information and how can you
exercise them?
10. Revisions to this Privacy Notice.
11. Any further questions?

1. How do we collect your personal information?

We collect personal information about you from the following sources:

• Directly from information you provide to us.

• From previous employers.
• From outsourcing and employment agencies and intern referral agencies.
• From referees, either internal or external.
• From background screening providers (where applicable).
• From immigration and other similar governmental and public authorities.
• From background checking agencies in certain jurisdictions.
• From service providers and third parties that manage recruitment activities on our
behalf such as recruitment and matching services, job applicant management providers,
recruitment and HR management platforms, travel booking providers, insurance
providers and other administration services.
• From occupational health or similar health providers.
• From information we collect when you visit one of our websites.

2. What personal information do we process about you and why?

We use the following information to enable you to apply and interview for roles and
opportunities with us and to manage our recruitment processes.

• Personal contact details and identification information such as your name, address,
contact telephone numbers (landline and mobile), personal email addresses and
photograph.
• Your date of birth and social security, national insurance or national identity number (or
similar).

• A copy of your passport or similar photographic identification and / or proof of address

documents, immigration status and documentation, visas and work permits.

• Employment and education history including your qualifications, job application,

employment references, information provided on your CV or resume, reference letters,
right to work information and details of any criminal convictions (in countries where we
are legally required to collect this information).

• Security clearance details including basic checks and higher security clearance details
according to your job (where we are legally required to collect this information).

• Your responses to any feedback surveys we sent to you if this data is not anonymized.

• Voicemails, e-mails, call and video recordings, correspondence, documents, and other
information you share with us as part of the recruitment process.

• Health and wellbeing information either declared by you or obtained from health
checks, eye examinations, occupational health referrals and reports, sick leave forms,
health management questionnaires or fit notes i.e. Statement of Fitness for Work from
your GP or hospital.

• Information relating to your ethnicity, race, religion, disability, sexual orientation and
gender identification to monitor the diversity of our workforce (this information is
generally only collected on a voluntary basis or in certain countries where there is a
legal requirement to collect it).

• Information available on your public social media or networking sites such as LinkedIn.

• Information required for us to arrange any travel, accommodation or meals that are
required as part of the recruitment process.

• Information that we collect via our use of cookies and similar technologies when you
visit any of our websites.
 • Information collected from CCTV or security cameras if you visit any of our offices.

• We may use your data to create aggregated statistical or inferred data to further
develop and improve our recruitment processes.

If we ask you to provide any other personal data not described above, then the personal data
we will ask you to provide, and the reasons why we ask you to provide it, will be made clear to
you at the point we collect it.

3. What lawful basis do we use for processing your personal information

(this information is appliable to Trax staff based in the EU/EEA and the UK
only).
If you are a job candidate in the EU/EEA or the UK, our legal basis for collecting and using the
personal information described above will depend on the personal information concerned and
the context in which we collect it. However, we will normally collect personal information from
you based on the following:

Purpose for collecting Lawful basis for collecting the Lawful basis for collecting
your personal personal information under the special category information
information GDPR and the UK GDPR under the GDPR and UK GDPR
Enabling individuals to • Processing is necessary in • Processing is necessary to
apply and interview for order to take steps at your enable us to meet our
roles and opportunities request prior to entering obligations in the field of
with Trax and to into an employment contract employment, social
manage our with you. security or social
recruitment processes • Processing is necessary to protection law.
meet a legal obligation • Processing is necessary
which we are subject to. for the purposes of
• Processing is in our preventive or
legitimate interests in order occupational medicine or
to recruit the best possible for the assessment of the
talent for our business and is working capacity of our
not overridden by your data employees.
protection interests and • Processing is necessary
fundamental rights and for the exercise or
freedoms. defence of legal claims.
 • Processing is undertaken • Processing is necessary
with your freely given for reasons of substantial
consent. public interest.
• Processing is undertaken
with your freely given,
explicit consent.

In certain cases, in order to comply with our business, legal and contractual obligations, Trax is
required to have access to and use certain personal information.
Therefore, in certain circumstances, if you do not provide us with the personal information we
request or if you ask that we stop processing your personal information, we may not be able to
begin or continue with recruiting you for one of our roles.
If you have questions about or need further information concerning the legal basis on which we
collect and use your personal data, please contact us at [email protected]

4. How long do we keep your personal information for?

We will keep your personal information for as long as is needed to carry out the purposes we’ve
described above, or as otherwise required by law.
Generally, this means we will keep job candidate information for the following periods:
1. Successful job candidates – we will store personal information relating to your
recruitment up to 6 months after making a job offer to you. We will then transfer any
personal information we require in order to meet our employee obligations to you into
your HR file. It will then be stored in line with our Employee Privacy Notice which will be
made available to you on joining the company.

