Applicant/Candidate Privacy Notice

Last Reviewed: October 2024

This Applicants and Candidates Privacy Notice (“Notice or Notice at Collection”) pertains to SMBC Americas Division, its subsidiaries, and affiliates, collectively as “SMBCAD,” “we,” “our,” or “us.” It explains how SMBCAD processes personal information of applicants (an individual who has applied for an SMBCAD job opportunity) or candidate (an applicant who has progressed beyond applying for a position). SMBCAD cares about your privacy and is committed to processing your Personal Information in accordance with applicable local and regional employment, data privacy and data protection laws, rules, and regulations, as well as internal frameworks, policies, and standards. This Notice applies to Personal Information that is collected from you as a job candidate or applicant. This notice covers the job application process from initial intake of your initial application for any given role, up to and including the pre-hire process after an offer has been extended and accepted.

When appropriate, we will provide a "just in time" notice to cover any additional processing activities not mentioned in this document. If you are a California resident, please see our online privacy notice for additional disclosures regarding the information we collect and any rights you may have under California law.

If you are a resident of California, please click here for additional California-specific disclosures.

You must be 18 years or older to apply.

If you have any comments or questions about this Notice, please contact us at the contact details below.

Personal Information (“PI”) is any information that:

• identifies, relates to, describes, is capable of being associated with, or could be linked, directly or indirectly, to a living individual, whether it distinguishes them from another individual or not. PI includes SPI as defined below;class="smbc-bullet-list

Sensitive Personal Information (“SPI”) is defined as:

• PI that jurisdictions believe should be treated with a higher standard of care. Relevant examples include but are not limited to racial or ethnic origin, political, religious or philosophical beliefs, membership of trade unions, genetic data and biometric data, health, life, or sexual orientation data of a natural person.class="smbc-bullet-list

Different types of personal information may be requested from you to satisfy various legal and regulatory requirements. SMBCAD will only require the minimum amount of personal information needed to meet these obligations.

SMBCAD maintains computer systems in data centers in various jurisdictions, which may change. SMBCAD may collect, store, process, disseminate, copy, transfer or use PI and PII about you in a manner that causes the data to be transferred across borders or accessed from computer systems located or operated in another country owned or operated by or on behalf of SMBCAD (or a third-party vender to SMBCAD).

The types of personal information we collect about you:

We may collect PI/SPI about you in connection to your employment application and/or as part of the recruitment process, where permitted by applicable law, including but not limited to:

• Identification data – such as your first and last name, gender, photograph, date of birth, video/photo images or audio recordings depending on communication method;
• SPI (as defined above) – such as racial or ethnic origin, criminal convictions, biometric data for the purposes of unique identification, disability status and/or veteran status
• Contact details – such as home address, personal telephone number, personal email address, emergency contact details;
• Employment details – such as previous job title/position, compensation expectations;
• Background information – such as academic/professional qualifications, education, CV/résumé, criminal records, business or government relationships and the results of any pre-employment screening;

How we may collect, use, and disclose your personal information

The Personal Information you submit to us while applying for a job will be stored according to the laws of the jurisdiction where the prospective position may be located. The Personal Information will be reviewed and processed for business purposes outlined in the job description by SMBCAD.

Personal Information you provide to us will be collected, used, stored, transferred, disclosed or otherwise processed (“Processed”) for SMBCAD’s recruitment function and for related management, information, planning and record-keeping purposes. Processing examples include but are not limited to; determining whether you are a suitable candidate for any role(s) that you apply for, background screening, selection, arranging interviews, and onboarding. This includes ensuring all candidates are assessed against and are aligned with SMBCAD’s internal standards according to legal requirement. For these reasons, the information we collect from you is essential for our recruitment process and is in our legitimate interests as an employer, but also in the interests of our clients, regulators, and workforce members.

SMBCAD will collect and use your Personal Information to process your application and, if you are hired, to complete applicable onboarding requirements, to provide to you any services available, to communicate with you about your job application, to comply with any applicable laws, rules, regulations (collectively “laws”), and/or audits or in connection with any legal claims; to manage the relationship between you and SMBCAD; to monitor and record services whether provided by SMBCAD or a third-party; to facilitate historical requisition management; perform background verification as and where required; perform drug testing as and where required; and to

inform you about new vacancies and events relative to our recruiting initiatives, where appropriate and as permitted under applicable local laws.

Please be aware that if you refuse to provide certain required Personal Information that this notice covers in connection with your employment application, we may not be able to process your application.

Note that we may collect, use, and share information that does not identify you (including information that has been aggregated or de-identified), except as prohibited by law.

Who will have access to Personal Information?