2. Unsuccessful job candidates – we will store personal information relating to your job
application and recruitment for up to 6 months following our decision not to offer you a
position at Trax. We will then contact you and ask for your consent to store your
personal information for a further 2 years so that we may contact you about future,
suitable positions or roles that may be of interest to you.
Where we have no continuing legitimate business need to process your personal information,
we will either delete or anonymize it or, if this is not possible (for example, because your
personal information has been stored in backup archives), then we will securely store your
personal information and isolate it from any further processing until deletion is possible.
 5. Who do we share your personal information with?
We take care to allow your personal information to be accessed only by those who really need
it in order to perform their tasks and duties, and by third parties who have a legitimate purpose
for accessing it.
We may share your personal information with the following third parties for the purposes
outlined in Section 2 above, ‘What personal information do we process about you and why?’

• Other Trax group companies.

• Third parties such as government, federal, and other public agencies such as
immigration authorities where we have a legal requirement to do so.
• Third parties such as occupational health and health insurance providers and providers
that help undertake health and wellbeing checks for job candidates.
• Third party consultancy firms or other organizations that we engage to help deliver and
improve our recruitment services and processes.
• Service and solution providers and vendors who provide recruitment and related
services on our behalf - such as IT software and cloud providers, data analytics services
and IT and cyber security services.
• Employment agencies and intern agencies where they are providing Trax employees or
potential job candidates.
• Companies that manage flight, travel services and hotel bookings where required to
support individuals in attending interviews with us.
• With our external legal and compliance advisors.
• With public authorities in response to lawful requests made by those public authorities,
including to meet national security or law enforcement requirements.
We only share the minimum amount of personal information with our third parties, service
providers and vendors in order to meet the purposes outlined above.
If we go through a corporate sale, merger, reorganization, dissolution or similar event, personal
information we gather from you may be transferred in connection with such an event. Any
acquirer or successor of Trax may continue to use the information as described in this notice
provided that the acquirer or successor is bound by appropriate agreements or obligations and
may only use or disclose your personal information in a manner consistent with the use and
disclosure provisions of this notice, or unless you consent otherwise.
For job candidates based in California and subject to the CPPA and CPRA, we do not “sell” or
“share” (as these terms are defined by the CCPA and CPRA) your personal information with any
third parties.
 6. International operations and transfers out of your home jurisdiction
Your personal information may be collected, used, processed, stored or disclosed by us and our
vendors and service providers outside your home jurisdiction, including in the U.S, Singapore,
Israel and in some cases, other countries. These countries may have data protection laws that
are different to the laws of your country.
Trax only transfers personal information to another country, including within the Trax group of
companies, in accordance with applicable privacy laws, and provided there is adequate
protection in place for the information.
For transfers of your personal information within the Trax corporate group:

• Trax has in place an Intra Group Data Transfer Agreement which provides safeguards for
the transfer of personal data amongst its group entities based on the EU and UK
Standard Contractual Clauses. These require all group companies to protect personal
information from the EU/EEA and the UK in accordance with EU and UK data protection
law.
• Trax has implemented a Global Privacy Policy that requires all of Trax’s global entities to
apply a similar high standard of data privacy to any personal information they process.
• All personal information transferred from the EU, EEA or UK and received by Trax Retail
Inc. our US entity, is subject to the requirements and Principles of the EU-U.S. Data
Privacy Framework – see Section 7, ‘The EU-U.S. Data Privacy Framework and the UK
Extension to the EU-U.S. Data Privacy Framework’ below.
For transfers of your personal information to third parties:

• Trax has in place the required data privacy agreements, for example with our service
provider and vendors, unless we are able to use one of the ‘additional reasons for
transfer’ listed below (we only use these where they are allowed under local data
privacy law).
• For transfers of personal information from the EU, EEA and the UK, including onward
transfers, Trax relies on either:
a) the EU and UK Standard Contractual Clauses unless one of the ‘additional reasons for
transfer’ listed below applies. We have also undertaken additional transfer impact
assessments where necessary and applied any additional safeguards needed to
strengthen the protections offered by the EU Standard Contractual Clauses.
b) for transfers from the EU, EEA and the UK to our US entity, Trax Retail Inc., we rely
upon our participation in the EU-U.S. Data Privacy Framework (EU-U.S. DPF) for personal
information subject to this Framework - see Section 7, ‘The EU-U.S. Data Privacy
Framework and the UK Extension to the EU U.S. Data Privacy Framework’ below.
 ‘Additional reasons for transfer’ - may be used where the transfer is not regular, concerns
only a small number of individuals, is necessary for a compelling legitimate interest and we
have properly assessed the risks of such a transfer.
- We have your consent to make the data transfer;
- The transfer is necessary to perform our employment contract with you;
- The transfer is necessary for us to conclude or perform a contract in your interest
with another third party;
- The transfer is necessary for important reasons of public interest;
- The transfer is necessary for us to establish, exercise or defend legal claims;
- The transfer is necessary to protect your vital interests or those of another person
and where you are unable to give consent;
We will ensure your personal information is treated in accordance with this Privacy Notice and
Trax’s Global Privacy Policy wherever we process it. A copy of our Intra Group Data Transfer
Agreement and/or Standard Contractual Clauses can be provided by contacting:
[email protected]

7. The EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S.
Data Privacy Framework – how do we comply with it and what are your
rights?
Trax Retail Inc.’s compliance with the EU-U.S. Data Privacy Framework and the UK Extension
to the EU-U.S. Data Privacy Framework
Our US entity, Trax Retail Inc. participates in and adheres to the Principles of the EU-U.S. Data
Privacy Framework (“EU-US DPF”) and the UK Extension to the EU-U.S. Data Privacy Framework
(“UK Extension to the EU-US DPF”) regarding the collection, use and retention of personal
information from the European Union (“EU”), European Economic Area member countries
(“EEA”) and the United Kingdom (“UK”). We have certified with the Department of Commerce
that we adhere to the Data Privacy Framework Principles. If there is any conflict between the
terms in this Privacy Notice and the Data Privacy Framework or the Principles, the Data Privacy
Framework and Principles shall govern.
All personal information received from the EU, EEA or UK by Trax Retail Inc. is subject to Trax
Retail Inc.’s adherence with and to the Principles of the EU-U.S. DPF and the UK Extension to
the EU-US DPF.
To learn more about the Data Privacy Framework Principles, click here. To access the Data
Privacy Framework List and our certification, click here.
How to contact Trax Retail Inc. or otherwise make an enquiry or complaint about personal
information processed through the EU-U.S. Data Privacy Framework and the UK Extension to
the EU-U.S. Data Privacy Framework
In compliance with the EU-US DPF and the UK Extension to the EU-US DPF, Trax Retail, Inc.
commits to resolve DPF Principles-related complaints about the collection and use of your
personal information. EU, EEA and UK individuals with enquiries or complaints regarding our
handling of personal information received in reliance on the EU-US DPF and the UK Extension to
the EU-US DPF should first contact Trax’s Privacy Team at: [email protected]
Trax Retail, Inc. commits to cooperate and comply with the advice of the panel established by
the EU data protection authorities (“DPAs”), the UK Information Commissioner’s Office (“ICO”)
and the Gibraltar Regulatory Authority (“GRA”) with regard to unresolved complaints
concerning our handling of candidate’s personal information received in reliance on the EU-US
DPF and the UK Extension to the EU-US DPF in the context of the employment relationship.
Should there be any violations of the Principles that Trax Retail Inc. has not been able to
resolve, you can contact the relevant Data Protection Authority using the links below:
EU/EAA individuals
UK individuals
Gibraltar individuals
Individuals whose personal information is subject to the EU-US DPF (including the UK Extension
to the EU-US DPF) may have the possibility, under certain conditions, to invoke binding
arbitration for complaints relating to Trax Retail, Inc.’s compliance with the DPF Principles.
Further information can be found here or by contacting Trax’s Privacy Team.
The Federal Trade Commission has jurisdiction over Trax Retail Inc.’s compliance with the EU-
US DPF and the UK Extension to the EU-US DPF.
Transfers of personal information subject to the EU-U.S. Data Protection Framework and the
UK Extension to the EU-U.S. Data Privacy Framework to third parties, including onward
transfers
As outlined in Section 5, ‘Who do we share your personal information with?’, we sometimes
provide personal information to third parties to perform services on our behalf. If Trax Retail
Inc. transfers personal information received under the Data Privacy Framework to a third party,
the third party's access, use, and disclosure of the personal information must also be in
compliance with our Data Privacy Framework obligations, and we will remain liable under the
Data Privacy Framework for any failure to do so by the third party unless we prove we are not
responsible for the event giving rise to the damage. This also applies to any onward transfers of
personal information made by Trax Retail Inc. where that personal information is received from
the EU, EEA and the UK and is covered by this Privacy Notice.
 8. How can you request access to your personal information?
A number of Trax’s systems such as Comeet allow you to see and/or update the personal
information that we hold about you through the recruitment process. If you have personal
information that you cannot access via these systems, then you can make a request to access
your personal information by emailing: [email protected]
We may ask you for information to verify your identity and evaluate your right to access the
personal information requested. We might need to refuse access to personal information in
certain cases, such as when providing access might infringe someone else’s privacy rights or
impact our legal obligations. If we do need to refuse a request to access your personal
information, we will explain to you in writing the reason for this.