Access to Personal Information about you will be limited to those SMBCAD employees, temporary staff, vendors, and contractors who have a need to know. Employees who “need to know”, and who would have access to your Personal Information may include internal recruiters, human resource personnel, technical services personnel, managers, and/or their respective designees. We may share Personal Information about you with selected service providers or consultants acting on our behalf, such as parties assisting SMBCAD with the application process. Those parties will be required to protect Personal Information consistent with the terms of this Notice.

SMBCAD may also disclose Personal Information about you in order to: (1) protect the legal rights, privacy or safety of SMBCAD or its workforce members (e.g. employees, agents and contractors); (2) protect the safety and security of visitors to our web sites or other properties; (3) protect against fraud or other illegal activity or for risk management purposes; (4) respond to inquiries under this notice or inquires or requests from public or other authorities; (5) permit us to pursue available remedies or limit the damages that we may sustain; (6) enforce our terms, conditions, notices or policies; or (7) comply with applicable laws or legal processes.

Who will we share your Personal Information with?

We will only allow access to Personal Information to those who require such access to perform their tasks and duties, and to third parties and service providers who have a legitimate business purpose or other lawful grounds for accessing it. We will implement appropriate measures to ensure your Personal Information is used consistent with this Notice and that its security and confidentiality is preserved when sharing with third parties.

Transfers to service providers

We make certain PI available to third parties who may provide services to us related to the application and onboarding processes. We will only share the minimum amount of data needed to fulfill the agreed-upon purpose, and in accordance with applicable data privacy laws.

For example, your PI may be made available to:

• service providers who provide us with payroll, tax, and expense administration support services;
• providers of our HR Platform, including our recruitment platform;
• service providers who provide, support, and maintain our IT, security, and communications infrastructure (including for data storage purposes) and/or provide business continuity services;
• service providers who assist in the coordination and provision of relocation, travel and/or travel permit services (in connection with work-related travel);
• service providers who provide services in relation to qualifications and background checks, e.g.;

Transfers to other third parties

We may also disclose Personal Data to third parties on other lawful grounds, including:

• Where you have provided your consent;
• To comply with our legal obligations, including where necessary to abide by law, regulation, or contract, or to respond to a court order, administrative or judicial process, including, but not limited to, a subpoena, government audit or search warrant;
• In response to lawful requests by public authorities (including for tax, immigration, health and safety, national security, or law enforcement purposes);
• As necessary to establish, exercise or defend against potential, threatened or filed legal claims;
• Where necessary to protect your vital interests or those of another person; and/or
• In connection with the sale, assignment or other transfer of all or part of our business.
• We do not sell the Personal Data we collect from and about you as described in this Notice.

Rights of Data Subjects (Applicants and Candidates)

In certain jurisdictions, consistent with applicable law and SMBCAD’s record retention policies, you may have the right to access, correct, or delete the PI that SMBCAD processes about you by logging into the Careers site and editing your profile information.

If you would like to request deletion of your profile:

Data Subject Request Form

Data Retention

We retain personal information in compliance with our records retention schedule and for as long as needed based on the purpose(s) for which it was obtained and consistent with applicable law.

The criteria used to determine our retention periods include:

• whether the information is necessary to manage our business, manage your relationship with us, or satisfy the purpose for which the information was collected,
• whether there is a legal obligation we are subject to (for example, certain laws require the retention of records related to certain transactions for a certain period),
• whether we are subject to a contractual obligation, or
• whether the information is reasonably required to protect or defend our legal rights or property (e.g., due to statutes of limitation, litigation, or regulatory investigations).

Please note that your personal information may be used for more than one purpose and may be subject to different retention periods.

Security

SMBCAD has taken reasonable steps to ensure a secure environment for your PI to be processed internally and by third parties. You understand that internet electronic communication systems may not provide a secure environment for your communications with us. It is your sole responsibility to use the appropriate level of care whenever communicating with us.

Third Party Sites and Services

This site may contain links to other web sites, or you may receive an email from SMBCAD during the recruiting process and on-boarding that may have links to external web sites, that are not subject to the same notice as SMBCAD. Those sites may send their own cookies to you and may collect information and make use of that information in ways that SMBCAD would not. Once you have left this site, this notice will no longer apply to Personal Information, or any other information collected from or provided by you.

Notice of Changes

We may change this notice to reflect our information collection, use and disclosure practices, changes in industry practices or applicable laws. Any changes will become effective when we post the notice on the site. You can tell when we last reviewed this notice by the “Last Reviewed Date” at the top of this notice.

Contact us:

Please contact HR with any questions related to this notice at: smbchronboarding@smbcgroup.com

Jurisdictional considerations

If you are applying to a role in any of the jurisdictions noted below, please click on the link provided for additional local, regional privacy provisions that apply to your personal information.

North America

• Canada
• United States

EMEA (Europe Middle East & Africa)

• Republic of Ireland

Latin America

• Brazil
• Chile
• Colombia
• Mexico
• Peru