9. What other rights do you have over your personal information and how
can you exercise them?
Although individual privacy rights can vary across the jurisdictions and countries in which Trax
operate, we have adopted a general policy of applying the following rights to all our job
candidates. If there is a reason why we are unable to meet one of the rights listed below due to
where you live or apply from, we will explain this when you make contact with us.
You have the right to exercise the following in relation to your personal information:

• The right to change and/or correct inaccurate personal information that Trax holds
about you.

• The right to request that Trax erase your personal information in certain circumstances,
such as where it has been unlawfully processed, or where there is no overriding
legitimate ground for processing it.

• The right to request Trax to restrict the processing of your personal information.

• The right to request portability of your personal information in certain circumstances.

• The right to withdraw your consent to the processing of your personal information
where we are relying on your consent to do so. Withdrawing your consent will not affect
the lawfulness of any processing we carried out prior to your withdrawal, nor will it
affect processing of your personal information carried out where we are relying on
 other lawful grounds other than consent.

• If you are a Californian resident, the right to request to opt out of the sale or sharing of
your personal information with a third party and to restrict the sharing of your sensitive
personal information in certain circumstances.
You can make any of these requests by emailing: [email protected]
Please note that the above rights are not absolute. There may be instances where applicable law
or regulatory requirements allow or require us to refuse to meet your request in part or in full.
In the event we cannot accommodate your request, we will inform you of the reasons why,
subject to any legal or regulatory restrictions. We will respond to all requests in accordance with
applicable data protection laws.
Depending upon your location, you also have the right to raise a complaint about how Trax
processes your personal information with a supervisory authority.
We would always rather that you raise any complaints or concerns with Trax first before making
a formal complaint. We are usually able to resolve any concerns quickly and in partnership with
our job candidates.
If you would like to raise any concerns about how your personal information is being processed
you can raise these with your recruiting manager or contact or with Trax’s Privacy Team by
contacting: [email protected]
Enquiries and complaints for individuals in the EU and UK

Trax’s main establishment in the EU (“CVDM Solutions SAS”) and establishment in the UK (“Trax
Retail Ltd”) can be contacted to make an enquiry or raise a complaint about how your personal
information is being processed by Trax. To make an enquiry, please send an email to
[email protected] stating the relevant entity you would like to contact.
If you would rather raise a complaint directly with a supervisory authority, you can contact the
privacy team for their contact details using the email address above. You can also find a list of
the European Supervisory Authorities by following the link here:
https://ec.europa.eu/newsroom/article29/items/612080/en

For enquiries and complaints relating to personal information processed by Trax Retail Inc. in
accordance with the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data
Privacy Framework see Section 7 above, ‘The EU.U.S. Data Privacy Framework’ and the UK
Extension to the EU-U.S. Data Privacy Framework’.
 10. Revisions to this Privacy Notice
We may, from time to time, make updates or changes to this privacy notice because of changes
in applicable laws or regulations or because of changes in our personal information practices.
We will give you notice of any material changes that impact your personal information, and
where consent is necessary to make a change to our practices, we will not apply the changes to
your personal information until we have that consent.

11. Any further questions?

If you have any further questions having read the information in this Privacy Notice you can
contact your recruiting manager or contact or the privacy team at: [email protected]